title: How can I use IN-operator for bound queries in Codeigniter
body: <p>"I am adapting some of my queries to prevent SQL injection by rewriting them with bound parameters. This is straightforward enough for simple queries:</p>
  
  <p>e.g. </p>
  
  <pre><code>// Old code 
  $sql = "SELECT * FROM some_table WHERE id = 4 AND author = 'Bob'";
  $this-&gt;db-&gt;query($sql);
  
  // New Bound SQL query
  $sql = "SELECT * FROM some_table WHERE id = ? AND author = ?";
  $this-&gt;db-&gt;query($sql, array(4, 'Bob'));
  </code></pre>
  
  <p>I am having trouble getting this to work for queries using the IN operator. As suggested <a href="https://www.codeigniter.com/userguide3/database/queries.html" rel="nofollow">here</a> I have tried the following:</p>
  
  <pre><code>// Old code 
  $sql = "SELECT * FROM some_table WHERE id = 7 AND author IN ('Bob','Geoff)";
  $this-&gt;db-&gt;query($sql);
  
  // New Bound SQL query
  $sql = "SELECT * FROM some_table WHERE id = ? AND author IN ?";
  $this-&gt;db-&gt;query($sql, array(7, array('Bob','Geoff')));
  </code></pre>
  
  <p>However this query fails with the error message:</p>
  
  <blockquote>
    <p>"You have an error in your SQL syntax; check the manual that
    corresponds to your MySQL server version for the right syntax to use
    near 'Array' at line 6"</p>
  </blockquote>
  
  <p>It seems the query is getting changed to:</p>
  
  <pre><code>"SELECT * FROM some_table WHERE id = '5' AND author IN Array"
  </code></pre>
  
  <p>I really can't see what I'm doing wrong. Any suggestions?</p>