title: Arrays as prepared statement for Search form
body: <p>I'm currently making Search form which has a lot of options with user inputs and checkboxes. I made something what actually does work, but I'm not so sure does it prevent SQL Injection ? I did used prepared statements, but I don't know is this the right way for it.</p>
  <pre class="lang-php prettyprint-override"><code>if(isset($_SERVER['REQUEST_METHOD']))
  {
  
      $_where = array();
      $_params = array();
  
      if(!empty($_POST['naziv']))
      {
          $_where[] = &quot;JSON_EXTRACT(listing_data, '$.naziv') LIKE ?&quot;;
          $_params[] = &quot;%&quot; . trim($_POST['naziv']) . &quot;%&quot;;
      }
  
      if(!empty($_POST['opsteznacajke']))
      {
          foreach($_POST['opsteznacajke'] as $opste)
          {
              $_where[] = &quot;JSON_EXTRACT(listing_data, '$.opsteznacajke') LIKE ?&quot;;
              $_params[] = &quot;%&quot; . $opste . &quot;%&quot;;
          }
      }
  
      $_where_sql = implode(&quot; AND &quot;, $_where);
  
      $stmt = $pdo-&gt;prepare(&quot;SELECT * FROM listing WHERE $_where_sql&quot;);
      $stmt-&gt;execute($_params);
      while($row = $stmt-&gt;fetch()) {
          $_data_arr[] = json_decode($row['listing_data'], true);
      }
  
  }
  </code></pre>
  <p>edit: I forgot to mention that column 'listing_data' is JSON type.</p>