<p>嘗試綁定一個陣列（第一個陣列綁定）以防止SQL注入</p><p>這是有效的程式碼：</p><p><br /> ;</p> <pre class="lang-php prettyprint-override"><code>if (isset($_POST['checkbox_selected'])) { $valuesArr = array(); foreach ($_POST['checkbox_selected'] as $key => $value) { //檢索Array ID以查找CSVOption列的行號 $findrow = array_search_partial($attributeid, $value); //在表單提交時，屬性值被指派給屬性 id $attribute = $value; $csv = $csvcolumn[$findrow]; $valuesArr[] = "('$userid', '$feed_id', '$attribute', '$csv')"; } $sql = "INSERT INTO map (user_id, feed_id, attribute_id, csvcolumn) values "; $sql .= implode(',', $valuesArr); mysqli_query($conn,$sql); } </code></pre> <p>我無法綁定該數組，已嘗試：</p> <pre class="brush:php;toolbar:false;">$sql = "INSERT INTO map (user_id, feed_id, attribute_id, csvcolumn) VALUES (?, ?, ? ,?)"; $stmt = $conn->prepare($sql); $stmt->bind_param('iiii', implode(',', $valuesArr)); $stmt->execute(); echo implode(',', $valuesArr) //('1', '1', '13', '9') //這是被插入到SQL中的陣列 //(user_id, feed_id, attribute_id, csvcolumn) //這裡是第一個語句中分配的值</pre> <p><br /></p>

if (isset($_POST['checkbox_selected']))
{
    $sql = "INSERT INTO map (user_id, feed_id, attribute_id, csvcolumn) VALUES (?, ?, ?, ?);";
    // prepare only has to happen once
    $stmt = mysqli_prepare($conn,$sql);

    mysqli_begin_transaction($conn);
    try {
        foreach ($_POST['checkbox_selected'] as $key => $value) {
            $findrow = array_search_partial($attributeid, $value);
            $attribute = $value;            
            $csv = $csvcolumn[$findrow];
            
            $stmt->bindParam('iiii', $userid, $feed_id, $attribute, $csv);
            $stmt->execute();
        }
        mysqli_commit($conn);
    } catch(mysqli_sql_exception $e) {
        mysqli_rollback($conn); // immediately roll back changes
        throw $e; // re-throw exception
    }
}