About Quotes and Strings

When writing dynamic web pages with PHP and MySQL, there are numerous issues around the use of quotation marks that you must understand to avoid errors in your code. PHP, HTML and MySQL use quotation marks in ways that are both similar and different. As strings move from one environment to another, they are transformed in a variety of ways. This series of articles will map out and explain the essential behaviors that will let you write solid, high-quality code.

Quotes in PHP

In PHP there are two significant quoting characters: the single-quote (') or apostrophe, and the double-quote ("). Both can be used in pairs to define strings.

$A="String 1";
$B='and String 2';

Single-quotes have no special properties. A string surrounded by single-quotes is a simple string literal. Double-quotes also define a simple string literal. Both types of string definitions may include quotes of the opposite type. A double-quoted string may include any number of single-quotes. Similarly, a single-quoted string may include double-quotes. In addition, you may use the same type of quote that defines the string inside the string if it is escaped by a backslash (\).

$C="Using 'single-quotes' inside a double-quoted string.";
$D='Using "double-quotes" inside a single-quoted string.';
$E="Using \"double-quotes\" escaped inside double-quotes";
$F='Using \'single-quotes\' escaped inside single-quotes';

Finally, it is possible to display quotes on a web page by using the HTML character entity references. The double-quote is represented by " or by ". The single-quote is ' - it has no name. If you echo the strings shown to a web page, they will show the character that corresponds to the entity reference. Note that the entity reference itself has no meaning in PHP and is only converted to the character by a web browser.

$G="The ampersand double-quote: "";

Double-quoted strings also have another special property in PHP. If you place a PHP variable inside a double-quoted string, it will be replaced by the value of that variable when the string is evaluated. Understand that this is a slower process than concatenation. So if you are modifying strings with one or two variables inside a loop, it is faster to just concatenate the variable with the string.

$I="Putting $A inside another string";
$J="Concatenating ".$A." with another string";

There are a number of other different quote marks and corresponding character entities, such as the ‘left single quote’ or the ‘single right-pointing angle quotation mark.’ However, none of these characters have any significance to PHP.

Quotes in HTML

Single and double-quotes also have significance within HTML. The characteristics are essentially a subset of the PHP characteristics:

Quotation marks in plain text will appear exactly as written. Basically, this is true of anything between matching HTML tags, such as <p> and </p> or <h1> and </h1>. Within the angle brackets of a tag, you must use only string literals. Attributes of each tag are defined with string literals. It is best to use one type of quote consistently throughout.

<p>Use 'any' quotes "you like" here between paragraph tags - '" '" ` </p>
<a href="http://www.helioza.com" target='other'>Use literals inside tags</a>

By the way, it is best to always use a string literal for tag attributes. In some cases, browsers will correctly interpret attribute assignments made without quotation marks. However, this is a dangerous practice. Furthermore, quotes are required for XMTML. Get in the habit of using quotation marks for all attributes, even numerals. It will improve the quality of your code.

Quotes in MySQL

MySQL has its own set of rules for handling quotation marks. Single and double-quotes operate the same as they do in HTML. Either can be used to define string literals in SQL statements.

INSERT INTO TBL_Words
(Word,Size)
VALUES ("column",'6')

As before, the opposite quote type may be used inside strings, and escaping is supported. MySQL also makes use of the backquote, or ‘single, left-pointing angle quotation mark.’ These are used optionally around table and field names.

INSERT INTO `TBL_Usrs`
(Name1,Name2,Addr,St,Zip)
VALUES ("Dan'l",'D\'Marco',"Apt \"3G\"","Neverland",'90210')

If you run this statement against a database with a valid and compatible TBL_Usrs, the following values will be entered into the fields.

Name1 = Dan'l
Name2 = D'Marco
Addr = Apt "3G"
St = Neverland
Zip = 90210

Note that the escaped quotes were translated into the actual quote characters by the MySQL engine before they were stored in the row entries. This simple transformation, and many others, can be the cause of numerous bugs in web pages generated by PHP. The next article, "Quote Transforms and PHP" covers this topic in greater detail.

Excellent article! Especially if you use PHP string to output html. Like: $out="link"; echo $out; Or in MySQL: $sql="INSERT INTO TBL_Words (Word,Size)VALUES ('column','6')";