<p>I've never liked wrapping the </p>

<pre><code>mysql_real_escape_string 
</code></pre>

<p>function around input I expect to be integer for inclusion in a MySQL query.
Recently I came across the </p>

<pre><code>filter_var 
</code></pre>

<p>function. Nice!</p>

<p>I'm currently using the code:</p>

<pre><code>if (isset($idUserIN) 
    &amp;&amp; filter_var($idUserIN, FILTER_VALIDATE_INT) 
    &amp;&amp; 0 &lt; filter_var($idUserIN, FILTER_SANITIZE_NUMBER_INT)
    ) {
      $idUser = filter_var($idUserIN, FILTER_SANITIZE_NUMBER_INT);
      $sql = 'SELECT * FROM TABLE_NAME WHERE idUser = '.$idUser;
} else {
  // handle invalid data
}
</code></pre>

<p>Does this leave any holes open?</p>

<p>('> 0' chosen rather than '>= 0' as its a table auto_increment field, so 0 would not be a normal value)</p>

A much simpler and easier-to-read method that I use is this:
```
```
$sql = 'SELECT * FROM TABLE_NAME WHERE idUser = ' . intval($idUser);
```
```
It attempts to convert $idUser to an integer and on failure returns 0 which none of my tables have as real id's. (So I know the input was invalid if it evaluates to 0.)
To answer your actual question, no that won't leave any holes open. I suggest getting rid of the repetitive code though:
```
```
$idUserIN_filtered = filter_var($idUserIN, FILTER_VALIDATE_INT);

if (isset($idUserIN) 
    && $idUserIN_filtered 
    && 0 < $idUserIN_filtered
    ) {
      $sql = 'SELECT * FROM TABLE_NAME WHERE idUser = '.$idUser_filtered;
} else {
  // handle invalid data
}
```
```