PHP Syntax Question

gamerdude

New Member
Messages
101
Reaction score
0
Points
0
I never knew if you were suppose to enclose "$_POST" variable in single quotes in something like this
PHP:
$link = mysql_connect('localhost', $_POST['SQLname'], $_POST['SQLpass']);
.

Should it be like this (#1)
PHP:
$link = mysql_connect('localhost', $_POST['SQLname'], $_POST['SQLpass']);

Like this (#2)
PHP:
$link = mysql_connect('localhost', '$_POST['SQLname']', '$_POST['SQLpass'']);

Or it doesn't matter (#3)

or am I doing it wrong entirely? (#4)
 

marshian

New Member
Messages
526
Reaction score
9
Points
0
It's not really safe what you're doing there, you should check wether it's the right input, because somebody could abuse this code...
#1 is right, #2 is wrong
PHP:
$link = mysql_connect("localhost", $_POST["SQLname"], $_POST["SQLpass"]);
This would be right too: double quotes instead of single quotes everywhere.
 
Last edited:

phpasks

New Member
Messages
145
Reaction score
0
Points
0
I never knew if you were suppose to enclose "$_POST" variable in single quotes in something like this
PHP:
$link = mysql_connect('localhost', $_POST['SQLname'], $_POST['SQLpass']);
.

Should it be like this (#1)
PHP:
$link = mysql_connect('localhost', $_POST['SQLname'], $_POST['SQLpass']);
Like this (#2)
PHP:
$link = mysql_connect('localhost', '$_POST['SQLname']', '$_POST['SQLpass'']);
Or it doesn't matter (#3)

or am I doing it wrong entirely? (#4)

#1 Step is right.

You can used it in single quote or double quote.
 

gamerdude

New Member
Messages
101
Reaction score
0
Points
0
Thanks, both your posts have received rep.

It's not really safe what you're doing there, you should check wether it's the right input, because somebody could abuse this code...
#1 is right, #2 is wrong
PHP:
$link = mysql_connect("localhost", $_POST["SQLname"], $_POST["SQLpass"]);
This would be right too: double quotes instead of single quotes everywhere.

That is only a little piece of the code, I was just wondering about the syntax.
 
Last edited:

marshian

New Member
Messages
526
Reaction score
9
Points
0
I'm not really good in explaining stuff, but here's something I found on the internet:

A string is a datatype we first used in our original examples to assign values to variables. A string can be any combination of letters, numbers, or special symbols as long as consideration is given to characters that have functions in PHP. Before we consider special cases, let's first discuss the difference between the two string notations: the single and double quote. In every case where you may want to assign a string value to a variable, the value itself must begin and end with a pair of either single (' ') or double (" ") quotes.

PHP:
<?php

  // This string begins and ends with single quotes
  $mystring = 'single quoted string';

  // This string begins and ends with double quotes
  $mystring = "double quoted string";
?>

In this example, both variables would simply be assigned a value within the single or double quotes. However, when double quotes are used, PHP will first look inside the string for any references to variables that may exist. If any references are found, they are replaced with values before being assigned to the designated variable. Conversely, when dealing with single-quoted strings, PHP simply takes the string as-is and assigns it to the designated variable.

PHP:
<?php

  $myint = 10;	// Assign the variable myint to 10

  $string_one = 'The value of myint is $myint';
  $string_two = "The value of myint is $myint";

?>

Consider the above example. In the first line, we simply assign the integer value "10" to the variable $myint. Then, we assign two more variables $string_one and $string_two. These are identical except $string_one is stored using single quotes and $string_two is stored using double quotes. In this example, the values within the two strings are as follows:

  • $string_one = The value of myint is $myint
  • $string_two = The value of myint is 10

Notice that, when the value of $string_two is displayed, the variable $myint was replaced with the value "10". In the single-quoted string, however, the actual string $myint was stored.
Taken from: http://www.onlamp.com/pub/a/php/2001/03/08/php_foundations.html
 

jonathanyaniv

Banned
Messages
178
Reaction score
0
Points
0
use preg_match to validate your input, you really dont want a user to be injecting code into your database.

Do not allow the "" to be inserted into your database, also '' or = or < or > or , or '
 
Top