MYSQL query WHERE php array

Question

I have a page where a user can select multiple check boxes and then submit the form, on the next page it displays what they checked with more details. but my query is not working. how can i pass the checkbox data to the mysql query to get the rest of the data.

this is my query:

$c=$_POST['select'];

$result=mysqli_query($con, 'SELECT * FROM item WHERE item_number IN ("'.implode('","', $c).'")');

echo "<table border='1'>
<tr>
<th>item name</th>
<th>item number</th>
</tr>";
while($row = mysqli_fetch_array($result))
{
  echo "<tr>";
  echo "<td>" . $row['item_name'] . "</td>";
  echo "<td>" . $row['item_number'] . "</td>";
  echo "</tr>";
 }
  echo "</table>";


mysqli_close($con);

when running the query i get this error:

Warning: mysqli_fetch_array() expects parameter 1 to be mysqli_result, boolean given

it returns no results but if i echo the query and copy paste into mysql i get the results, but when running from PHP i get only the error.

any help would be greatly appreciated

why it's not working? what's the error you get from the db or from the webserver? — STT LCU, Apr 17 '13 at 13:07
What is $c? Also, you should really be protecting your database by running all the values through mysqli_real_escape_string() — Seth, Apr 17 '13 at 13:07
try to echo $c do you get a value if you get a value your question is answerd — Sven van den Boogaart, Apr 17 '13 at 13:08
@Seth You think `mysqli_real_escape_string()` really makes strings SQL-friendly in PHP? Uh oh... — Grant Thomas, Apr 17 '13 at 13:10
i know i need to protect it, i'm just trying to get it working first. — Andrew Lindemulder, Apr 17 '13 at 13:10
Try echoing out `mysqli_error($con)` to see what the error is — Brendan Bullen, Apr 17 '13 at 13:14
Warning: mysqli_fetch_array() expects parameter 1 to be mysqli_result, boolean given — Andrew Lindemulder, Apr 17 '13 at 13:17
first try to echo query and paste it here, I guess the query being made is creating issues — Darshit Gajjar, Apr 17 '13 at 13:31
That is the error when trying to fetch the resulting rows. You need the error when executing the query. It could just be failing as $con isn't a valid connection to the db — Kickstart, Apr 17 '13 at 13:32

score -1 · Answer 1 · answered Apr 17 '13 at 13:44

Updated version of your code to put out an error message on the query if there is one. Also sanitises the input

<?php
if (is_array($_POST['select']))
{
    $c = array_map('array_map_callback', $_POST['select']);

    $result = mysqli_query($con, 'SELECT item_name, item_number FROM item WHERE item_number IN ("'.implode('","', $c).'")') OR die(mysqli_error($con));

    echo "<table border='1'>
    <tr>
    <th>item name</th>
    <th>item number</th>
    </tr>";
    while($row = mysqli_fetch_array($result))
    {
        echo "<tr>";
        echo "<td>" . $row['item_name'] . "</td>";
        echo "<td>" . $row['item_number'] . "</td>";
        echo "</tr>";
    }
    echo "</table>";
    mysqli_close($con);
}
else
{
    echo "No items selected";
}

function array_map_callback($a)
{
  global $con;
  return mysqli_real_escape_string($con, $a);
}

?>

Hopefully this should put out the message of what is wrong with the query.

score -4 · Answer 2 · answered Apr 17 '13 at 13:09

-4

$c does not seems to be PHP Array, so it can not be imploded here

answered Apr 17 '13 at 13:09

Ilya

141
6

1

"if i echo the ("'.implode('","', $c).'") i get the values" – Andrew Lindemulder Apr 17 '13 at 13:12
what kind of data type do you get from $_POST['select'] - valid PHP array or sting? – Ilya Apr 17 '13 at 13:14
yup, it prints all of my values selected from the form if i echo it. – Andrew Lindemulder Apr 17 '13 at 13:16

MYSQL query WHERE php array

2 Answers2