# fix: Prevent SQL injection in whereIn clause

## Description

Previously, the `whereIn` method in the `Select` statement directly interpolated values into the SQL query string by wrapping them in single quotes. This approach is highly vulnerable to SQL injection, as malicious input in the `$value` array could alter the query's intent and potentially lead to unauthorized data access or manipulation.

This commit addresses this critical security vulnerability by switching to a prepared statement approach for the `WHERE IN` clause. Instead of direct string concatenation, values are now added to the internal `$this->params` array, and database-specific placeholders are generated using `Utilities::get_placeholder()`. This ensures that all values are properly escaped and bound by the underlying database driver, effectively preventing SQL injection attacks.

## Changes in the codebase

-   **`src/Statement/Select.php`**:
    -   In the `whereIn` method, the anonymous function responsible for formatting the list of items for the `IN` clause has been modified.
    -   The line `return "'" . $item . "'";` has been replaced.
    -   Each `$item` from the input `$value` array is now first added to the `$this->params[]` array, making it available for parameter binding.
    -   `Utilities::get_placeholder($this->db, $item)` is now used to generate a database-agnostic placeholder for each item, ensuring safe parameterization regardless of the database system.

Author: AbmSourav

composer.json

@@ -1,7 +1,7 @@
 {
     "name": "codesvault/howdy-qb",
     "description": "Mysql Query Builder for WordPress",
-    "version": "1.7.0",
+    "version": "1.7.1",
     "minimum-stability": "stable",
     "scripts": {
         "test": "phpunit",

src/Statement/Select.php

@@ -115,7 +115,8 @@ public function andNot(string $column, ?string $operator = null, $value = null):
     public function whereIn(string $column, ...$value): self
     {
 		$list = implode(', ', array_map(function($item) {
-			return "'" . $item . "'";
+			$this->params[] = $item;
+			return Utilities::get_placeholder($this->db, $item);
 		}, $value));
 
         $this->sql['whereIn'][] = 'WHERE ' . $column . " IN ($list)";