My question is similar to before, but now the code has changed completely. I would like to understand if this code is vulnerable to mysql injection.
<?php
// Define our querystring variables
$option = (array_key_exists('option', $_POST) ? $_POST['option'] : false);
$view = (array_key_exists('view', $_POST) ? $_POST['view'] : false);
$id = (array_key_exists('id', $_POST) ? intval($_POST['id']) : false);
// Check wheter our variables are correct in order to proceed
if ($option == 'com_content' && $view == 'video' && $id > 0) {
// Connect to the database
include_once("../configuration.php");
$cg = new JConfig;
$con = mysqli_connect($cg->host,$cg->user,$cg->password,$cg->db);
if (mysqli_connect_errno()) {
die('n/a');
}
// Add new hit: Update the `times_viewed` field corresponding to specific video id
$query = "UPDATE " . $cg->dbprefix . "hdflv_upload
SET `times_viewed` = `times_viewed` + 1
WHERE `id` LIKE " . $id . ";";
if (mysqli_query($con, $query) === true) {
// Get the updated `times_viewed` of video id
$query = "SELECT `times_viewed`
FROM " . $cg->dbprefix . "hdflv_upload
WHERE `id` LIKE " . $id . ";";
$result = mysqli_fetch_assoc(mysqli_query($con, $query));
}
// close the connection to the database
mysqli_close($con);
$addone = $result['times_viewed'];
echo $addone;
}
?>