如何正确地将数组转换为 sql 字符串 [重复]

Question

说我有这个：

$term_query = "AND t.slug IN ('" . $term_slugs . "') ";

其中$term_slugs id 是这样的数组：

array('foto', 'video');

如果我做一个简单的 implode()，它不会工作，因为它不能是“照片，视频”。所以我应该做一个foreach循环来构建“'照片'，'视频'”。 但我不能认为这是唯一的方法......真的很不​​雅。还有其他更聪明的方法吗？

Answer 1

你可以使用：

$term_query = "AND t.slug IN ('" . implode("','",$term_slugs) . "') ";

但是准备好的语句更好：

$term_query = "AND t.slug IN ('" . implode(",",array_fill(0,count($term_slugs),"?") . ") "

现在可以绑定参数了：

PDO 绑定

$stmt = $pdoObject->prepare($query); //Query is the full query which contains the parametrised $term_query 
foreach ($term_slugs as $index => &$slug) {
    $stmt->bindParam($index+1,$slug); //+1 because PDO parameters are index starting from 1
}

MySQLi 绑定

$stmt = mysqli_prepare($query); //Query is the full query which contains the parametrised $term_query 
$refArray = [ $stmt, array_fill(0,$term_slugs),"s") ]; //first two parameters for bind param
foreach ($term_slugs as $index => &$slug) {
    $refArray[] = &$slug; //mysqli_bind_param needs references
} 
call_user_func_array('mysqli_bind_param',$refArray);