再举一个例子:

$galleryIds = [1, '2', 'Vitruvian Man'];
$ids = array_filter($galleryIds, function($n){return (is_numeric($n));});
$ids = implode(', ', $ids);

$sql = "SELECT * FROM galleries WHERE id IN ({$ids})";
// output: 'SELECT * FROM galleries WHERE id IN (1, 2)'

$statement = $pdo->prepare($sql);
$statement->execute();

正如Flavius Stef的回答，你可以使用intval()来确保所有id都是int值:

$ids = join(',', array_map('intval', $galleries));  
$sql = "SELECT * FROM galleries WHERE id IN ($ids)";

除了使用IN查询，您还有两个选择，因为在IN查询中存在SQL注入漏洞的风险。您可以使用循环来获得所需的确切数据，也可以使用带有or大小写的查询

1. SELECT *
      FROM galleries WHERE id=1 or id=2 or id=5;


2. $ids = array(1, 2, 5);
   foreach ($ids as $id) {
      $data[] = SELECT *
                    FROM galleries WHERE id= $id;
   }

无PDO的安全方法:

$ids = array_filter(array_unique(array_map('intval', (array)$ids)));

if ($ids) {
    $query = 'SELECT * FROM `galleries` WHERE `id` IN ('.implode(',', $ids).');';
}

将$ids变量强制转换为数组 将所有数组值转换为整数 移除重复的值 删除零值 内爆连接所有值到IN选择

所有交易所:

$query = "SELECT * FROM `$table` WHERE `$column` IN(".implode(',',$array).")";

字符串:

$query = "SELECT * FROM `$table` WHERE `$column` IN('".implode("','",$array)."')";

假设你事先正确地清理了你的输入……

$matches = implode(',', $galleries);

然后调整你的查询:

SELECT *
FROM galleries
WHERE id IN ( $matches ) 

根据数据集适当地引用值。