-4

here's my question:

What is a PHP variable/string without quotes? Below is the code I wrote and went wrong:

$email = $_POST['email'];

$query = "DELETE FROM email_list WHERE email = $email";

the correct code should be:

$query  = "DELETE FROM email_list WHERE email = '$email'";

So, variable $email is not a string without quotes, even if it's what I input in the form?

Then I wrote a code in PHP:

echo($email."<br />");
echo("$email" ."<br />");

The result turned out to be same in the browser. So why should I add another single quotes to enclose $email while it's already enclosed by double quotes?

Apolo Doo
  • 3
  • 3

1 Answers1

1

Writing $email and "$email" outputs the same. Writing "'$email'" doesn't.

In the last case, you are adding a single quote before and after; which are needed by SQL to recognize a string.

If the creators of the SQL language had decided that strings had to be enclosed between # you would have to write "#$email#" if you want the SQL engine to recognize the string. It has nothing to do with how PHP treats or interpolates strings; it has to do with SQL.

jotaelesalinas
  • 1,387
  • 1
  • 11
  • 24
  • Understood, your anwser is very clear, thanks!!! – Apolo Doo Oct 13 '17 at 10:14
  • I just ran into something like this today. `"INSERT INTO MyTable (Date, IPAddr, Key, CID, Version) VALUES (NOW(),'$ipAddr','$key','0','$pixels')"` if $pixels does not have the single quotes around it, then only a numeric value is allowed. – Trygve Apr 28 '20 at 03:33