Why does this query have .?

Question

I want to know why the following query have . and "" in ".$_POST['date']." etc.

$query = "INSERT INTO eventcal ('eventDate','eventTitle','eventContent','user',
'user_id') VALUES('".$_POST['date']."','".addslashes($_POST['eventTitle'])."',
'".addslashes($_POST['eventContent'])."')";     

If I change to the following, will it make any differences?

VALUES('$_POST['date']','addslashes($_POST['eventTitle'])',
'addslashes($_POST['eventContent'])')

Thanks in advance.

Answer 1

It is the PHP form of concatenation (The quotes mark the end of the strings). In JavaScript and many other languages it is the + character that concatenates.

echo "hello" . " " . "world!"; // Outputs 'hello world'

Yes, making that change would drastically change its meaning.

Finally, this is open to a severe SQL injection attack because date is not properly escaped.

Always sanitize your input and use parameterized queries where possible.