-1

This is some PHP code for rendering an HTML anchor element. Why does this:

$archives .= "&nbsp;<a href='" . get_year_link($archPost->year) . "' 
title='Click to go to full listing for " . $archPost->year . "' target='_blank'>[List^]</a>";

work exactly like this:

$archives .= "&nbsp;<a href='" . get_year_link($archPost->year) . "' 
title='Click to go to full listing for $archPost->year' target='_blank'>[List^]</a>";

Coming from C/C# and such, I have a preference for the first variant, because I think that one cannot just dump variables smack-dab in the middle of the string. Apparently PHP has no problem with this. Why not?

TylerH
  • 20,799
  • 66
  • 75
  • 101
Axonn
  • 10,076
  • 6
  • 31
  • 43
  • 1
    http://php.net/manual/en/language.types.string.php#language.types.string.parsing – Rizier123 Sep 30 '15 at 20:12
  • 1
    String interpolation isn't unique to PHP, and neither constrained to scripting languages anymore. – mario Sep 30 '15 at 20:12
  • 1
    because your string delimiters are " which means php will attempt to inject any accessible variables in to the string. If you change your delimiters to ' then you'll find $archPost->year will stop working. – Dave Sep 30 '15 at 20:12
  • 1
    Variable parsing : When a string is specified in double quotes or with heredoc, variables are parsed within it. http://php.net/manual/en/language.types.string.php#language.types.string.parsing –  Sep 30 '15 at 20:13

1 Answers1

3

This is called string interpolation, and it is available in C# as well.

Personally, I find using string interpolation to be bad practice. It makes code hard to read in your IDE, and can lead to misinterpretation of strings. (Maybe you wanted that dollar sign to mean a dollar sign, but because you used double quotes " instead of single quotes ', you now have a bug.) I concatenate instead:

$var = 'something' . $somethingElse;

If you're using echo, it is more performant to echo a list, rather than concatenate:

echo 'something', $somethingElse;

The other issue, at least as used in your example, is that you are dumping data directly into the context of HTML with no escaping done. If your output contained reserved entities, you would be generating invalid ambiguous HTML. This can even lead to security issues depending on the context used, such as XSS problems. You want to use htmlspecialchars() around any arbitrary data used in HTML. (Or, use a template engine that does this for you.)

Brad
  • 159,648
  • 54
  • 349
  • 530
  • Heh. Didn't know about it :). I guess for good reason. I share your opinion. As for the data: it's a year, so I wouldn't worry about escaping :). – Axonn Sep 30 '15 at 20:16
  • 1
    It's supposed to be a year, doesn't mean it is going to be. I wonder how many injection attacks have resulted because of that exact phrase. – ajon Sep 30 '15 at 21:11
  • @ajon Exactly. A proper file doing template-like work should be transparent. It's impossible predict what code will get passed in there in the future, and you should never have to know everything about a whole system when implementing one part of it. – Brad Sep 30 '15 at 21:50