is_numeric or a numeric preg_match?

php, security

Solution

Here is what is_numeric() considers to be a numeric string:

Numeric strings consist of optional sign, any number of digits, optional decimal part and optional exponential part. Thus +0123.45e6 is a valid numeric value. Hexadecimal notation (0xFF) is allowed too but only without sign, decimal and exponential part.

If you only want to check if a string consists of decimal digits 0-9, you could use ctype_digit().

Problem

I read on a forum that you can't completely trust is_numeric(). It lets through "0xFF" for example which is an allowed hexadecimal... So my question is can you trick is_numeric? Will I need to use a regex to do it correctly?

Original source