Why does this query have . ?

Question

I want to know why the following query have . and "" in ".$_POST['date']." etc.

$query = "INSERT INTO eventcal ('eventDate','eventTitle','eventContent','user',
'user_id') VALUES('".$_POST['date']."','".addslashes($_POST['eventTitle'])."',
'".addslashes($_POST['eventContent'])."')";     

If I change to the following, will it make any differences?

VALUES('$_POST['date']','addslashes($_POST['eventTitle'])',
'addslashes($_POST['eventContent'])')

Thanks in advance.

Answer 1

Yes, only variables are parsed in double quotes which means your functions won't be executed in the second code block.

Answer 2

The "dot" operator is PHP's operator for string concatenation. I think that using the addslashes function is a better idea than what you have in the first example but you will still need to use string concatenation as PHP's string interpolation only supports variables.

Answer 3

It is the PHP form of concatenation (The quotes mark the end of the strings). In JavaScript and many other languages it is the + character that concatenates.

echo "hello" . " " . "world!"; // Outputs 'hello world'

Yes, making that change would drastically change its meaning.

Finally, this is open to a severe SQL injection attack because date is not properly escaped.

Always sanitize your input and use parameterized queries where possible.

Answer 4

Single quotes inhibit variable interpolation, and as well the single quotes used in the array index would terminate the string.

Also, use a library that supports query parametrization instead of adding the values in like this.