Question

I have a query (PHP, Mysql) a table named ‘table’ that looks like this:

 id | name
-------------
  6 | abc
  10| xxx
  52| def

And a query:

$ids = '5,62'

$name = $pdo -> prepare('SELECT id, name FROM table WHERE id IN ( :ids )');
$name -> bindValue(':ids', $ids, PDO::PARAM_STR); 
$name -> execute();
$name = $name->fetchAll(PDO::FETCH_ASSOC);
print_r($nazwa);

I would expect to get a result like

 id | name
-------------
  6 | abc
  52| def

Unofrtunately i get only:

 id | name
-------------
  6 | abc

As if second value would be ignored. If I change the query to:

$name = $pdo -> prepare('SELECT id, name FROM table WHERE id IN (' $ids ')');

It all goes right. Can you tell me why prepared statement doesnt take under consideration imploded table with commas?

Answer 1

Because the comment field does not allow to write that well, here an answer that is merely a comment:

Let’s say you have two IDs:

$name = $pdo->prepare('SELECT id, name FROM table WHERE id IN ( :id1, :id2 )');

Let’s say you have three IDs:

$name = $pdo->prepare('SELECT id, name FROM table WHERE id IN ( :id1, :id2, :id3 )');

You see the pattern? You have as many values as you have IDs. Formulate the prepare statement as well as perform the bind statements accordingly to the number of IDs you have.

So the answer is: You need to change your code so that it actually reflects the number of IDs you want to handle. The MySQL server will not magically interpret a comma-separated list inside a string as multiple IDs. Instead you need to tell the server about each single ID.