Database IN() operators + array are broken

[Ninos Ego]

I found the ticket #11100 after I searched for a solution with escaping in IN operators. I think the solution in [12156] is very nice. But if you have nothing in your array, you get a database error. So here's my solution :)

$in = count($postmetaids) ? implode( ',', array_fill(1, count($postmetaids), '%d')) : 'NULL';
$wpdb->query( $wpdb->prepare("DELETE FROM $wpdb->postmeta WHERE meta_id IN($in)", $postmetaids ));

This codesnippet is for #11100 and should work like a charm. But I think there are another places with the solution like in [12156]...

PS: Maybe it would be also nice to include a solution for arrays in the $wpdb->prepare() function like %as (string array), %ad (decimal array) %af (float array)

Thanks

[pento]

Thanks for the report, Ninos!

This was fixed in [18500], when delete_post_meta_by_key() changed over to using delete_metadata().

As for passing an array to $wpdb->prepare(), this behaviour isn't supported by regular prepare functions, so I don't think it'd be a good fit.

[nacin]

Duplicate of #18196.

[Ninos Ego]

Replying to pento:

As for passing an array to $wpdb->prepare(), this behaviour isn't supported by regular prepare functions, so I don't think it'd be a good fit.

But it would solve a lot of time passing an array through the prepare-function. The core, plugins and themes would be also more secure and a little bit lighter. If you want I can pull a patch.

PS: is it maybe better to create for that a new ticket?