Question

Apologies if this has been asked already. I’ve seen answers regarding static SQLs, but in this case I’d like to use PDO->prepare() for a query string that is built dynamically at runtime.

Breaking down into a simple example:

$TempSQL = 'SELECT field1, field2, field3 FROM table WHERE ';  if ($numberParams == 1) {     $TempSQL = $TempSQL . ' field1 = '$val1' '; } else {     $TempSQL = $TempSQL . ' field2 = '$val2' ';     $TempSQL = $TempSQL . ' AND field3 = '$val3' '; }  db->query($TempSQL); 

How do I rewrite this as a db->prepare()?

Should I build the statement->execute(array(‘:param’ => $var))) on the fly as well?

Is there a better / neater way?

Answer 1

Perhaps something like this. (untested)

$TempSQL = 'SELECT field1, field2, field3 FROM table WHERE '; $args=array();  if ($numberParams == 1) {     $TempSQL = $TempSQL . ' field1 = :val1'     $args[':val1']=$val1; } else {     $TempSQL = $TempSQL . ' field2 = :val2 and field3 = :val3';     $args[':val2']=$val2;     $args[':val3']=$val3; }  $stmt=$db->prepare($TempSQL); $stmt->execute($args);