php - 如何在 Codeigniter 中使用 IN 运算符进行绑定(bind)查询

Question

“我正在调整我的一些查询，通过使用绑定(bind)参数重写它们来防止 SQL 注入(inject)。这对于简单的查询来说足够简单:

例如

// Old code 
$sql = "SELECT * FROM some_table WHERE id = 4 AND author = 'Bob'";
$this->db->query($sql);

// New Bound SQL query
$sql = "SELECT * FROM some_table WHERE id = ? AND author = ?";
$this->db->query($sql, array(4, 'Bob'));

我在使用 IN 运算符进行查询时遇到问题。按照建议here我尝试了以下方法:

// Old code 
$sql = "SELECT * FROM some_table WHERE id = 7 AND author IN ('Bob','Geoff)";
$this->db->query($sql);

// New Bound SQL query
$sql = "SELECT * FROM some_table WHERE id = ? AND author IN ?";
$this->db->query($sql, array(7, array('Bob','Geoff')));

但是此查询失败并显示错误消息:

"You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'Array' at line 6"

似乎查询正在更改为:

"SELECT * FROM some_table WHERE id = '5' AND author IN Array"

我真的看不出我做错了什么。有什么建议吗？

Answer 1

您可以使用 where_in作为

$array = array('Bob', 'Geoff');
$this->db->select('*');
$this->db->where('id', 7);
$this->db->where_in('author', $array);//WHERE author IN ('Bob', 'Geoff')
$this->db->get('some_table');