绕过mysql_real_escape_string（）的SQL注入

考虑以下查询：

$iId = mysql_real_escape_string("1 OR 1=1");    $sSql = "SELECt * FROM table WHERe id = $iId";

mysql_real_escape_string()

''

$iId = (int)"1 OR 1=1";$sSql = "SELECt * FROM table WHERe id = $iId";