CSV error while using implode - php

Question

Please help, I'm new in Yii. I want to generate and export CSV file from checked rows in CGridView. When I use static SQL query it works normally, but when I use implode function in WHERE clause - controller returns an error.
My button that called controller action:
$this->widget('bootstrap.widgets.TbButtonGroup', array(
'type' => 'primary',
'size'=>'mini',
'buttons' => array(
array(
'label' => 'Export',
'type' => 'success',
'buttonType'=>'ajaxLink',
'encodeLabel'=>true,
'icon'=> 'th white',
'url'=>Yii::app()->createUrl('/propertyPurchaseSale/ExportChecked'),
'ajaxOptions'=>array(
"type" => "post",
"data" => "js:{ids:$.fn.yiiGridView.getSelection('property-purchase-sale-grid')}",
"update" => '#', 'success'=>"js:function(data) {window.location.assign('/propertyPurchaseSale/ExportChecked');}"),
array( //htmlOptions
)
),
array(
...
),
),
));
My controller action:
public function actionExportchecked() {
header('Content-type: text/csv');
header('Content-type: multipart/form-data');
header('Content-Disposition: attachment; filename="Export_(' . date('H-i_d.m.Y') .').csv"');
header('Content-Transfer-Encoding: binary');
header('Expires: 0');
header('Cache-Control: must-revalidate, post-check=0, pre-check=0');
header('Content-Description: File Transfer');
$fp = fopen('php://output', 'w');
if(Yii::app()->request->isAjaxRequest)
{
if(isset($_POST['ids']))
{
$idx = $_POST['ids'];
$count=Yii::app()->db->createCommand('SELECT COUNT(*) FROM property')->queryScalar();
// $sql='SELECT * FROM property WHERE id IN (981, 982, 985)'; --> when I use static values - all work
$sql="SELECT * FROM property WHERE id IN('".implode("', '",$idx)."')"; // --> when I use join or implode function - data exist in firebug, but page return error 500
$dataProvider=new CSqlDataProvider($sql, array(
'totalItemCount'=>$count,
'sort'=>array(
'attributes'=>array(
'fullname', 'address', 'phone', 'db_number', 'created_date'
),
),
'pagination'=>false,
));
fputs($fp, $bom =( chr(0xEF) . chr(0xBB) . chr(0xBF) ));
if ($fp)
{
echo PropertyPurchaseSale::model()->getAttributeLabel("id").";".
PropertyPurchaseSale::model()->getAttributeLabel("fullname").";".
PropertyPurchaseSale::model()->getAttributeLabel("address").";".
PropertyPurchaseSale::model()->getAttributeLabel("phone").";".
PropertyPurchaseSale::model()->getAttributeLabel("db_number").";".
PropertyPurchaseSale::model()->getAttributeLabel("created_date").
" \r\n";
foreach ($dataProvider->getData() as $data) {
echo $data['id'] . '; ' . $data['fullname'] . '; ' . $data['address'] . '; ' . $data['phone'] . '; ' . $data['db_number'] . '; ' . $data['created_date'] . '; ' . "\r\n";
}
}
exit;
}
}}
Please, help, what am I doing incorrectly?

Answer 1

My knee-jerk reaction is that there is nothing confirming that $_POST['ids'] is an array. If it is just a string, then implode will fail, the SQL will be improperly formatted, and that would lead to a 500 level error.
Perhaps this might work:
// check for empty, that way invalid entry won't go through
if(!empty($_POST['ids'])) {
// Check if it is an array
$input_idx = is_array($_POST['ids'])?
// if so, then use it as an array
$_POST['ids']:
// If not, you need to turn it into an array. I'm only guessing that this should
// be a ','. It could be a " " or some other character(s)
explode(',',$_POST['ids']);
// Remove all non-numeric items in the array.
$idx = array_filter($input_idx, 'is_numeric');
if(!$idx) {
// Do something with bad data.
}
// continue with the line $count = ...
You should also look to making sure that the data is sanitary as those IDs could include SQL injection. (Perhaps this answer)