Mysql, update where not in array php

Question

I am trying to update with 0 the rows that is not in the array I get from the xml.

$sus = array();
foreach( $xml->property as $node ) {
  $sus[] = $node->suid;
}
$A = "'".implode("','",$sus)."'";
 echo $A;
$sth = $dbh->prepare("UPDATE tabla SET alta = 0
WHERE suid NOT IN ($A)");
$sth->execute($sus);

When I echo $A it prints it out correctly like this: '60','62','65','73','74','79','83','90','112','124' However it does not do the update, whats wrong?

Answer 1

You should start by escaping your XML values to avoid SQL injection:

$escapedValues = str_repeat('?,', count($sus) - 1) . '?';
$sth = $db->prepare("UPDATE tabla SET alta = 0 WHERE suid NOT IN ($escapedValues)"
$sth->execute($sus);