Question

I have a MySQL table with ID as a primary key and other for this matter non-important fields.
What I would like to do is delete multiple records by sending a list of IDs for deletion as a parameter to stored procedure.

I know how to do this manually (building a query directly in PHP) but I would like to avoid that and do all my SQL directly in the DB.

Tried searching SO but couldn’t find any related questions. Sorry if this is a duplicate.

Thanks

Answer 1

I gave +1 to @Marc B for clever use of FIND_IN_SET(). It won’t be able to use an index, so the performance won’t be good, but it should work.

Another solution that can work (but will be slow as well, because it can’t use an index):

DELETE FROM sometable 
WHERE CONCAT(',', param, ',') LIKE CONCAT('%,', idfield, ',%')

The solution that @Andrej L describes isn’t really parameter binding, it’s interpolation of a stored procedure argument into a dynamic SQL string prior to preparing it.

SET sql = CONCAT('DELETE FROM sometable WHERE idfield IN (', param, ')');
PREPARE stmt FROM sql;
EXECUTE stmt;

You can’t parameterize a list of values with a single parameter, even if the parameter’s value looks like a comma-separated list of integers.

Interpolation can work, and it will benefit from an index, but be careful to filter the string so it contains only numeric digits and commas. Otherwise you introduce a significant risk of SQL injection (debunking the claim that some people make that stored procedures are inherently more secure).