Multi-select dropdown only inputting one value into database

[brandkast]

Feel like I'm missing something really simple here, so hoping for a fresh set of eyes to look my code over. I'm fairly new to PHP, but feel like I can comfortably make my way around the database/files. 

Currently trying to make shop items viewable by a custom profile field option, rather than viewable by usergroup. I'll post what code I have below.

This changes the items to be viewable/not viewable depending on 'Race'.

$userid = $mybb->user['uid'];

$rquery = $db->query(" SELECT * FROM mybb_userfields WHERE mybb_userfields.ufid = $userid ");
	$us = $db->fetch_array($rquery);
	$race = $us['fid5'];


	if($category['race'] == '1') { $noshow = 1; } // Race = All
	elseif ($category['race'] == '2') { $noshow = 0; } // Race = None

	elseif ($category['race'] == '3') {
        if ($race == 'Human') { $noshow = 1; }
	else { $noshow = 0; }
        }

	elseif ($category['race'] == '4') {
        if ($race == 'Dire') { $noshow = 1; }
	else { $noshow = 0; }
        }

	elseif ($category['race'] == '5') {
        if ($race == 'Eximius') { $noshow = 1; }
	else { $noshow = 0; }
        }	

	// if it's not visible, don't show it
	if ($category['visible'] == 0 || $noshow == 0)
	continue;

Inputs the info as a string into the database

$race = $db->escape_string($mybb->input['race']);

Grabs the Races by their number, assigns the corresponding Race name to the number.

$query = $db->simple_select('newpointsshopracecats', '*');
	while ($rr = $db->fetch_array($query)) {
		$race[$rr['race']] = $rr['name'];
	}

Make the field in the ACP...

$form_container->output_row("<b>VIEWABLE BY RACE</b>", "These races can view this category.", 
$form->generate_select_box('race', $race, explode(',', $cat['race']), array('id' => 'race', 'multiple' => true, 
'size' => 5)), 'race');

Edit: As a note, I'm able to input multiple number values into the database, and it's working as intended if I do so: https://prnt.sc/qoaxhm

[Omar G.]

As per your code I would expect $mybb->input['race'] to be an array, but you seem to threat it like a string when sanitizing:

$race = $db->escape_string($mybb->input['race']);

You need to convert it to a string before escaping. Look at the implode() function.
https://www.php.net/manual/en/function.implode.php

There should be plenty of in-core examples for this.

The following might work:

$race = $db->escape_string(implode(',', arrayp_map('intval', $mybb->get_input('race', MyBB::INPUT_ARRAY))));

[brandkast]

Thank you so much Omar! That actually worked perfectly.

I also had to change race to race[] in the ACP field creation part:

$form_container->output_row("<b>VIEWABLE BY RACE</b>", "These races can view this category. <strong class='small'>Note: This field is currently view only from the ACP, and can only be updated from the database. :(</strong>", $form->generate_select_box('race[]', $race, explode(',', $cat['race']), array('id' => 'race', 'multiple' => true, 'size' => 5)), 'race');