problem with mysqli

[lional]

Hi All

I am converting my scripts from mysql to mysqli and I am having some difficulty

$query = mysqli_query($conn,"SELECT * FROM products WHERE prod_id IN (");
foreach ($_SESSION['cart'] as $key => $value) {
$query .= $key . ',';
}
$query = substr ($query, 0, -1) . ')';
$result = mysqli_query($conn, $query) or die(mysqli_error($conn));

			while ($row = mysqli_fetch_array($query, MYSQLI_ASSOC)) {
			
	 
      
			
	
}

I get the following error

 

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '1111)' at line 1

 

I have tried to change it with my limited knowkledge. I am not asking for the answer just to point me in the right direction.

 

Any help will be appreciated

[requinix]

$query is supposed to be a string. That part shouldn't have been "converted".

[lional]

Thanks, I will look and see why it is doing that and try to rectify it

[maxxd]

Also, a major point of the newer DB classes is to allow the use of prepared statements so that you're not creating SQL injection opportunities like you've done here. Personally, I recommend PDO over Mysqli as I find it easier to use, but it may not be possible for you to switch at this point in your project. Either way, do some research on prepared statements - it'll make your life much easier (and safer) in the long run.

[ginerjm]

1 - why are you even doing a query on line1 (where the error is coming from)?

 

2 - your foreach is pulling the key value from an array to use as the 'value' of a query statement.  Is that what you want?  Seems like you would want ot use the $value of the array loop, not the key.

[Psycho]

Not tested

 

//Get all of the IDs of the cart items
$cartIDs = isset($_SESSION['cart']) ? array_keys($_SESSION['cart']) : array();
//Filter out non-integer values
$cartIDs = array_filter(array_map('int_val', $cartIDs));
//Verify that valid values were passed
if(!count($cartIDs))
{
    //Error condition
    echo "No valid cart items passed";
}
else
{
    //Create the query
    $query = "SELECT * FROM products WHERE prod_id IN (" . implode(',', $cartIDs) . ")";
    //Run the query
    $result = mysqli_query($conn, $query) or die(mysqli_error($conn));
    while ($row = mysqli_fetch_array($query, MYSQLI_ASSOC))
    {
        //Do something with $row
    }
}

[Jacques1]

I'm having a déjà vu.

 

We've gone through this exact problem back in 2016. The OP has been told over and over and over again to either switch to PDO or finally learn mysqli. There was never any reaction, and now we're back to square one.

 

At this point, I think everything as been said by everybody. Now it's up to the OP to actually absorb the information.