Add quotation marks to comma delimited string in PHP

Question

I have a form which is a select multiple input which POSTs values like this: option1,option2,option3 etc..

How is the best way to convert this to 'option1','option2','option3' etc...

Currenty I'm doing this, but it feels wrong??

$variable=explode(",", $variable);
$variable=implode("','", $variable);

The reason why I'm doing this is because I want to use the form select multiple inputs in a SQL Query using IN.

SELECT * FROM TABLE WHERE some_column IN ('$variable')

How does that even work out to put the first and the last `'`? Or do you put it in some code you don't show? — Francisco Presencia, Oct 07 '12 at 20:33
I edited the SQL statement where I added the quotation marks to the variable. — Per, Oct 07 '12 at 20:36
Don't build up query strings like this. Use [PDO](http://php.net/manual/en/book.pdo.php). — user229044, Oct 07 '12 at 20:37
You might be better of with `FIND_IN_SET()` then, escaping-wise. — mario, Oct 07 '12 at 20:46
Mario, how could I use this? I'm not interested in the position of the value? — Per, Oct 07 '12 at 20:54
If your csv file has a column with data "Hey, Chuck Norris" and it really meant to be a single cell, your script makes it a mess. — AKS, Oct 07 '12 at 22:21
How are you getting the PHP code to comma-delimit the incoming selected values? What's your HTML? — Jeromy French, May 20 '14 at 21:55

score 14 · Answer 1 · answered Oct 07 '12 at 20:48

14

You can wrap whatever code in a function to make the "feels wrong" feeling disapear. E.g.:

function buildSqlInClauseFromCsv($csv)
{
        return "in ('" . str_replace(",", "','", $csv) . "') ";
}

answered Oct 07 '12 at 20:48

JRL

76,767
18
98
146

What I mean by "feels wrong" is that there might be a bitter way :) Do you think this function will do it faster? – Per Oct 07 '12 at 20:55

score 4 · Answer 2 · answered Jun 28 '16 at 03:42

4

If $variable = "option1,option2,option3"

you can use:

"SELECT * FROM TABLE WHERE FIND_IN_SET(some_column, '$variable')"

answered Jun 28 '16 at 03:42

Luke Wenke

1,149
2
23
43

How to use NOT IN SET? – Kiran Reddy Feb 22 '17 at 13:45
1

Kiran Reddy: SELECT * FROM TABLE WHERE NOT FIND_IN_SET(some_column, '$variable') – Luke Wenke Aug 03 '18 at 04:27

Hardik Vyas · Answer 3 · 2015-03-04T08:01:50.553

3

we know that implode converts array to string,we need to provide the separator and then array as shown below, here we have (coma ,) as a separator. Implode breaks each element of an array with the given separator,I have conceited '(single quotes) with the separator.

 $arr = array();
    $arr[] = "raam"; 
    $arr[] = "laxman"; 
    $arr[] = "Bharat"; 
    $arr[] = "Arjun"; 
    $arr[] = "Dhavel"; 
    var_dump($arr);


    $str = "'".implode("','", $arr)."'";
    echo $str;

output: 'raam','laxman','Bharat','Arjun','Dhavel'

edited Mar 04 '15 at 08:01

answered Mar 04 '15 at 06:41

Hardik Vyas

500
1
7
27

While this may answer the question it’s always a good idea to put some text in your answer to explain what you're doing. Read [how to write a good answer](http://stackoverflow.com/help/how-to-answer). – Jørgen R Mar 04 '15 at 07:38

score 2 · Answer 4 · edited Apr 07 '14 at 01:47

2

Here is what I used:

WHERE  column IN ('".str_replace(",", "','", $_GET[stringlist])."')

edited Apr 07 '14 at 01:47

Rey Libutan

5,226
9
42
73

answered Apr 07 '14 at 01:30

boltous

31
1

Great. why implode explode, if you can do it in one line. – Ahmed Syed Aug 19 '16 at 05:11
love it. very simple solution. – Shuhad zaman Feb 16 '22 at 13:25

score -1 · Answer 5 · edited May 23 '17 at 10:29

-1

There is only one correct way to escape strings for SQL - use the function provided by the database api to escape strings for SQL. While mysyl_* provides mysql_real_escape_string():

$choices = explode(",", $variable);

foreach($choices as &$choice)
    $choice = "'".mysql_real_escape_string($choice)."'";

$choices = implode(",", $choices);

PDO provides a method that will add quotes at the same time:

$choices = explode(",", $variable);

foreach($choices as &$choice)
    $choice = $pdoDb->quote($choice);

$choices = implode(",", $choices);

^{Note that PDO::prepare doesn't really work here}

edited May 23 '17 at 10:29

Community

1
1

answered Oct 07 '12 at 20:57

Eric

95,302
53
242
374

that is good practice, but unfortunately is not an answer to the question that was asked. – Asad Saeeduddin Oct 07 '12 at 21:00
@Hammerite: Not recommending - the question implies the asker is already using it. – Eric Oct 07 '12 at 21:01
@Asad: I was under the impression it added quotes for you. Edited to use the PDO version, which does. – Eric Oct 07 '12 at 21:02

Add quotation marks to comma delimited string in PHP

5 Answers5

Linked

Related