Zend准备语句中的IN子语句

Question

I am working on a project in which i need to use prepared statements to prevent sql injections. Although i find the syntax to be used for queries for update,delete and insert statements. but for select query Its not working for IN sub statement. I am trying to do as follows :

 $arr= 'tomwased,eshantsahu';
 $this->_db->fetchAll("select username,password from user where username in (?)",array($arr)));

but its not working.I am getting the string $arr from other code.

Answer 1

$arr                   =   array('tomwased','eshantsahu');
$db                     =   Zend_Registry :: get('db');
$select                 =   $db->select(); 
$select                 ->  from("user",array('username','password'))
                       ->  where("username in ?",$arr); 
$stmt                   =   $db->query($select);
$result             =   $stmt->fetchAll(); 

Answer 2

you can use statement like below

$productIds = array(1, 2, 3);

$select = $db->select()
             ->from('products',
                    array('product_id', 'product_name', 'price'))
             ->where('product_id IN (?)', $productIds);

And to convert as for user

$username = array('tomwased','eshantsahu');

$select = $db->select()
             ->from('user',
                    array('username', 'password '))
             ->where('username IN (?)', $username );

hopw this will sure work for you