How can this sql query be injected?

Question

I've a php code where I get the page number from a GET request and then run a sql query to select records from the database by the page number

$maxPerPage = 20;

$page = $_GET["p"];

$applicants = DB::query('SELECT * FROM registrees ORDER BY id DESC LIMIT 
'.$page*$maxPerPage.','.$maxPerPage);

My question is can someone inject an SQL query in this code ? and if it could happen, I need examples of the sql-injection that can run here.

The problem here that the $page is multiplied with $maxPerPage if I tried to add any string in $page php will throw this error A non-numeric value encountered.

Any ideas ?

Answer 1

The code in its current status is not running if $page is a string, so if you can't parse unexpected data, then it's not injectable. Even encoded commands would require the ability to parse more than just numerical data.