title: filter_input and mysqli_real_escape_string for integers
body: <p>I'm developing a simple PHP database application for internal use but would like to code it to best practices. Some of my pages are receiving integer values from GET requests and I'm just wondering how much validation and sanitation is really required.</p>
  
  <p>Currently I'm using <code>$num = filter_input(INPUT_GET, 'num', FILTER_VALIDATE_INT, $num_options);</code> with specified min and max values. From here I'm exiting with an error message if <code>$num == false</code></p>
  
  <p>Is it necessary to also use <code>$mysqli-&gt;real_escape_string($num);</code> </p>
  
  <p>Currently I am not bothering because I think it's quite hard to do SQL injection using an integer...</p>
  
  <p>Thanks,</p>
  
  <p>Kevin</p>
  
  <p>UPDATE: To clarify the query I'm doing looks like this</p>
  
  <pre><code>$sql = "SELECT employeeID, concat(FirstName, ' ', LastName) as Name FROM employee WHERE employeeID='$num'";
  </code></pre>