Even if you are filtering your input, a good and easy to implement safety measure is to cast all numeric values in the SQL statement.

• 即便你过滤了输入的信息，将SQL声明中所有数字型的值进行指引也不失为一个又好又容易执行的安全方法。