title: How do I use $_GET["id"] securely with PDO query?
body: <p>I'm trying to get the id of a page from the url and use it to retrieve the information from the database. I want to ensure that the id is an integer with a length less than 4 and redirect to a parent page if not.</p>
  
  <pre><code>if(isset($_GET["id"])) {
      $id = (int) $_GET["id"];
      // If id is longer than 4 redirect
      if(strlen($id) &gt; 4) {
          header("Location: /parent.php");
          exit;
      }
      try {
          $sth = $dbh -&gt; prepare("SELECT id, title, etc, FROM table WHERE id = :id");
          $sth -&gt; bindParam(':id', $id, PDO::PARAM_INT);
          $sth -&gt; execute();
      } catch(PDOException $e) {
          // print $e -&gt; getMessage();
          echo "Error";
          exit;
      }
      $feature = $sth -&gt; fetch(PDO::FETCH_ASSOC);
      // If query result is empty redirect
      if($feature == false) {
          header("Location: /parent.php");
          exit;
      }
      $sth = null;
  } else { // If id isn't set redirect
      header("Location: /parent.php");
      exit;
  }
  </code></pre>
  
  <p>Is the way I'm doing this secure/correct? I'm still getting to grips with this sort of thing so am second guessing myself.</p>
  
  <p>Also, it seems to work as I intended except when the id is set to something like 123abc (child.php?id=123abc) which it interprets as 123 and still loads the information for id 123. Because I'm casting the type is it just ignoring the abc part? Should I be concerned that it still loads and doesn't redirect to parent?</p>