Concatenated many strings in PHP easily

Question

The following code is correct:

$str = "INSERT INTO table ('".$val1."',"."'".$val2."'".","."'".$val3."'".","."'".$val4."')";

but the code below is incorrect:

$str = "INSERT INTO table ('".$val1."',"."'".$val2."'".","."".$val3."'".","."'".$val4."')";

The above example is small but you can see that larger cases of the above are annoying to debug when one misses out a ' or a ". Is there a better way of concatenating strings in PHP? I want to have variables having single inverted commas on bother sides and I want the string to be made using double inverted commas.

There must be a better way.. I write a lot of queries from PHP that talk to an Oracle DB and I am constantly making mistakes with these strings!!

Thank you :).

Step 1: Use PDO, prepared statements, and placeholders. Step 2: .... Step 3: Profit. — mu is too short
– mu is too short, Commented Sep 14, 2011 at 6:16
@mu is too short: pdo oracle driver is not recommended for production, unfortunately — zerkms
– zerkms, Commented Sep 14, 2011 at 6:17
@zerkms: Right, too late to edit. Shame about the Oracle driver. — mu is too short
– mu is too short, Commented Sep 14, 2011 at 6:23

zerkms · Accepted Answer · 2011-09-14 06:16:07Z

5

$str = sprintf("INSERT INTO table ('%s', '%s', ...", $val1, $val2);

or use prepared statements

answered Sep 14, 2011 at 6:16

zerkms

256k73 gold badges447 silver badges551 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

ale Over a year ago

Excellent.. that will save me a huge amount of time!

Serhii Sokolenko Over a year ago

Looks very clean, but I think you should wrap $val1 and $val2 with mysql_real_escape_string() as other noticed here.

zerkms Over a year ago

@Sergiy: it is oracle, not mysql. And I did notice that prepareds are preferred

Poomalairaj · Accepted Answer · 2011-09-14 06:26:03Z

3

You can try this

$str = "INSERT INTO table ('$val1','$val2','$val3')";

answered Sep 14, 2011 at 6:26

Poomalairaj

5,0983 gold badges25 silver badges28 bronze badges

1 Comment

ale Over a year ago

Awesome.. I didn't know you could do that (duh :P). Best solution so far +1.

Community · Accepted Answer · 2023-11-17 20:38:18Z

2

Use prepared statements for that: https://www.php.net/manual/en/pdo.prepared-statements.php

Never just concatenate arbitrary values to create a SQL statement. You will create millions of SQL injection holes in you application. http://xkcd.com/327/

At the very least, use mysql_real_escape_string or equivalent.

I recommend you do some reading about security and application design before writing any PHP application of consequence.

edited Nov 17, 2023 at 20:38

CommunityBot

11 silver badge

answered Sep 14, 2011 at 6:25

sirbrialliance

3,7121 gold badge28 silver badges15 bronze badges

3 Comments

ale Over a year ago

Really valuable advice +1. See comments above about PDO Oracle driver though. Loving the XKCD .

ale Over a year ago

With mysql_real_escape_string(), even though I am using an Oracle DB, I think it would ensure my queries are safe even though it's intended for MySQL right? Can't seem to find any Oracle equivalent.

zerkms Over a year ago

@alemaster: for oracle the better approach is to use prepared statements with oci_parse()

sanmai · Accepted Answer · 2011-09-14 06:17:05Z

0

How about

echo implode(",", array(
   '"'.$val1.'"',
   '"'.$val2.'"',
   '"'.$val3.'"',
));

But I must say that you can do it much easier with prepared statements.

answered Sep 14, 2011 at 6:17

sanmai

31.2k12 gold badges72 silver badges76 bronze badges

1 Comment

ale Over a year ago

I like it but I think I would make the same number of mistakes with this :P.

sarkiroka · Accepted Answer · 2011-09-14 06:24:29Z

0

create your own function with http://php.net/manual/en/function.func-get-args.php and foreach, and use sql escapeing for each params. see the example1 on page

answered Sep 14, 2011 at 6:24

sarkiroka

1,54121 silver badges29 bronze badges

Comments

veritas · Accepted Answer · 2011-09-14 06:50:09Z

0

When dealing with large param sets I prefer to put them into an array and join with implode() function.implode like in code below:

$params = array('param1','param2','param3');
$param_string = "('".implode("','", $params)."')";

answered Sep 14, 2011 at 6:50

veritas

2,0521 gold badge16 silver badges30 bronze badges

Collectives™ on Stack Overflow

Concatenated many strings in PHP easily

6 Answers 6

3 Comments

1 Comment

3 Comments

1 Comment

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

6 Answers 6

3 Comments

1 Comment

3 Comments

1 Comment

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related