绑定PDO的参数数量无效

Question

I am using a tutorial for this project, however I am trying to expand on what was provided in the material. I am trying to use a function which creates the query just before binding the values to create a query with more than 3 WHERE values.

Here is the code:

private function action($action, $table, $where = array()){
    $operators = array('=', '>', '<', '>=', '<=' , 'AND' ,'OR', 'LIKE', 'GROUP BY','ORDER BY', 'ASC', 'DESC');
if(!empty($where)){
    $sql = "{$action} FROM {$table} WHERE ";
    if(count($where) > 3){
            $isVal = FALSE;
            $values = '';
            foreach ($where as $value) {
                    switch(trim($value)){
                        case '=':
                        case '>':
                        case '<':
                        case '>=':
                        case '<=':
                            $sql .= "{$value}";
                            $isVal = true;
                        break;
                        default:
                            if($isVal){
                                $sql .= " ? ";
                                $values .= $value;
                                $isVal = false;
                            }else{
                                $sql .= "{$value}";
                            }
                        break;
                    }

            }

        if(!$this->query($sql, $values)->error()){return $this;}

  /////////////////////////////////////////
 // From this point down everything works!!!
 ////////////////////////////////////////////
    }else if(count($where) === 3){
        $field      = $where[0]; 
        $operator   = $where[1];
        $value      = $where[2];
        if(in_array($operator, $operators)){
            $sql = "{$action} FROM {$table} WHERE {$field} {$operator} ?"; // NO $value ?
            if(!$this->query($sql, array($value))->error()){return $this;}
        }
    }
}else{
    // If array is empty
    $sql = "{$action} FROM {$table}";
    if(!$this->query($sql)->error()){return $this;}
}
return FALSE;
}

Section where nested Else IF statement reads count($where) === 3 works fine, however the first nested IF 'count($where > 3)` throws me an error.

I am trying to find a way to set this up correctly so that I can use more than just 3 where values.

Also here is my query binder:

public function query($sql, $params = array()){
        $this->_error = FALSE;
        if($this->_query = $this->_pdo->prepare($sql)){
            $x = 1;
            if(count($params)){
                foreach($params as $param){
                    $this->_query->bindValue($x, $param);
                    $x++;
                }
            }// End IF count    

            if($this->_query->execute()){
                    $this->_lastID = $this->_pdo->lastInsertId();
                    try{
                        $this->_results = $this->_query->fetchAll(PDO::FETCH_OBJ);
                    }catch(Exception $e){
                        // Catch Error
                    }
                    $this->_count = $this->_query->rowCount();
            }else{

                $this->_error = TRUE;}
        }
        return $this;
    }

If anyone can help me out with this I will be very grateful ... Thank you!

Answer 1

There are some problems here, for example:

1. $values in your first method is a concatenated string. Casting that to an array will give you an array with 1 element which is not what you need. You would need an array with all values separated, something like $values[] = $value; instead of $values .= $value;.
2. You will run into problems when you try to add combinations of OR and AND statements as grouping using parenthesis makes a lot of difference there.
3. You are using a prepared statement for the values but there is no check on the column names to prevent sql injection. You should use a white-list there.