MySql在循环中准备语句

Question

我希望检查表中数组存储值的出现.像这样的数组:

$myarray=array("122","123","124","125");

我不想在查询中内爆数组,因为它不安全.

SELECT ledger FROM mytable WHERE ledger IN('".implode("','",$myarray)."')

我想去准备好安全声明.我试图在for循环中运行查询,但它失败了.

$not = sizeof($myarray);
for ($i = 0; $i < $not; $i++) {
    $qc = 'SELECT ledger FROM mytable WHERE ledger = ?';
    $st = $mysqli->prepare($qc);
    $st->bind_param("i", $myarray[$i]);
    $st->execute();
    $ro = $st->num_rows;
    if ($ro > 0){
        echo "number exists";
        break;
    }
}

这会抛出"对非对象调用成员函数bind_param()"错误.我相信有更好的方法可以做到这一点.有什么建议？

Answer 1

这将为您提供原始查询的参数化版本。

$in = '';
$myarray = array('1', '2', '3');
foreach($myarray as $value) {
    $in .= '?, ';
}
//or $in = str_repeat("?, ", count($myarray)); in place of foreach
$query = 'SELECT ledger FROM mytable';
if(!empty($in)) {
    $in = '(' . rtrim($in, ', ') . ')';
    $query .= " where ledger IN $in";
}
echo $query;
//$st = $mysqli->prepare($query);
//$st->execute($myarray);
//$ro = $st->num_rows;

输出：

SELECT ledger FROM mytable where ledger IN (?, ?, ?)

然后您可以fetch对结果进行处理并获取ledgers找到的所有内容。