Proper format for PDO and MySQL IN/NOT IN queries

Question

For reasons that should be obvious, this is murder to search for...

How do I do this in PDO:

SELECT thing FROM things WHERE thing_uid IN ( ... )

My particular use case is a string built by exploding an array taken from a form with several dozen checkboxes. In standard MySQL this is very easy...

$thingString = implode("', '", $thingArray);
$q = "SELECT thing FROM things WHERE thing_uid IN ('$thingString')";

but I want that to benefit from PDO's anti-injection protection... bound params and all that. So how can I do it?

Answer 1

Create an array of as many ? as you have values, and throw that into the query.

$placeholders = array_fill(0, count($thingArray), '?');
$sql = "SELECT thing FROM things WHERE thing_uid IN (" . implode(',', $placeholders) . ")";