php pass multiple value from select list to sql

Question

I have a form has select list with multiple selecting option, what I need is to pass the multiple values to the sql statement in php.

example of the select list

<select name="site_name" size="10" multiple="multiple">
              <option selected="selected">Select ...</option>
              <option>UV</option>
              <option>US</option>
              <option>PI</option>
</select>

and this should pass UV or and US or and PI to the sql statement example

$sql = "SELECT Web_Page_Name FROM sites where Web_Page_Name =" $site_name[] ;

the previous is incorrect and I am looking for your help to know the correct sql statement to pass the multiple values.

Asaph · Accepted Answer · 2012-08-18 23:38:31Z

2

You can construct a sql statement using the IN keyword:

SELECT Web_Page_Name FROM sites where Web_Page_Name IN ('UV', 'US', 'PI');

As a sidenote, watch out for SQL injection vulnerabilities.

edited Aug 18, 2012 at 23:38

answered Aug 18, 2012 at 23:33

Asaph

163k25 gold badges204 silver badges204 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

Pipo Over a year ago

thanks for your reply, I want to use the in clause as an array from the selected values of the select list. they will not be fixed values.

Asaph Over a year ago

@Pipo You'll have to build that string dynamically in PHP. There is no array parameter type. As I stated in the answer, be mindful of SQL injection vulnerabilities.

Pipo Over a year ago

Thanks again, I'll check this source to have this

Pipo · Accepted Answer · 2012-08-19 12:58:17Z

0

I have implemented it as below

1- I have changed the select list code to the below:

<select name="site_name[]" size="10" multiple="multiple">
              <option selected="selected">Select ...</option>
              <option>UV</option>
              <option>US</option>
              <option>PI</option>
</select>

2- sql statement in the 2nd page as below

$sql = "SELECT * FROM sites WHERE Web_Page_Name IN ('"
. implode("', '", $_POST['site_name'])
. "')";

this is working good with me now

answered Aug 19, 2012 at 12:58

Pipo

3097 silver badges24 bronze badges

2 Comments

Asaph Over a year ago

You did not heed my advice. The code in this answer is vulnerable to SQL Injection. You cannot simply call implode() directly on the $_POST variables. Each value must be encoded first.

Pipo Over a year ago

hello, really I appreciate your help and caring to reply to me, I have tried the above and it working on most browsers without any problem, now I have the values inside sql statement an showing results.

Collectives™ on Stack Overflow

php pass multiple value from select list to sql

2 Answers 2

3 Comments

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

3 Comments

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related