symfony/symfony-docs — pull request #1535 by joncave (2012-07-06 15:40:48+00:00)
Title: Remove SQLi vulnerability from a 'flat PHP' example

On http://symfony.com/doc/current/book/from_flat_php_to_symfony2.html#adding-a-blog-show-page one of the examples for the flat PHP blog has an SQL injection vulnerability.

The $id parameter isn't being used in a string context so escaping it as such doesn't help! Instead it should be treated as an integer.

Maybe a little could be added to the "Worse, had you forgotten ..." line saying something like "or incorrectly used mysql_real_escape()" too :)