Prepared Statements in MYSQLi in combination with “SELECT WHERE IN”

Question

I'm facing a little problem with mysqli and prepared statements:

I want to prepare and "IN" statement in sqli but it does not work for me! :-(

Can someone help or explain me what I'm doing wrong? I think it's because of the way prepared statements work and therefore like some magic (strip, addslashed ...) are preventing my solution so maybe I need something else but can figure it out. This is my sql statement:

$dbPrepare = $db->prepare(
    'SELECT
    `name`, `image`
    FROM `sometable`
    WHERE `number` IN (?)'
);
$dbPrepare->bind_param('s', $numbers);

and that is my way of achieving the "$numbers":

$numbers = implode('","', explode(',', $_GET['numbers']));

the "var_dump($numbers)" result is like this: string(5) "a","b" ($_GET['numbers'] get it's value like this: &numbers=a,b)

I know, maybe not the best solution, but actually I wanna transfer (in the end could be $_POST) some data to a "IN" statement including a prepared variable.

FOR REFERENCE: this is working:

$dbPrepare = $db->prepare(
    'SELECT
    `name`, `image`
    FROM `sometable`
    WHERE `number` IN ("'.implode('","', explode(',', $_GET['numbers'])).'")'
);

So I'm quite sure it's because of the prepared variable.

Thanks in advance!

amit 1984 amit 1984 · Accepted Answer · 2014-06-26T08:02:19

Try this

$dbPrepare = $db->prepare(
    'SELECT
    `name`, `image`
    FROM `sometable`
    WHERE `number` IN (?)'
);
$dbPrepare->bind_param('s', $numbers[0],$numbers[1]);

Prepared Statements in MYSQLi in combination with “SELECT WHERE IN”

1 Answers