使用implode时出现CSV错误

Question

Please help, I'm new in Yii. I want to generate and export CSV file from checked rows in CGridView. When I use static SQL query it works normally, but when I use implode function in WHERE clause - controller returns an error. My button that called controller action:

$this->widget('bootstrap.widgets.TbButtonGroup', array(
'type' => 'primary',
'size'=>'mini',
'buttons' => array(
    array(
        'label' => 'Export',
        'type' => 'success',
        'buttonType'=>'ajaxLink',
        'encodeLabel'=>true,
        'icon'=> 'th white',
        'url'=>Yii::app()->createUrl('/propertyPurchaseSale/ExportChecked'),
        'ajaxOptions'=>array(
        "type" => "post",
        "data" => "js:{ids:$.fn.yiiGridView.getSelection('property-purchase-sale-grid')}",
        "update" => '#', 'success'=>"js:function(data) {window.location.assign('/propertyPurchaseSale/ExportChecked');}"),                                                
                              array( //htmlOptions
                                    )                                    
                                ),
                array(
                    ...
                ),
                ),
            ));

My controller action:

public function actionExportchecked() {
        header('Content-type: text/csv');
        header('Content-type: multipart/form-data');
        header('Content-Disposition: attachment; filename="Export_(' . date('H-i_d.m.Y') .').csv"');
        header('Content-Transfer-Encoding: binary'); 
        header('Expires: 0');
        header('Cache-Control: must-revalidate, post-check=0, pre-check=0');
        header('Content-Description: File Transfer');
                    $fp = fopen('php://output', 'w');

        if(Yii::app()->request->isAjaxRequest)
        {
            if(isset($_POST['ids']))
            {       
                $idx = $_POST['ids'];
                $count=Yii::app()->db->createCommand('SELECT COUNT(*) FROM property')->queryScalar();
                // $sql='SELECT * FROM property WHERE id  IN (981, 982, 985)';  --> when I use static values - all work
                $sql="SELECT * FROM property WHERE id IN('".implode("', '",$idx)."')";  // --> when I use join or implode function - data exist in firebug, but page return error 500

                $dataProvider=new CSqlDataProvider($sql, array(
                    'totalItemCount'=>$count,
                    'sort'=>array(
                        'attributes'=>array(
                             'fullname', 'address', 'phone', 'db_number', 'created_date'
                        ),
                    ),
                    'pagination'=>false,
                ));
                                    fputs($fp, $bom =( chr(0xEF) . chr(0xBB) . chr(0xBF) ));
                                    if ($fp)
                                    {                        
                        echo    PropertyPurchaseSale::model()->getAttributeLabel("id").";".
                                    PropertyPurchaseSale::model()->getAttributeLabel("fullname").";".
                                PropertyPurchaseSale::model()->getAttributeLabel("address").";".
                                PropertyPurchaseSale::model()->getAttributeLabel("phone").";".
                                PropertyPurchaseSale::model()->getAttributeLabel("db_number").";".
                                PropertyPurchaseSale::model()->getAttributeLabel("created_date").
                                " 
";                        
                        foreach ($dataProvider->getData() as $data) {
                            echo $data['id'] . '; ' . $data['fullname'] . '; ' . $data['address'] . '; ' . $data['phone'] . '; ' . $data['db_number'] . '; ' . $data['created_date'] . '; ' . "
";
                        }
            }
                    exit;
                }
            }}

Please, help, what am I doing incorrectly?

Answer 1

My knee-jerk reaction is that there is nothing confirming that $_POST['ids'] is an array. If it is just a string, then implode will fail, the SQL will be improperly formatted, and that would lead to a 500 level error.

Perhaps this might work:

// check for empty, that way invalid entry won't go through
if(!empty($_POST['ids'])) {
    // Check if it is an array
    $input_idx = is_array($_POST['ids'])?
        // if so, then use it as an array
        $_POST['ids']:
        // If not, you need to turn it into an array. I'm only guessing that this should 
        // be a ','. It could be a " " or some other character(s)
        explode(',',$_POST['ids']);
    // Remove all non-numeric items in the array.
    $idx = array_filter($input_idx, 'is_numeric');
    if(!$idx) {
        // Do something with bad data.
    }
    // continue with the line $count = ...

You should also look to making sure that the data is sanitary as those IDs could include SQL injection. (Perhaps this answer)