How to use array values in SQL query in PHP_MySQL

Question

I am taking multiple values from user from a drop down list. I stored those values in an array in php. Everything is fine. Now I want to use these array values to query my database to give the desired results. My html code is

<select multiple name="equipment[]">
    <option  value="all">ALL</option>
    <option  value="helmet">HEMLMET</option>
    <option  value="boots">BOOTS</option>
    <option  value="jacket">JACKET</option>
    <option  value="flask">FLASK</option>
</select>

$equipment=$_POST['equipment'];

I used this piece to store values.

Now based on one or more values in the array; I want filter my query.

Select w,x,y,z from table_a inner join table_b where table_a.w="the values in array";

I tried using foreach to loop through, but its taking only the last value. thank you for your help.

score 3 · Answer 1 · edited May 23 '17 at 12:22

Keep in mind that HTML, PHP, and MySQL are three different processing environments, so none of them share the same memory (variables) or code (e.g. loops).

Roughly in order:

HTML can "pass" values to PHP through URLs and form posts (and other HTTP methods)
PHP can "pass" values to MySQL by printing its variables into the MySQL "query string" (beware of MySQL string injection)
MySQL returns its data to PHP, based on the query string, through the query engine.
PHP can "pass" values to HTML by printing its variables into the HTML output.

So, to get the variable selections to MySQL from PHP, you need to compose a "query string" that looks for all of the answers.

It will look something like this:

SELECT w,x,y,z
FROM table_a
INNER JOIN table_b
WHERE table_a.w IN ('helmet', 'boots', 'jacket');

See MySQL Expression syntax for more help on this.

To build it, you will need to be VERY CAREFUL to read the "MySQL string injection" (where a person using your web page can change the calls your database makes) question linked above, since you are taking the values from the "user"/"client" (through a URL or form post).

The answers to Can I bind an array to an IN() condition? have some good suggestions for how to build a query string with array values while preventing injection attacks.

score 1 · Accepted Answer · answered Oct 06 '15 at 16:23

It's the IN clause you are looking for:

select * from tableA inner join on tableB on ... where tableA.w in ('value1', 'value2')

You can use a loop or implode() function in php to generate the in clause. Just be mindful that if you select only 1 item in the control, then $_POST['equipment'] will be a string, not an array. So, use is_array() to determine if multiple values were selected.

score 0 · Answer 3 · answered Oct 06 '15 at 18:04

<form action='somepage.php' method='POST'>
    .
    .
    <select multiple name="equipment[]">
        <option  value="all">ALL</option>
        <option  value="helmet">HEMLMET</option>
        <option  value="boots">BOOTS</option>
        <option  value="jacket">JACKET</option>
        <option  value="flask">FLASK</option>
    </select>
    .
    .
</form>

somepage.php

<?
$equipment=$_POST['equipment'];

$TotalEquipment=sizeof($equipment); //Count total number of equipements selected
$values=""; //initialize values as empty.

for($i=0;$i<$TotalEquipment;$i++)
{
    $valu=$equipment[$i];
    if($i==0)
    {
        $values="'".$valu."',";
    }
    else
    {
        $values=$values."'".$valu."',";
    }
}

$values=rtrim($values, ","); //For removing last comma (,) from the string

$Query="SELECT w,x,y,z 
        FROM table_a
        INNER JOIN table_b
        WHERE table_a.w IN ($values)";

//Here, execute your $Query with appropriate mysql functions

?>

Enjoy Coding. Cheers.

How to use array values in SQL query in PHP_MySQL

3 Answers3