Changing built-in PHP variable to a local variable

PHP
21

Okay, I will buy your strong recommening.
I found some of my coding practice is bad.
I like to improve my coding practice especially in my new project. .

22

By the way,
I found the code below doesn’t work correctly.

$sql=("INSERT INTO test ( name)
VALUES (  '$_SERVER[HTTP_REFERER] ') ");

Instead of the code above, is the code below Okay?

$SERVER_HTTP_REFERER = $_SERVER[HTTP_REFERER];
$sql=("INSERT INTO test ( name)
VALUES ( '$SERVER_HTTP_REFERER') ");
23

Sometimes script can be simplified and makes debugging a lot easier as can be seen in this post

24

Please edit your post and start and finish the script with three backticks on a single line because the editor has removed some characters.

25

I am on the way of editing it. but it’s not easy to do.
What does it mean by “backticks”?

26

A backtick character is usually the top left key on American keyboards and is a single quite mark facing backwards.

Alternatively highlight the script and use the forum post shortcut </> which is at the top of the editor post box.

If this explanation is not clear then search for backtick.

27

I fixed it.

1 Like
28

Thus is what I meant:

// BAD
$SERVER_HTTP_REFERER = $_SERVER[HTTP_REFERER];
$sql=("INSERT INTO test ( name)
VALUES ( '$SERVER_HTTP_REFERER') ");

// GOOD
$SERVER_HTTP_REFERER = $_SERVER['HTTP_REFERER'];

$sql = "INSERT INTO test ( `name` )
VALUES (" . $SERVER_HTTP_REFERER .')';

// BETTER
$sql = 'INSERT INTO test ( `name` )
VALUES (' .$_SERVER['HTTP_REFERER'] . ')';

Edit:
There is a big difference in using single and double quotes containing variables.

I far prefer to use single quotes when enclosing strings then concatenating variables because it seems far less confusing.

29

Unfortunately it is neither good, nor better. You need to use Prepared Statements. Variables have no business in a query whatsoever and creating variables for nothing is never a good idea.

1 Like
30

I was just trying to solve the Post #22 “By the way, I found the code below doesn’t work correctly.”


I agree that inserting variables can cause security problems which Prepared Statements overcomes. I find there is an abundance of poor and outdated information on MySql and also MySqli which because “it is on the Internet so it must be true”. It is not easy when starting to know what is best :frowning:

Perhaps the next PHP version will drop MySqli and only allow PDO or as an intermediate measure raise warnings.

31

I figured it was something like that. I know you know to use Prepared Statements. :grinning:

I would fully support dropping Mysqli. I think Php8 would be a great place to do that.

1 Like
32

Yeah i’m really looking forward for all the new tutorials containing

$pdo->query('select * from foo where id = $_GET["bar"]');

LOL

1 Like
33

Simple enough…

PHP 8 Proposed Spec…

$pdo->query('select * from foo where id = $_GET["bar"]');

Parse error: syntax error, unexpected $ in /home/sumuser/sumproject/somefile.php on line 15

1 Like
34

I don’t doubt it will happen.
At least it will be easier to steer them in the right direction from that, instead of having to remember (look up) mysqli syntax that you havn’t used in years.

Interesting idea, though don’t know if it’s just me, but I will confess to using variables in queries. Never user input, but sometimes variables set explicitly in the script, away from outside interference.

1 Like
35

That is the one case you could be OK doing it, but for the sake of consistency I would say “never” do it.

36

Is there already an RFC on that?

37

Not that I know of. That would be my proposal.

38

Didn’t expect someone here to take this seriously…

39

After a few years of why is my script telling "undefined function mysqli_something..."

40

Wouldn’t matter, as the query is enclosed in single-quotes, so wouldn’t be parsed for variable names anyway. Probably.