PHP, How to secure GET variable from URL

Question

Here is URL:

http://ex.com/members.php?id=5320

Here is code:

mysqli_query("SELECT * from members where id='$_GET[id]'");

which method is secure?

Answer 1

Use prepared statements and bind variables when you're using MySQLi

$stmt = $mysqli->prepare("SELECT * from members where id=?");
$stmt->bind_param('i', $_GET['id']);
$stmt->execute();

You may also wish to validate that $_GET['id'] is an integer first, and return an error message if it isn't rather than have all the overhead of a db query to return nothing.

Read this answer to a previous question to understand why yu should take this approach