IN() in PDO: How to Pass an Array Without Pain and Errors

"Can I bind an array to an IN() condition?" — a question that haunts every second PHP developer

Have you ever written a query like SELECT * FROM users WHERE id IN (?) and tried to pass an array to it via bindValue()? If so, you definitely know that feeling of disappointment when PDO returns just one row instead of all the ones you need. Or even worse — throws an error.

This question on Stack Overflow has gathered thousands of views, and for good reason. It seems simple enough: pass an array, get a result. But PDO (PHP Data Objects) is a strict tool. It doesn't know how to "unfold" arrays into a list of values for IN() automatically. And that's where the fun begins: developers come up with top errors that we'll break down today. And most importantly — we'll learn how to avoid them.

In this article, we won't just give you a ready-made solution. We'll go from incorrect code to safe, performant, and elegant code. Let's go!

Error #1: Naively passing an array via bindValue

The most common pitfall — trying to feed an array directly into bindValue().

// ❌ WRONG\n$ids = [1, 2, 3, 5];\n$stmt = $pdo->prepare("SELECT * FROM users WHERE id IN (?)");\n$stmt->bindValue(1, $ids, PDO::PARAM_STR);\n$stmt->execute();\n$users = $stmt->fetchAll();

What will happen? PHP converts the array to the string "Array", and the query turns into WHERE id IN ("Array"). The result — zero rows or an error, depending on the driver. PDO simply doesn't understand that the array needs to be expanded into individual placeholders.

Why does this happen? PDO expects a scalar value (string, number, null). An array is a composite type and is not suitable for direct binding.

How to fix it?

You need to manually create placeholders for each element of the array. No magic, just code.

// ✅ CORRECT\n$ids = [1, 2, 3, 5];\n$placeholders = implode(',', array_fill(0, count($ids), '?'));\n$stmt = $pdo->prepare("SELECT * FROM users WHERE id IN ($placeholders)");\n$stmt->execute($ids);\n$users = $stmt->fetchAll();

Here we create a string like ?,?,?,? and pass the array directly to execute(). PDO will substitute the values in order. Simple and safe.

Error #2: Ignoring data types

Let's say you're using named placeholders. And then the temptation arises to do this:

// ❌ WRONG\n$ids = [1, 2, 3];\n$placeholders = [];\nforeach ($ids as $i => $id) {\n    $placeholders[] = ":id_$i";\n}\n$sql = "SELECT * FROM users WHERE id IN (" . implode(',', $placeholders) . ")";\n$stmt = $pdo->prepare($sql);\nforeach ($ids as $i => $id) {\n    $stmt->bindValue(":id_$i", $id, PDO::PARAM_INT);\n}\n$stmt->execute();

It seems correct. But there's a nuance: if the array is empty, the query becomes WHERE id IN (), which will cause an SQL syntax error. The second problem — if the array contains strings, and you specified PDO::PARAM_INT, PDO might cast them to zero.

Solution: always check the array for emptiness and dynamically determine the type.

// ✅ CORRECT\n$ids = [1, 2, 3];\nif (empty($ids)) {\n    return []; // or throw an exception\n}\n$placeholders = [];\nforeach ($ids as $i => $id) {\n    $placeholders[] = ":id_$i";\n}\n$sql = "SELECT * FROM users WHERE id IN (" . implode(',', $placeholders) . ")";\n$stmt = $pdo->prepare($sql);\nforeach ($ids as $i => $id) {\n    $type = is_int($id) ? PDO::PARAM_INT : PDO::PARAM_STR;\n    $stmt->bindValue(":id_$i", $id, $type);\n}\n$stmt->execute();

Error #3: SQL injection through "manual" escaping

Some developers, in desperation, write something like