wpdb::prepare() with use multi placeholders (args) - php

Question

I want to query all user roles "subscriber" or "administrator"
$ARRAY = array('%subscriber%','%administrator%');
$query = $wpdb->prepare( "
SELECT *
FROM {$wpdb->usermeta}
WHERE meta_value IN %s
ORDER BY user_id
DESC LIMIT {$limit} OFFSET {$offset}
", $ARRAY );
Errors: Notice: wpdb::prepare was called incorrectly. The query only expected one placeholder, but an array of multiple placeholders was sent.
I want to use multi placeholders, how to fix? thank you!

Answer 1

Using LIKE operator and AND condition in place of IN() function.
You can try:
$ARRAY = array('%subscriber%','%administrator%');
$query = $wpdb->prepare( "
SELECT *
FROM {$wpdb->usermeta}
WHERE meta_value LIKE %s OR meta_value LIKE %s
ORDER BY user_id
DESC LIMIT {$limit} OFFSET {$offset}
", $ARRAY );

Answer 2

You need to expand the array into a string by using the implode function as it's expecting a string to be passed.
$ARRAY = array('%subscriber%','%administrator%');
$array_placeholders = implode( ', ', array_fill( 0, count( $ARRAY ), '%s' ) );
$query = $wpdb->prepare( "
SELECT *
FROM {$wpdb->usermeta}
WHERE meta_value IN ( $array_placeholders )
ORDER BY user_id
DESC LIMIT {$limit} OFFSET {$offset}
", $ARRAY );

Answer 3

First, I should point out a security problem with your query. You are looking for any meta value with the words "subscriber" and "administrator" in them. So with any user account on your site, I could just set my first name or bio to contain "administrator" and your query will pick me up as one. If you are looking for roles, make sure you are explicit about it:
$prefix = $wpdb->get_blog_prefix();
... "WHERE meta_key = '{$prefix}_capabilities' AND " ...
Second, although incorrect, Andrew's answer looks better, because you're not hard-coding the number of roles you're going to look for in the query itself, like in Karlo's answer. Imagine you have to query for 15 roles. The reason it's incorrect though, is because the capabilities meta value is a serialized PHP array, so you can't really use IN() there, unfortunately, but using the same idea, you could do something like this:
$prefix = $wpdb->get_blog_prefix();
$roles = array( 'subscriber', 'administrator' );
$parts = array();
foreach ( $roles as $role ) {
$parts []= $wpdb->prepare( "meta_value LIKE %s",
'%' . $wpdb->esc_like( $role ) . '%' );
}
$parts_sql = implode( " OR ", $parts );
$sql = "SELECT * FROM {$wpdb->usermeta}
WHERE meta_key = '{$prefix}capabilities'
AND ({$parts_sql})";
$wpdb->get_results( $sql, ARRAY_A );
Finally, even if you do get site administrators this way, make sure you don't allow them any actions just based on their roles, and run capability checks wherever applicable with current_user_can() or user_can().
Hope that helps.