Its about a syntax in php while inserting data in mysql table

Question

Why is this syntax used:

mysql_query("INSERT INTO users (username, password, email, hash) VALUES( 
'". mysql_escape_string($name) ."', 
'". mysql_escape_string(md5($password)) ."', 
'". mysql_escape_string($email) ."', 
'". mysql_escape_string($hash) ."') ") or die(mysql_error());

I do not have any confusion about mysql_escape_string , function, however why is mysql_escape_string($name), enclosed within two dots:. mysql_escape_string($name) . then it is enclosed within double quotes:". mysql_escape_string($name) ." lastly the whole thing is enclosed within a single quote :'". mysql_escape_string($name) ."' I got this form the following web resource: http://net.tutsplus.com/tutorials/php/how-to-implement-email-verification-for-new-members/

...Its a php email verification program.

You should ignore that tutorial and find something that teaches you how to use mysqli or PDO. — Stephen
– Stephen, Commented Nov 26, 2010 at 16:30
Two off-topic tips: use mysqli or PDO instead of the mysql connector. The're safer and faster. Also, add a salt to the md5($password) function for safety. — Martijn Heemels
– Martijn Heemels, Commented Nov 26, 2010 at 18:03

sh03 · Accepted Answer · 2010-11-26 17:28:43Z

1

The dot (.) is the glue for string concatenation. It is used also for separating variables:

"First part of a string". $myvar ." second part of a string"

The double quotes is the way we say that that is a string:

is considered an integer,

"123"

is considered a string.

And finally the single quote is a part of the mysql syntax that requires the strings to be surrounded by '.

answered Nov 26, 2010 at 17:28

sh03

76.5k39 gold badges177 silver badges282 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Swhistlesoft · Accepted Answer · 2010-11-26 17:19:11Z

0

The dot operator is the glue for string concatenation. The double quotes represent the start and end of a string. "string1" . "string2" . "string3" would be equivilant to: "string1string2string3".

answered Nov 26, 2010 at 17:19

Swhistlesoft

591 bronze badge

Comments

NullUserException · Accepted Answer · 2011-11-13 17:01:49Z

0

The (.) is concatenating the whole string together. see here string operators

If you echo'ed the query it would look something like this.

INSERT INTO users (username, password, email, hash) 
    VALUES ('Jeff', 'hashedpassword', '[email protected]', 'somehash')

edited Nov 13, 2011 at 17:01

NullUserException

85.8k31 gold badges212 silver badges239 bronze badges

answered Nov 26, 2010 at 16:03

martynthewolf

1,6792 gold badges11 silver badges23 bronze badges

1 Comment

Martijn Heemels Over a year ago

Exactly! Don't think of the quotes enclosing the mysql_escape_string function! The single-quotes are actually just characters inside the string. The double-quotes delimit the strings, and the dots glue everything together. When everything is glued together into a single string the single-quotes will enclose the values, just as this answer shows.

Collectives™ on Stack Overflow

Its about a syntax in php while inserting data in mysql table

3 Answers 3

Comments

Comments

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related