Only if it wasn't cast as an integer. I usually do something like: $id = isset($_GET['id']) ? (int) $_GET['id'] : 0; It has to be treated as a float to b

Only if it wasn't cast as an integer. I usually do something like: $id = isset($_GET['id']) ? (int) $_GET['id'] : 0; It has to be treated as a float to be a problem, not as an int.