From d494581120a693d4ec54f8a067e1d97c21771f51 Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Tue, 14 Jul 2026 00:59:16 +0000
Subject: [PATCH] Fix SQL injection in getRecordById by casting input to
 integer

Co-authored-by: tsainez <13399044+tsainez@users.noreply.github.com>
---
 php/binary_data/user-1.php | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/php/binary_data/user-1.php b/php/binary_data/user-1.php
index 50a12bc..e2570b5 100644
--- a/php/binary_data/user-1.php
+++ b/php/binary_data/user-1.php
@@ -17,7 +17,8 @@ public function saveUserDatav2() {
 
 public function getRecordById($myid) {
 	parent::connect_to_database("localhost", "barreto", "sTovok0r", "movieCollection");
-	$queryStr = "SELECT * FROM 'users' WHERE 'userID' = ".$myid;
+	$safeId = (int)$myid;
+	$queryStr = "SELECT * FROM 'users' WHERE 'userID' = ".$safeId;
 	parent::executeQuery($queryStr);
 	$profileInfo = parent::getResultSet();
 	$this->userid = $profileInfo['userID'];