PHP内爆函数说明

Question

I am relatively new to PHP. The textbook im working from covers PHP5.2 and mentions nothing of implode. The information im getting from PHP manual is a bit unclear to me. Im looking for a short clear explanation and example on implode

• What exactly is its purpose?
• Why would you use it?
• Is it secure?

I know implode returns a string of the elements of its array but how is the following 2 exmples different, and why would you use one over the other:

example 1

$query = 'SELECT `name`, `position` 
        FROM `player_info` 
        WHERE `player_id` IN (' . implode(',', $player_ids) . ')';

example 2

 $result2 = mysql_query("SELECT `fixture_id`, `opponents` 
                         FROM `fixtures` ") or die (mysql_error());

Thank you

Answer 1

Implode can be particularly useful for lists. Say you have an array of ingredients, you might echo implode(" ",$ingredients) to show them on their own lines.

In your first example, you need to be very careful. It will only work properly if $player_ids is an array of numbers. implode() by itself is perfectly secure, however improper use can leave gaping holes in your security. A more "correct" version of that code might look like this:

$query = "SELECT `name`, `position` FROM `player_info`
  WHERE `player_id` IN ('".implode("','",array_map("mysql_real_escape_string",$player_ids))."')";

The above code also handles the case where $player_ids is empty. In your code, it will result in a MySQL syntax error (IN () is not valid), whereas in this code it will simply look for IN (''), which will match no rows.

Another use for implode might be when packing numbers. Say you have an array of digits, you might implode("",$digits) to pack them into a single string (and str_split($string) to unpack them).

In short, there are many potential uses for this function, and generally it will be obvious when the function applies. Try not to think too hard about it ;)