Should I use curly brackets or concatenate variables within strings?

Question

Is there an advantage or disadvantage to concatenating variables within strings or using curly braces instead?

Concatenated:

$greeting = "Welcome, " . $name . "!";

Curly braces:

$greeting = "Welcome, {$name}!";

Personally, I've always concatenated my strings, because I use UEStudio, and it highlights PHP variables with a different color when concatenated. However, when the variable is not broken out, it does not. It just makes it easier for my eyes to find PHP variables in long strings, etc.

_{People are confusing this about being about SQL. This is not what this question is about. I've updated my examples to avoid confusion.}

Duplicate of way too many questions, including stackoverflow.com/questions/1311368/… (this is more of a single vs double quote question, but then curly braces can only be used in double quoted strings anyway) — BoltClock
– BoltClock, Commented Jan 13, 2011 at 3:08
Yeah I seem to be the only one here who realizes your question isn't specifically about SQL (hence me saying "off-topic"). — BoltClock
– BoltClock, Commented Jan 13, 2011 at 3:49
PhpStorm correctly highlights the variables inside quoted in quotes separately. — nawfal
– nawfal, Commented Nov 6, 2015 at 3:05

Amil Waduwawara · Accepted Answer · 2014-10-16 05:05:33Z

59

All of the following does the same if you look at the output.

$greeting = "Welcome, " . $name . "!";
$greeting = 'Welcome, ' . $name . '!';
$greeting = "Welcome, $name!";
$greeting = "Welcome, {$name}!";

You should not be using option 1, use option 2 instead. Both option 3 and 4 are the same. For a simple variable, braces are optional. But if you are using array elements, you must use braces; e.g.: $greeting = "Welcome, {$user['name']}!";. Therefore as a standard, braces are used if variable interpolation is used, instead of concatenation.

But if characters such as tab (\t), new-line (\n) are used, they must be within double quotations.

Generally variable interpolation is slow, but concatenation may also be slower if you have too many variables to concatenate. Therefore decide depending on how many variables among other characters.

edited Oct 16, 2014 at 5:05

answered Jan 13, 2011 at 4:31

Amil Waduwawara

1,6421 gold badge16 silver badges14 bronze badges

Sign up to request clarification or add additional context in comments.

7 Comments

Michael Irigoyen Over a year ago

Thank you for the detailed explanation. I believe I'll continue to concatenate over curly braces.

mario Over a year ago

Boah, really. @mririgo The single quotes micro optimization myth has been thouroughly debunked. Unless you have a 2GB php script with millions of strings in it, you will not be able to measure it - as it lies solely in the tokenizer. Use xdebug and find something real to optimize.

Amil Waduwawara Over a year ago

When we develop web sites for concurrent access, we must optimize coding/web pages as much as possible.

Luke Over a year ago

Curly braces are not required with array elements. Simply take out the single quotes: $greeting = "Welcome, $user[name]"; This is the only time $user[name] will not result in a notice.

Popnoodles Over a year ago

php.net/manual/en/language.types.string.php says you don't seed to wrap array elements with curly braces

|

It DoesntMatterAnyway · Accepted Answer · 2011-12-20 16:59:36Z

3

Although not dealing with injection attacks (including SQLi), it should at least be noted -- especially for PHP devs -- that using any of the above techniques without first encoding and validating all inputs will lead you to an injection-based attack.

It is important to remember security at the beginning of coding -- not the end when all of the code needs to be redone to comply with security requirements. Or, when you finally get this dang " vs. ' war down and realize that it doesn't matter because you are susceptible to XSS using either technique without properly encoding and validating all inputs.

Encode using urlencode() or htmlenities() to normalize the input(s).
Use data-typing for non-strings OR dictionary-lookup and/or regular expressions for strings to validate.
Profit?

answered Dec 20, 2011 at 16:59

It DoesntMatterAnyway

311 bronze badge

2 Comments

dotancohen Over a year ago

urlencode() and htmlenities() should not be used to normalize inputs. Rather, they should be used before outputting to the browser user-entered data that should not contain HTML, JS, or CSS.

Shayne Over a year ago

If your doing SQL, always use prepared statements. Even the most well intentioned string santizers have been thoroughly thumped over time by various attacks. Prepared statements cleanly separate the logic from the data ,giving much more efficient data insertions and retrievals, and the security has been scrutinized by experts in the database field. Alternatively use a battle hardened ORM (preferably of the data-mapping rather than active-record variety, if you value performance and type safety)

alexwenzel · Accepted Answer · 2015-05-07 12:45:39Z

3

With pre-comiled PHP (Bytecode Cache) it makes no difference.

This feature come with PHP 5.5 (Zend Optimizer+).

answered May 7, 2015 at 12:45

alexwenzel

2,4492 gold badges18 silver badges18 bronze badges

Collectives™ on Stack Overflow

Should I use curly brackets or concatenate variables within strings?

3 Answers 3

7 Comments

2 Comments

Comments

Linked

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

7 Comments

2 Comments

Comments

Linked

Related