an input field to a PHP application can not be trusted to have any specific contents. After the
input is converted to a number via a function such as intval(), it can be trusted to be a number;
however, it cannot be trusted to have a specific numeric value until other checks are
performed.