Question

I’m working on a tagging system using 3 tables (normalised). I wanted to create a prepared statement for when some searches for example “red apples”, that it brings up all the items which have been tagged “red” and “apples”.

Currently my query looks something like this:

$stmt = $db->prepare("SELECT co.content_id, co.description FROM em_content AS co LEFT JOIN em_contenttags AS ct ON co.content_id = ct.content_id LEFT JOIN em_tags AS ta ON ct.tag_id = ta.tag_id WHERE ta.tag IN (?)");
$stmt->bind_param("s", $query);
$stmt->execute();
$stmt->store_result();

I’ve tried making $query an array and using placeholders for the “?” in the query and “s” in the bind_param variable, but I can’t pass the $query as an array otherwise it throws an error.

Is there any way to make this work with prepared statements?

Just FYI, I’m not using PDO, I’m using mysqli

Answer 1

You’ll have to build up the placeholders dynamically, so you’ll have one ? for each element of the array:

$array = array('foo', 'bar', 'baz');
$placeholders = join(',', array_fill(0, count($array), '?'));
$stmt = $db->prepare('SELECT ... WHERE IN (' . $placeholders . ')');
$stmt->execute($array);

Not 100% sure how to use MySQLi’s bind mechanism here, the above works for PDO.