Question

Alright, take this for example:

$array['key'] = 'value';

$SQL = "SELECT column FROM table WHERE column='{$array[key]}'";

That’s how I’ve been doing it, but of course if I were to enable E_ALL error reporting, I’d get a notice about using the undeclared constant, and it would assume ‘key’ instead of a constant.

As such, I assume that’s not the proper or more efficient way to do it, so what would be the most efficient way of doing that SQL query (or other relevant string)?

Answer 1

Actually, if you lookup the PHP string quoting rules, if you omit the quotes around the key inside {} it will be interpreted as a constant. However, if you omit the {} and the quotes, a simple array index will be properly interpreted without issuing a notice.

PHP double-quoted string parsing rules (The relevant examples are in the Variable Parsing section)

I tend to prefer surrounding with {} for readability:

// Inside {}, you must quote the array key or it will be interpreted as a constant
$SQL = "SELECT column FROM table WHERE column='{$array['key']}'";

But this is also valid and should not issue notices:

// Without {}, don't quote the array key and it will be correctly parsed.
$SQL = "SELECT column FROM table WHERE column='$array[key]'";

Note that the best way to pass variables into SQL queries is to use an API that supports prepared statements instead of concatenating in variables