Using String as array and use it in a query

Question

I am working on a PHP file and getting via POST this string:

$temas = $_POST['temas']; //$temas = ".45.12.34"

Where each of the numbers should be the id for a table record.

And I have following query

$query = "SELECT * FROM tb_preguntas WHERE tema = '".$temas."'";

I need to put in the WHERE part of the query each of the received id

Something like that: ... WHERE tema = 45 OR tema = 12 OR tema = 34

Of course, on each execution the string changes.

I have tried using the PHP explode function, but I don't know how to implement the result in the query.

@DevsiOdedra, you mean first remove the dot(.), then replace (.) with (,) and finally use WHERE IN($temas) . ? — mvasco
– mvasco, Commented Sep 7, 2018 at 7:52
you're open to SQL injection and probably should look to resolve :) — treyBake
– treyBake, Commented Sep 7, 2018 at 7:57
@mvasco I could write up an answer explaining that you should first sanitise your input a bit trim($temas, '.'); to remove any unnecessary periods, then you could do str_replace('.', ',', $temas); to get it into the correct format for an SQL IN.... But i think really that's a really shitty answer for you :), this looks like an xy problem xyproblem.info. The way you're trying to do it is a bit shonky/dangerous, so a better answer for you would require more details, such as why is your POST format looking like ".45.12.34", can we improve that? — SubjectCurio
– SubjectCurio, Commented Sep 7, 2018 at 7:58
@mvasco sad but it happens! What's the next step in your code? What are you feeding your $query to? — SubjectCurio
– SubjectCurio, Commented Sep 7, 2018 at 8:00

treyBake · Accepted Answer · 2018-09-07 12:18:26Z

4

My answer won't differ too much from everyone else's but it is an answer to address SQL injection + a solution

$temas = implode(',', explode('.', $_POST['temas']));
$temas = trim($temas);

$res = $conn->prepare('select * from `tb_preguntas` WHERE `tema` in (:temas)');
$res->execute(array(':temas' => $temas));

here we use a prepared statement, now you're code is safe woop woop

edited Sep 7, 2018 at 12:18

answered Sep 7, 2018 at 8:14

treyBake

6,5698 gold badges28 silver badges64 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

SubjectCurio Over a year ago

Much better to address the SQL injection issue as well rather than just ignoring it for the sake of internet points

Dawson Irvine · Accepted Answer · 2018-09-07 08:00:21Z

1

As suggested above you can use the IN() function of mysql, however you have to remove the first period '.' and change the rest to commas ','.

$query = "SELECT * FROM `tb_preguntas` WHERE `tema` IN('".str_replace('.',',',trim($temas,'.'))."') ";

answered Sep 7, 2018 at 8:00

Dawson Irvine

3444 silver badges19 bronze badges

Comments

Aurangzeb · Accepted Answer · 2018-09-07 08:13:34Z

1

best case scenario

$temas = implode(',', explode( '.', $_POST['temas']));
$query = "select * from tb_preguntas WHERE tema in (" . $temas . ")";

but your case, . comes first that makes life so much harder, so a better solution would be

$temas1 = explode( '.', $_POST['temas'] );
$temas2 = array();
foreach( $temas1 as $value ) {
   if( is_numeric( $value )) $temas2[] = $value;
}
$query = "select * from tb_preguntas WHERE tema in (" . implode( ',' , $temas2 ) . ")";

edited Sep 7, 2018 at 8:13

answered Sep 7, 2018 at 7:57

Aurangzeb

1,66614 silver badges10 bronze badges

1 Comment

user2399035 Over a year ago

you probably have to first trim the first dot in the $temas variable...

Mark Salvania · Accepted Answer · 2018-09-09 12:37:35Z

1

Use explode() to split those numbers by .And it must turn into array.

Then run your queries into a loop using the lenth of the array like this:

$id = explode('.',$temas);
    foreach($id as $temas_id) {    
      $query = "SELECT * FROM tb_preguntas WHERE tema = '".$temas_id."'";
      if(isset($conn->query(query ))) {
        // Execute code here if there's a result.
      }
    }

edited Sep 9, 2018 at 12:37

answered Sep 7, 2018 at 8:01

Mark Salvania

4843 silver badges17 bronze badges

Comments

Hiren Spaculus · Accepted Answer · 2018-09-07 08:49:40Z

0

Please try this code.

$temas = $_POST['temas']; 

$temas = explode('.',$temas);

$query = mysql_query("SELECT * FROM test_stipe WHERE tema in '".implode("', '", $temas)."'");

This code is working fine.

answered Sep 7, 2018 at 8:49

Hiren Spaculus

8056 silver badges6 bronze badges

Collectives™ on Stack Overflow

Using String as array and use it in a query

5 Answers 5

1 Comment

Comments

1 Comment

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

5 Answers 5

1 Comment

Comments

1 Comment

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related