具有不同參數計數的PHP PDO語句

Question

我最近開始使用php PDO來防止SQL注入，雖然我的語句有問題，但它會根據我通過URL傳遞的參數更改頁面結果。我正在努力的部分是，如何在URL的cat_id添加到我的執行數組時，如何添加$_GET['cat_id']。這裏有一個工作版本，但顯然很容易SQL注入，預先感謝任何幫助！

PHP

$and = ''; 
if (isset($_GET['cat_id'])) { 
    $and = "AND art_cat_id = ".$_GET['cat_id']; 
} 

$statement_article = $db->prepare("SELECT * FROM app_articles WHERE art_sta_id = :art_sta_id $and ORDER BY art_date DESC"); 

$statement_article->setFetchMode(PDO::FETCH_ASSOC); 

$statement_article->execute(array(':art_sta_id' => "1")); 

這裏就是我試過，但如果在URL中有cat_id失敗

PHP

$and = ''; 
if (isset($_GET['cat_id'])) { 
    $and = "AND art_cat_id = :cat_id"; 
} 


$statement_article = $db->prepare("SELECT * FROM app_articles WHERE art_sta_id = :art_sta_id $and ORDER BY art_date DESC"); 

$statement_article->setFetchMode(PDO::FETCH_ASSOC); 

$statement_article->execute(array(':art_sta_id' => "1",':cat_id' => $_GET['cat_id'])); 

Answer 1

調整參數數組有一個時cat_id：

$and = ''; 
$params = array(':art_sta_id' => "1"); 

if (isset($_GET['cat_id'])) 
{ 
    $and = "AND art_cat_id = :cat_id" 
    $params[':cat_id'] = $_GET['cat_id']; 
} 

$statement_article = $db->prepare("SELECT * FROM app_articles WHERE art_sta_id = :art_sta_id $and ORDER BY art_date DESC"); 

$statement_article->setFetchMode(PDO::FETCH_ASSOC); 

$statement_article->execute($params);