qa_db_query_sub with IN(#) not working?

Question

When executing a query with IN(#)

            $eventsconsidered = '"student_reserved", "student_paid", "tutor_accepted"'';

            $eventlogs = qa_db_read_all_assoc(
                                qa_db_query_sub('SELECT datetime, userid, eventid, eventname, params
                                                    FROM `^booking_log`
                                                    WHERE eventid = #
                                                    AND eventname IN(#)
                                                ;', $eventid, $eventsconsidered)
                                            );

it does not work.

When putting the string directly instead of the "#" it works.

What do I have to pass then?

Comments

+1 Thanks for asking this question. I had the same issue few times ago but was busy so overlooked and didn't even realized to post here (so bad). Thanks once again...!

Answer 1

The qa_db_query_sub function is for escaping untrusted user input. But it only accepts single parameters.

So what's happening is it's escaping your list of strings and looking for something that matches the whole string as one, not each of the 3 strings.

If the strings are completely defined by you then it's perfectly safe to put them directly into the query.

Comments

So I would directly use:

    AND eventname IN('.$eventsconsidered.')

---

Yes, as long as $eventsconsidered is specified by you, and not user input, it's fine to do that.

---

+1 @Scott, Thanks for explaining the issue. I had the same issue. It's clear now..