How to build a mysql query in php that uses an "IN" clause

Question

I was working on a search form that stores people's names in an array, and then wanted to create a query on the results page in PHP that uses an IN clause (if that's the best way; feel free to point me in another direction). Basically the page has checkboxes for all the names, so they can check one, many or all names. I tried using the implode function, but have been unsuccessful so far.

$yourName = implode("', '", $_POST['Your_name']);

if($dutyReq=="All" && $yourName!="All" ) $query="SELECT * FROM talent_eas WHERE Your_name IN ('$yourName')";

Does that look at all right? Would that handle all scenarios? I'm just starting out with PHP so I have no idea what I'm doing. I tried searching for my specific question but just didn't seem to see much use of the IN clause.

It looks "ok", but you're wide open to SQL injection attacks. — Marc B
– Marc B, Commented Sep 10, 2012 at 16:23
good point.... so would this do the trick to protect it? $yourName = mysql_real_escape_string($yourName); — richfranzen
– richfranzen, Commented Sep 10, 2012 at 16:35
@user1658726 it would b enough in this case but ideally you want to be looking at using PDO with mysql. Research that, you might as well learn how to do it properly — Zevi Sternlicht
– Zevi Sternlicht, Commented Sep 10, 2012 at 16:47

rationalboss · Accepted Answer · 2012-09-10 16:45:21Z

1

Yes, that how to use IN. Here are some more examples:

SELECT * FROM users WHERE name IN ('John','Jane');

SELECT * FROM some_table WHERE the_month IN ('January','April','September');

Also, please read on SQL Injections.

For your comment:

You need to use mysql_real_escape_string BEFORE the implode. So your code should be:

$yourName = implode("', '", mysql_real_escape_string($_POST['Your_name']));

edited Sep 10, 2012 at 16:45

answered Sep 10, 2012 at 16:25

rationalboss

5,3973 gold badges32 silver badges50 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

richfranzen Over a year ago

i modified it to: $yourName = implode("', '", $_POST['Your_name']); $yourName = mysql_real_escape_string($yourName); but that seems to break it

rationalboss Over a year ago

i updated my answer - the formatting for code looks better there

richfranzen Over a year ago

i tried it with the example you showed above, but it tells me that i have bad arguments in the implode function

Shail · Accepted Answer · 2012-09-10 16:27:43Z

0

You can Use

SELECT * FROM talent_eas WHERE Your_name IN ('shail','jyoti');

I suggest you to read Mysql Injection, else your code can be hacked easily

answered Sep 10, 2012 at 16:27

Shail

1,58511 silver badges24 bronze badges

Comments

Rezigned · Accepted Answer · 2012-09-10 16:46:47Z

0

Here's few ways to prevent SQLi

# 1. Map each name with escape function
$yourname = implode("', '", array_map('mysql_real_escape_string', $_POST['Your_name']));

# 2. Use PDO with prepare statement (with placeholders e.g. (?, ?, ?)
$placeholders = array_fill(0, sizeof($_POST['Your_name']), '?');
$stmt         = $pdo->prepare('SELECT * FROM talent_eas WHERE Your_name IN ('.implode(', ', $placeholders).')';

$stmt->execute($_POST['Your_name']);

answered Sep 10, 2012 at 16:46

Rezigned

4,9501 gold badge22 silver badges19 bronze badges

Collectives™ on Stack Overflow

How to build a mysql query in php that uses an "IN" clause

3 Answers 3

3 Comments

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

3 Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related