// array of WHERE conditions
$param = array('customer_id'=>1,'qty'=>'2');
$stmt = $MysqLi->stmt_init();
 
$types = ''; $bindParam = array(); $where = ''; $count = 0;
 
// build the dynamic sql and param bind conditions
foreach($param as $key=>$val)
{
    $types .= 'i';
    $bindParam[] = '$p'.$count.'=$param["'.$key.'"]'; 
    $where .= "$key = ? AND ";
    $count++;
}
 
// prepare the query -- SELECT * FROM t1 WHERE customer_id = ? AND qty = ?
$sql = "SELECT * FROM t1 WHERE ".substr($where,strlen($where)-4);
$stmt->prepare($sql);
 
// assemble the bind_param command
$command = '$stmt->bind_param($types,'.implode(',',$bindParam).');';
 
// evaluate the command -- $stmt->bind_param($types,$p0=$param["customer_id"],$p1=$param["qty"]);
eval($command);

最后一个eval()语句是个坏主意吗？我试图通过在变量名$param后面封装值来避免代码注入.

有没有人有意见或建议？我需要注意哪些问题？