3 ms·

Can't you at least build a "IN (?, ?, ?)" string, if you're going to build a string dynamically?

• sellyme 5y ago
  Not only is it the case that you can do that, it's the case that you should do that. Which leads to the question of why it's not in-built functionality. Making secure code harder to write than insecure code is a great way to ensure that lots of people write insecure code.
  • adzm 5y ago
    You end up writing code with 16 ? parameters and filling the empty ones with -1 or something ;)
    • kijin 5y ago
      No, you use array_fill() and implode() to generate exactly as many placeholders as you need.