Question

I’m trying to pass in an unknown number of parameters (from 1-10) using an array to prepare my SQL statement for execution in PHP.

function executeStatement ($myArray) {

    //for example, $myArray = ("one", "two", "three")

    $qry = "SELECT * FROM table WHERE FieldA LIKE ".$myArray[0]." OR FieldA LIKE ".$myArray[1]." OR FieldA LIKE ".$myArray[2].";

    $result = mysql_query($qry) or die("Query failed with error: ".mysql_error());
}

Whats an efficient way to pass in N number of parameters using the array?

Answer 1

Not really sure how to do it with a prepared statement, but if I am understanding the questions correctly the below should work

$queryStr = "SELECT * FROM `table` WHERE ";
foreach($myArray as $single){
    $queryStr .= "$addStr`FieldA` LIKE '".mysql_real_escape_string($single)."'"; //Note the mysql_real_escape_string, this should help guard against sql injection
    $addStr = ' OR ';
}
$query = mysql_query($queryStr) or die(mysql_error());

Additionally, I would recommend using = instead of LIKE unless you are going to use wildcards