0

I came across a program where in the queries are formed in a different way like this:

$insert_query = "INSERT INTO projects(project_user_id, project_name, project_body) ";
$insert_query .= "VALUES({project_user_id}, '{$project_name}', '{$project_body});

I know the second line is meant to concatenate it with the first line in order to improve the readability of the query. But what bugs me is what is the use of the opening and closing curly braces? Is it just to improve the readability of the code or the other way around?

aries
  • 64
  • 1
  • 12
  • 1
    Looks like string interpolation (inserting variable values into the string). With a typo on the first variable name. And highly SQL-injectable, you should *not* do this with database queries and user-modifiable values. – David Sep 29 '18 at 11:38

1 Answers1

2

From PHP Documentation:

Complex (curly) syntax

This isn't called complex because the syntax is complex, but because it allows for the use of complex expressions.

Any scalar variable, array element or object property with a string representation can be included via this syntax. Simply write the expression the same way as it would appear outside the string, and then wrap it in { and }. Since { can not be escaped, this syntax will only be recognised when the $ immediately follows the {.

Madhur Bhaiya
  • 28,155
  • 10
  • 49
  • 57