How can I pass an array of PDO parameters yet still specify their types?

前端 未结 3 1777
$sql = \"SELECT * FROM table WHERE id LIKE CONCAT(\'%\', :id, \'%\')
LIMIT :limit1, :limit2\";

I want to still use the array input like this:

3条回答
  •  没有蜡笔的小新
    2020-12-01 18:40

    Why bind limit values when they're not user input?

    $start = 0;
    $limit = 20;
    $sql = "SELECT * FROM table WHERE id LIKE CONCAT('%', :id, '%')
        LIMIT $start, $limit";
    

    Even if $start and $limit are determined from user input, say from a $_GET, you can test the value with is_int().

提交回复
热议问题