title: How to prevent mysql injection when using mysql IN clause without activeRecord in Yii?
body: <p>I have an array with ids that I get from client. And I want use those ids in my sql query with <code>IN</code> clause. But this query goes on a table that has no model. So there is no active record (criteria) query possible.</p>
  
  <p>** Table userTasks **</p>
  
  <pre><code>--------------------
  | idUser | idTasks |
  ---------+----------
  |    1   |    1    |
  ---------+----------
  |    1   |    2    |
  ---------+----------
  |    1   |    3    |
  ---------+----------
  </code></pre>
  
  <p>First approach does not work because params are always considered as strings. So <code>:tasks</code> is a string '1,2,3' instead of a comma separated list of ids:</p>
  
  <pre><code>$sql = 'SELECT COUNT(*) AS matches 
          FROM userTasks 
          WHERE idUser = :idUser 
            AND idTask IN (:tasks)';
  $result = Yii::app()-&gt;db-&gt;createCommand($sql)
    -&gt;queryRow(true,[
      ':idUser' =&gt; $idUser,
      ':tasks' =&gt; implode(',', $tasks)]); //$tasks is a simple array of ids [1,2,3]
  </code></pre>
  
  <p>So my workaround:</p>
  
  <pre><code>foreach($tasks as $task) //$tasks is a simple array of ids [1,2,3]
  {
    $inTasks[] = (int) $task;
  }
  
  $sql = 'SELECT COUNT(*) AS matches 
          FROM userTasks 
          WHERE idUser = :idUser 
          AND idTask IN (' . implode(',', $inTasks . ')';
  $result = Yii::app()-&gt;db-&gt;createCommand($sql)
    -&gt;queryRow(true,[':idUser' =&gt; $idUser]);
  </code></pre>