title: Blind SQL Injection
body: <p>when i use acunetix on my page i get a: Blind SQL/XPath injection</p>
  
  <p>header:
  GET /file.php?id=2'+and+31337-31337=0+--+&amp;page=2</p>
  
  <p>response:
  <h1>no files found</h1> (sometimes it shows results)</p>
  
  <p>here is my php code:</p>
  
  <pre><code>$id = (int) htmlentities($_GET['id']);
  $fileid = mysql_real_escape_string($id);
  </code></pre>
  
  <p>the query:</p>
  
  <pre><code>SELECT * FROM `files` WHERE `id` = '".$fileid."'
  </code></pre>
  
  <p>what am i doing wrong? can someone erase my database just with this?
  im also getting the same message at some queries almost equal to that one but that also have limit 0,1</p>
  
  <p>i'm using paginator (i fixed some injections that where in that script) but the example i gaved its not using it</p>