SQL injection prevention on dynamic parameters - php

Question

I have an intresting question:
I have a form that is send over GET, and i want to secure the database.
Problem is that there are 8 select boxes with arguments that can be passed in the form to the page, but they dont have to be there.
I am currently checking if the select box is sending default value, if its not, im storing it in array. After that i loop trough array and adding the search parameters to string :
$searchString = "WHERE Aktivno = 1";
foreach($pretragaArray as $key => $item){
$searchString = $searchString." AND";
$searchString = $searchString." ". $key ." = " . $item;
}
In the end i end up with search string query like this
WHERE Aktivno = 1 AND IDVrstaOglasa = 1
or
WHERE Aktivno = 1 AND IDOpstina = 15 AND IDGrad = 11 AND IDVrstaOglasa = 1 AND Broj_soba = 3 AND IDKategorijaNekretnine = 5
I am using PDO php class for querying the database.
My question is, is there a way to escape my string that is generated this way, and if not, is there a better way to query the database with dynamic number of atributes in WHERE clause.

Answer 1

You can generate a parameterised query with a dynamic number of parameters like this:
$searchString = "WHERE Aktivno = 1";
$params = array();
$paramNum = 1;
foreach($pretragaArray as $key => $item)
{
$paramName = ':param' . $paramNum++;
$searchString = $searchString." AND";
$searchString = $searchString." ". $key ." = " . $paramName;
$params[$paramName] = $item;
}
$db = new PDO("...");
$statement = $db->prepare("SELECT * FROM some_table " . $searchString);
$statement->execute($params);
$row = $statement->fetch(); // or fetchAll()...