PHP string concat without the "dot" operator

Question

I'm working to integrate a plug-in into a PHP web application, and one line of the code puzzles me:

$sql = "update inventory set qtyleft='$qtyleft',price='$price',sales=sales+'$sales',qtysold=qtysold+'$qtysold' where id='$id'";
mysql_query($sql);

where $qtyleft, $price, $sales, $qtysold and $id are all variables.

I'm not very familiar with PHP, but I always thought string concatenation in PHP is done by using the . operator and it seems to me that the code above is just a long string without actually putting those variables to the SQL query. Is that the case?

Answer 1

In PHP, double quote (") delimited strings will evaluate variables in them.

$foo = 42;
echo "The answer for everything is $foo"; // The answer for everything is 42

This specific example is very bad because you shouldn't include variables directly in an SQL query, and shouldn't use mysql_query in new code.

See more:

• Why shouldn't I use mysql_* functions in PHP?
• How can I prevent SQL injection in PHP?