I'm building a quiz site, where I store some variables
(time taken to answer, which answer-option was chosen by the user etc etc) in $_SESSIONs after each question - where I put those stats into the DB only after the user finishes the quiz.
I've implemented a few if's to check if those $_SESSION variables are numbers (is_numeric()). Also I validate the length (strlen()) etc.
- But is there a reason to do that?
- Or is it enough just to
real_escape_string()those before storing them in MySQL? - Also if there would be many users, then won't that put a big load on the server?