why not using filter_input or casting it ? e.g $userId = (int)$_GET["userId"]; and also when query to db using parameter binding ?