title: PHP/MySQL: Using array elements in WHERE clause using prepared statements
body: <p>I want to make a "dynamic" <code>WHERE</code> clause in my query based on a array of strings. And I want to run the created query using Mysqi's prepared statements.</p>
  
  <p>My code so far, PHP:</p>
  
  <pre><code>$searchArray = explode(' ', $search);
  $searchNumber = count($searchArray);
  $searchStr = "tags.tag LIKE ? ";
  for($i=1; $i&lt;=$searchNumber-1 ;$i++){
      $searchStr .= "OR tags.tag LIKE ? ";
  }
  </code></pre>
  
  <p>My query:</p>
  
  <pre><code>SELECT tag FROM tags WHERE $searchStr;
  </code></pre>
  
  <p>More PHP:</p>
  
  <pre><code>$stmt -&gt; bind_param(str_repeat('s', count($searchArray)));
  </code></pre>
  
  <p>Now this obviously gives me an error since the bind_param part only contains half the details it need.</p>
  
  <p>How should I proceed?</p>
  
  <p>Are there any other (better) way of doing this?</p>
  
  <p>Is it secure?</p>