I am having trouble with formatting php correctly. Specifically, when I need to use two sets of double quotes, how do I make it group them correctly?
eg:
query("INSERT INTO Holdings (id, symbol, shares) VALUES ($_SESSION["id"], "$_POST["symbol"]", $_POST["shares"]) ON DUPLICATE KEY UPDATE shares = shares + VALUES(shares)")
When I run this line, it groups these quotes together: "INSERT...."$_POST[["symbol"] . So, now "$_POST["symbol"]" isn't surrounded by quotes when the query is ran.
here are two solutions:
you could use the string concatenation operator (i.e., .). example:
echo "the session id is: " . $_SESSION["id"] . "!";
you could surround the name of the variable with curly braces. example:
echo "the session id is: {$_SESSION["id"]}!";
update: you shouldn't surround variable names with quotes. so you shouldn't have something like "$_POST["symbol"]". it should be just $_POST["symbol"].
also as mentioned above, you should probably use one of these ways when you're plugging variables into a string not get things mixed up.
in this particular case, it's highly recommended to use a parameterized query to protect your database from injection attacks. example:
query("INSERT INTO foo (a, b) VALUES (?, ?)", $varA, $varB);
where foo is a table, a and b are columns, and $varA and $varB are variables.
