Question

I did make a post previously but was not able to properly explain my issue nor was I able to get it resolved. This is what I have.

$shoutlines = file($shout_file);

$aTemp = array();
foreach($matches['user'] as $user) {
    $aTemp[] = "'" . $user . "'";
}
$user = implode(",", $aTemp);

$rara = "SELECT * FROM accounts WHERE username IN ( $user )"; // Tried this statment both as a query and prepared statement
$getlevel = $db->query("SELECT * FROM accounts WHERE username IN '( ".$user." )'"); // Tried this both as a query and prepared statement
//$getlevel->bind_param('s', $user);
//$getlevel->execute();
//$level = $getlevel->get_result();
//$getlevel->store_result();
while($getdb = $getlevel->fetch_assoc()){
    //output the html
        for($i = 0; $i < (1000); $i++)
        {
            if(isset($shoutlines[$i]))
            {

                $shoutline = preg_replace('/<\/div>\n/', ' ', $shoutlines[$i], 1);
                echo showSmileys($shoutline) . "<div class='delete'><a href='javascript: delete_shoutline({$i});' title='Delele'>delete</a></div></div>";
            }
        }
}

I have a for loop within the while loop that will not run within it, if I move the for loop outside of the while it works fine, but I need it in the while loop to make checks of the users for post titles, abilities etc., that are saved in my database. I have shown what I have tried so far when to comes to identifying the problem, I have tried dieing out errors if the query, binds, or executes weren’t showing true, but got now hits. The code for this is pulled out so there isn’t too much clutter for your reading abilities, any help with this would be greatly appreciated.

Answer 1

When “exploding” the username, you need ot wrap each username in quotes, not the whole thing. Also make the names safe for data entry.

$aTemp = array();
foreach($matches['user'] as $user) {
    $aTemp[] = '"' . mysql_real_escape_string($user) . '"';
}
$user = implode(",", $aTemp);

Then use the first query:

"SELECT * FROM accounts WHERE username IN ( $user )";

---

Edit: adding error checking:

$getlevel = $db->query("SELECT * FROM accounts WHERE username IN ( $user )");
if ($getlevel == false) {
    // Normally you'll build into a function or class, but this is the simple example
    // Never output SQL errors on a live site, but log to file or (if you can do it safely) the database.
    echo 'Whoopsie<br />';
    var_dump($db->errorInfo());
    exit();
}