Looping through an array and executing statement in MYSQL - mysql

Question

Is it possible to loop through this array in mysql and execute a delete statement where the category_id column is equal to the current value been looped in that array below.
$row = [
'type' => '3',
'name' => 'Warez',
'category_id' => 'IAB26-2',
'parent_category_id' => 'IAB26'
],
[
'type' => '3',
'name' => 'Spyware/Malware',
'category_id' => 'IAB26-3',
'parent_category_id' => 'IAB26'
],
[
'type' => '3',
'name' => 'Copyright Infringement',
'category_id' => 'IAB26-4',
'parent_category_id' => 'IAB26'
],
[
'type' => '3',
'name' => 'Uncategorized',
'category_id' => 'IAB24'
]
I have tried this
foreach($row as $value) {
$this->execute('DELETE from categories WHERE category_id = '.$value['category_id'].'');
}
doesn't seem to work as it should. Is there is better Sql command for this kind of operation?

Answer 1

Your code is insecure because it's possible to inject SQL. So an attacker might execute whatever he wants in your SQL query.
If this is really CakePHP code, why aren't you using the ORM? You cleary should read https://book.cakephp.org/3.0/en/orm.html the Table Objects and Deleting Data section. If not don't use wrong tags.
Assuming this is done in a table object, the most simple way to do this is:
$ids = Hash::extract($data, '{n}.category_id');
if (!empty($ids)) {
$this->deleteAll([
'category_id IN' => $ids
]);
}

Answer 2

You probably just need to wrap the value you concatenate with quotes (because it's not numeric).
Something like this:
$this->execute('DELETE from categories WHERE category_id = "'.$value['category_id'].'"');
However, doing DELETE ... WHERE as suggested in one of the comments would yield better performance.
Also, note that if the data comes from the user then it may be susceptible to SQL injection, so you should read about and use parameterized queries rather than concatenation.

Answer 3

Using an IN clause
$list = array(); foreach ($row as $item) {
$list[] = "'{$item['category_id']}'";
}
$sql = 'DELETE from categories WHERE category_id IN ('.implode(',',$list).')';
$this->execute( $sql );