Have Geek Brain

What is the point of accelerating quotes in php

Here is a confirmation script from a book I am studying Why avoiding quotes? eg<option value=\"char\">char</option> 

<?php
//validate important input
if ((!$_POST[table_name]) || (!$_POST[num_fields])) {
    header( "location: show_createtable.html");
           exit;
}

//begin creating form for display
$form_block = "
<form action=\"do_createtable.php\" method=\"post\">
<input name=\"table_name\" type=\"hidden\" value=\"$_POST[table_name]\">
<table cellspacing=\"5\" cellpadding=\"5\">
  <tr>
    <th>Field Name</th><th>Field Type</th><th>Table Length</th>
  </tr>";

//count from 0 until you reach the number fo fields
for ($i = 0; $i <$_POST[num_fields]; $i++) {
  $form_block .="
  <tr>
  <td align=center><input type=\"texr\" name=\"field name[]\"
  size=\"30\"></td>
  <td align=center>
    <select name=\"field_type[]\">
        <option value=\"char\">char</option>
        <option value=\"date\">date</option>
        <option value=\"float\">float</option>
        <option value=\"int\">int</option>
        <option value=\"text\">text</option>
        <option value=\"varchar\">varchar</option>
        </select>
  </td>
  <td align=center><input type=\"text\" name=\"field_length[]\" size=\"5\">
  </td>
</tr>";
}

//finish up the form 
$form_block .= "
<tr>
    <td align=center colspan=3><input type =\"submit\" value=\"create table\">
    </td>
</tr>
</table>
</form>";

?>

<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>Create a database table: Step 2</title>
</head>

<body>
<h1>defnie fields for <? echo "$_POST[table_name]"; ?> 
</h1>
<? echo "$form_block"; ?>

</body>
</html>
+2


a source to share


8 answers


Escaping quotes within a string prevents them from line termination. For instance:

$str = "Hi this is a "broken" string";

In fact, PHP parser sees several statuses: "Hi this is a"

, broken

and "string "

. It becomes an invalid line of code.

When the parser encounters the first quotation mark, it knows that it has found the string, and it knows that the next quotation mark tells where the string ends. If you want to have quotes inside your string, you need to tell the parser that they are not the end of the string, avoiding them with backslashes in front.



If you start your string with single quotes, '

you only need to escape the single quotes inside your string. Same with double quotes. These two lines are valid code:

$str = "This string is 'not' broken";
$str = 'This string is also "not" broken';

You just need to keep track of what you used to open and close the string.

+7


a source


When you start a line with "

, any unescaped "

inside will mark the end of the line:

$str = " A string can be enclosed in ' or ".";
                                          ^
this " which is not escaped will prematurely end the string.

To avoid this, we will avoid anyone "

appearing inside"" 

$str = " A string can be enclosed in ' or \".";


Likewise, an unsafe "on the line enclosed in" will cause problems.

The easy job is to understand that a "

internally is ' '

treated literally, and therefore '

internally" "

So, if you want to escape the escape code "

, you can wrap the string in ' '

, but inside the variables ' '

will not be interpolated, you need to remember that.

+2


a source


It is needed there because you are assigning a value to a string. You can also use single quotes and not escape double quotes, but you need to be careful and avoid single quotes in a string:

$form_block .= '
<tr>
<td align=center><input type="texr" name="field name[]"
size="30"></td>
<td align=center>
  <select name="field_type[]">
      <option value="char">char</option>
      <option value="date">date</option>
      <option value="float">float</option>
      <option value="int">int</option>
      <option value="text">text</option>
      <option value="varchar">varchar</option>
      </select>
</td>
<td align=center><input type="text" name="field_length[]" size="5">
</td>
</tr>';
+2


a source


Quotes must be avoided because the PHP parser would otherwise assume that these quotes end the string instead of being part of the string.

To avoid escaping quotes, you can in some cases use apostrophes instead, but variables within strings, enclosed within apostrophes, will not be parsed (i.e. the contents of a variable will not be output, only the variable name).

However, neither single nor double quotes are favorable when outputting multiple lines of HTML at a time. The book may not have meant to confuse the reader or introduce new concepts, but in general, if you have a long block of HTML that you want to output without variables, then it’s better to just exit PHP mode, like this:

<?php
for ($i = 0; $i < 10; $i++)
{
?>
Some text goes here
<input type="text" name="textfield[]" />
<br />
<?php
}
?>

It's optimal and computationally, and allows you to write text without worrying about escape sequences or anything like that. However, if you need variables, this may not always be the best solution (although you can always go back to PHP mode to output the variable). For this purpose, there is a heredoc syntax for strings. For instance:

<?php
for ($i = 0; $i < 10; $i++)
{
    echo <<<SOMELABEL
Text number $i: 
<input type="text" name="textfield[$i]" />
<br />
SOMELABEL;
}
?>

A line is made up of all text starting with <<<SOMELABEL

, up to a line containing only text SOMELABEL;

(you can obviously name the shortcut whatever you want). All PHP variables and escape sequences work in the heredoc syntax, so it can be ideal when the string is multiple lines of HTML, because you don't have to worry about avoiding quotes.

+2


a source


If you specify a string with "

and then use that character inside the string, it will end the string. Use both '

and"

'<option value="char">char</option>'

+1


a source


You use them to tell PHP that the quotes are part of the string, not the end of it. For instance:

my_string = "hello "world"";

will give an error, PHP parser gets confused. Your options should either run away from them:

my_string = "hello \"world\"";

or use single quotes to delimit the string:

my_string = 'hello "world"';
+1


a source 


$form_block = "
<form action=\"do_createtable.php\"...

A string stored, for example, form_block, is enclosed in quotes to indicate it as a string.

Now this string contains a quote character inside the string, but if you have to represent this quote simply "without escaping", then the php interpreter will understand that at the end of the line.

eg.

$form_block = "
<form action=\"do_createtable.php\"
//            ^
//            |
//          escaped quotation mark, part of string.
//      notice how this text is red because it a string.
//      and I need to end this line with a quotation mark to end the string."
$form_block = "
<form action="do_createtable.php\"
//           ^
//           |
//          not escaped quotation mark, so string will end there, it will be "<form action="
+1


a source


you can also get around escaping quotes altogether by using something like

echo <<<EOD
    <td align=center><input type="texr" name="field name[]"
    size="30"></td>
    <td align=center>
      <select name="field_type[]">
          <option value="char">char</option>
          <option value="date">date</option>
          <option value="float">float</option>
          <option value="int">int</option>
          <option value="text">text</option>
          <option value="varchar">varchar</option>
          </select>
EOD;

where echo <<<EOD;

and EOD;

are in their own lines

0


a source






More articles:


All Articles