SELECT email FROM users WHERE status IN()

[davidolson]

If i check more than one checkbox. I dont get any value from database.

 

HTML

<form method="post">
    <input type="checkbox" name="receiver[]" value="cheater">CHEATER
    <input type="checkbox" name="receiver[]" value="un-verified">UN-VERIFIED
    <input type="checkbox" name="receiver[]" value="inactive">INACTIVE
    <input type="checkbox" name="receiver[]" value="active">ACTIVE
    <input type="submit" name="submit" value="ADD">
</form>

PHP

$errors = array();
$success = NULL;
$error = NULL;
$var['receiver'] = isset($_POST['receiver']) ? $_POST['receiver'] : NULL;
.................

if(!empty($_POST['submit'])){
    // FORM VALIDATION //
}

if(!empty($_POST['submit']) and empty($errors)){
	
    $status = array_map('strval', $var['receiver']) + array(0);
    $statusSql = implode(',', $status);
	
    $query = 'SELECT email FROM users WHERE status IN("'.$statusSql.'")';
    $select = $db->prepare($query);
    $select->execute();
	
    $arrayData = array();
    while($row = $select->fetch(PDO::FETCH_ASSOC)){
        $arrayData[] = $row['email'];
    }
	
    $errors[] = implode(',', $arrayData);
	
}

require_once 'includes/antiCsrf/index.php';
$csrf = new antiCsrf();

$smarty->assign('success', $success);
$smarty->assign('error', $error);
$smarty->assign('errors', $errors);
$smarty->assign('csrfKey', $csrf->csrfKey());
$smarty->assign('csrfToken', $csrf->csrfToken());
$smarty->assign('var', $var);
.................

[mac_gyver]

i recommend that you echo the $query value so that you can see if it is what you expect.

 

also, why are you putting external data values into the sql query statement, then preparing the query? you use a prepared query by putting place-holders into the sql query statement where the data values are at, then you bind the actual data to the place-holders.

[CroNiX]

What does $status look like after you do this:

$status = array_map('strval', $var['receiver']) + array(0);

I'm not sure what that array(0) is supposed to do. Shouldn't those be square brackets and why are you adding that anyway?

 

Besides that, it doesn't look like your database is normalized for your statuses. It seems those should be IDs instead of their names.

[davidolson]

Tried this way and it is working

$query = 'SELECT email FROM users WHERE status IN("active", "inactive", "un-verified", "cheater")';
$select = $db->query($query);

[Barand]

Your join() isn't putting the statuses in quotes. It will give

 

IN (active,inactive,un-verified,cheater)

[davidolson]

WOKRKING QUERY

$status = array_map('strval', $var['receiver']);
$statusSql = implode('","', $status);
    
$query = 'SELECT email FROM users WHERE status IN("'.$statusSql.'")';
$select = $db->query($query);