Re: Secure "where in(a,b,c)" clause.

["William Temperley" <willtemperley@xxxxxxxxx>]

Thanks for the replies,

"Rodrigo E. De León Plicet" <rdeleonp@xxxxxxxxx> wrote:
>Use a prepared query and ANY, e.g.:
>select st_collect(the_geom) from tiles
>where tilename = any('{foo,bar,baz}');

Thanks, that's what I was looking for!
$sql = "select uid, accredited as acc, x(the_geom), y(the_geom) from clubs
where st_within(the_geom, (select st_collect(the_geom) from tiles
where tilename = any($1)))";

$result = pg_query_params($sql, array('{'.$tilearr.'}'));

Though a regex would do as well I guess.

Cheers

Will