You might try something like this:
$createSqlString = `INSERT INTO results (var, var, var) VALUES ';
$vars = array();
for($x = 0; $x < $auctionobjects; $x ++) {
/* processing ... */
$vars[] = "($val1, $val2, $val3)";
}
$createSqlString .= implode (',', $vars);
implode
is pretty nice for these SQL-style comma separated lists.
If you wanted to be really careful about bind variables to prevent injection attacks, you could try this:
$createSqlString = `INSERT INTO results (var, var, var) VALUES ()';
$sqls = array();
$vals = array();
for($x = 0; $x < $auctionobjects; $x ++) {
/* processing ... */
$sqls[] = '(?,?,?)';
$vals[] = $val1;
$vals[] = $val2;
$vals[] = $val2;
}
$createSqlString .= implode (',', $vars);
/* then bind the $vals array to the statement and execute it */