If you do positive validation, you probably won't be affected by this. In other words: check that the id is a string with digits only. Don't search for invali

If you do positive validation, you probably won't be affected by this. In other words: check that the id is a string with digits only. Don't search for invalid characters like ASCII NUL or for clever escapes, because there are too many ways of abuse. Use ctype_digit() for numerical ids and stop with a validation error if ctype_digit() does not return TRUE. https://www.php.net/manual/en/function.ctype-digit.php https://www.php.net/manual/en/function.ctype-digit.php For more complicated cases (like an id with lowercase letters and digits) preg_match() can be used, for example: preg_match('/^[a-z0-9]+$/').