title: SQL Injection via URL parameter
body: <p>I just saw in my webstats that someone appended a lot of SQL code to one url parameter. The URLs look like this:</p>
  
  <pre><code>http://www.example.com/page.php?id=672%3f%20and%28select%201%20from%28select%20count%28*%29%2cconcat%28%28select%20%28select%20concat%280x7e%2c0x27%2cunhex%28hex%28cast%28database%28%29%20as%20char%29%29%29%2c0x27%2c0x7e%29%29%20from%20%60information_schema%60.tables%20limit%200%2c1%29%2cfloor%28rand%280%29*2%29%29x%20from%20%60information_schema%60.tables%20group%20by%20x%29a%29%20and%201%3d1
  
  http://www.example.com/page.php?id=convert%28int%2cdb_name%28%29%29--
  
  http://www.example.com/page.php?id=999999.9%20union%20all%20select%200x31303235343830303536%2c0x31303235343830303536%2c0x31303235343830303536%2c0x31303235343830303536%2c0x31303235343830303536%2c0x31303235343830303536%2c0x31303235343830303536%2c0x31303235343830303536%2c0x31303235343830303536%2c0x31303235343830303536%2c0x31303235343830303536%2c0x31303235343830303536%2c0x31303235343830303536%2c0x31303235343830303536%2c0x31303235343830303536%2c0x31303235343830303536%2c0x31303235343830303536%2c0x31303235343830303536%2c0x31303235343830303536%2c0x31303235343830303536%2c0x31303235343830303536%2c0x31303235343830303536--
  </code></pre>
  
  <p>and some more...</p>
  
  <p>My code looks like this:</p>
  
  <pre><code>$myid = intval($_GET['id']);
  $stmt = $con-&gt;prepare("SELECT *
  FROM mytable AS r
  WHERE r.ID =:ID");
  $stmt-&gt;bindValue(':ID', $myid, PDO::PARAM_INT);
  </code></pre>
  
  <p>My questions are:
  Is my code secure?
  And how can I check what the result of these queries was? I mean my page only echos the variables I asked for. But the attacker of course wants to see the things he/she queried for.</p>