How to securely write a Joomla SELECT query with an IN condition in the WHERE clause?

Question

With a regular MySQL command, we use SELECT foo WHERE bar IN (a,b,c).

How is this properly executed using Joomla's query building methods?

I tried this:

$query
    ->select(array('a.id', 'a.promo', 'a.harga', 'a.dp', 'a.image', 'a.teaser' , 'b.title','b.created'))
    ->from($db->quoteName('#__cck_store_form_paket_trip', 'a'))
    ->join('LEFT', $db->quoteName('#__content', 'b') . ' ON (' . $db->quoteName('a.id') . ' = ' . $db->quoteName('b.id') . ')')
    ->where($db->quoteName('b.catid') . ' IN '.$db->quote(.'(13,14,15)'.)
    ->order($db->quoteName($orderby) . ' '.$order)
    ->setLimit($limit,$start)
    ;

Answer 1

$db->quote function accepts a value or an array. You can try below code with implode function -

instead of this -

$db->quote(.'(13,14,15)'.)

Try this -

$db->quote(array(13,14,15))

and final query will be -

$query
    ->select(array('a.id', 'a.promo', 'a.harga', 'a.dp', 'a.image', 'a.teaser' , 'b.title','b.created'))
    ->from($db->quoteName('#__cck_store_form_paket_trip', 'a'))
    ->join('LEFT', $db->quoteName('#__content', 'b') . ' ON (' . $db->quoteName('a.id') . ' = ' . $db->quoteName('b.id') . ')')
    ->where($db->quoteName('b.catid') . ' IN (' . implode(',', $db->quote(array(13,14,15))) . ')' )
    ->order($db->quoteName($orderby) . ' '.$order)
    ->setLimit($limit,$start)
    ;