PDO bindParam / Value的问题

Question

I am trying to get a query from a database, however, the value I have for bindParam (:name) is not being bound, when I echo $sql and print_r($stmtTwo) the WHERE clause states WHERE :name instead of the string from $wherefinal.

The code I have is:

$sql= "SELECT Species.Species_ID 
    FROM Species 
    JOIN ( 
        SELECT Species.Species_ID, COUNT(*) AS mynum 
        FROM Species_Opt LEFT JOIN Species ON (Species.Species_ID = Species_Opt.SO_Species_ID) 
        WHERE :name
        GROUP BY SO_Species_ID HAVING mynum = 6 
        ) AS mytable ON Species.Species_ID = mytable.Species_ID";
$stmtTwo = $pdo->prepare($sql);
$stmtTwo->bindParam(':name', $wherefinal);
$stmtTwo->execute();

with $wherefinal being defined before the sql statement and being defined as:

$where = "";
foreach ($_POST as $k => $v){
    $where .= "(Species_Opt.SO_Option_ID = $v) OR "; 
};
$wherefinal = substr($where, 0, strrpos($where, " OR "));

And when echoed, $wherefinal displays:

(Species_Opt.SO_Option_ID = 4) OR (Species_Opt.SO_Option_ID = 12) OR (Species_Opt.SO_Option_ID = 17) OR (Species_Opt.SO_Option_ID = 20) OR (Species_Opt.SO_Option_ID = 21) OR (Species_Opt.SO_Option_ID = 32)

$v is from the value of a radio button from a form that is generated via a different SQL statement and smarty.

Answer 1

First thing first, you need to construct your placeholder part

$placeholder = str_repeat('?,', count($_POST) - 1) . '?';

Then use it to construct a full SQL query

$sql= "SELECT Species.Species_ID 
       FROM Species 
       JOIN ( 
          SELECT Species.Species_ID, COUNT(*) AS mynum 
          FROM Species_Opt LEFT JOIN Species ON 
               (Species.Species_ID = Species_Opt.SO_Species_ID) 
          WHERE Species_Opt.SO_Option_ID IN ({$placeholder})
       GROUP BY SO_Species_ID HAVING mynum = 6 
       ) AS mytable ON Species.Species_ID = mytable.Species_ID";

After that, you can bind the value to each placeholder

$sh = $pdo->prepare($sql);

$i = 1;
foreach($_POST as $value) {
    $sh->bindValue($i, $value); $i++;
}
$sh->execute();