Invalid number of parameters binding PDO - php

Question

I am using a tutorial for this project, however I am trying to expand on what was provided in the material. I am trying to use a function which creates the query just before binding the values to create a query with more than 3 WHERE values.
Here is the code:
private function action($action, $table, $where = array()){
$operators = array('=', '>', '<', '>=', '<=' , 'AND' ,'OR', 'LIKE', 'GROUP BY','ORDER BY', 'ASC', 'DESC');
if(!empty($where)){
$sql = "{$action} FROM {$table} WHERE ";
if(count($where) > 3){
$isVal = FALSE;
$values = '';
foreach ($where as $value) {
switch(trim($value)){
case '=':
case '>':
case '<':
case '>=':
case '<=':
$sql .= "{$value}";
$isVal = true;
break;
default:
if($isVal){
$sql .= " ? ";
$values .= $value;
$isVal = false;
}else{
$sql .= "{$value}";
}
break;
}
}
if(!$this->query($sql, $values)->error()){return $this;}
/////////////////////////////////////////
// From this point down everything works!!!
////////////////////////////////////////////
}else if(count($where) === 3){
$field = $where[0];
$operator = $where[1];
$value = $where[2];
if(in_array($operator, $operators)){
$sql = "{$action} FROM {$table} WHERE {$field} {$operator} ?"; // NO $value ?
if(!$this->query($sql, array($value))->error()){return $this;}
}
}
}else{
// If array is empty
$sql = "{$action} FROM {$table}";
if(!$this->query($sql)->error()){return $this;}
}
return FALSE;
}
Section where nested Else IF statement reads count($where) === 3 works fine, however the first nested IF 'count($where > 3)` throws me an error.
I am trying to find a way to set this up correctly so that I can use more than just 3 where values.
Also here is my query binder:
public function query($sql, $params = array()){
$this->_error = FALSE;
if($this->_query = $this->_pdo->prepare($sql)){
$x = 1;
if(count($params)){
foreach($params as $param){
$this->_query->bindValue($x, $param);
$x++;
}
}// End IF count
if($this->_query->execute()){
$this->_lastID = $this->_pdo->lastInsertId();
try{
$this->_results = $this->_query->fetchAll(PDO::FETCH_OBJ);
}catch(Exception $e){
// Catch Error
}
$this->_count = $this->_query->rowCount();
}else{
$this->_error = TRUE;}
}
return $this;
}
If anyone can help me out with this I will be very grateful ... Thank you!

Answer 1

There are some problems here, for example:
$values in your first method is a concatenated string. Casting that to an array will give you an array with 1 element which is not what you need. You would need an array with all values separated, something like $values[] = $value; instead of $values .= $value;.
You will run into problems when you try to add combinations of OR and AND statements as grouping using parenthesis makes a lot of difference there.
You are using a prepared statement for the values but there is no check on the column names to prevent sql injection. You should use a white-list there.