interpolate variable into sql statement in php

To interpolate a variable into an SQL statement in PHP, you can use two methods: concatenation and prepared statements.

Concatenation:

main.php
$user_id = 1; // the variable to be interpolated
$sql = "SELECT * FROM users WHERE id = " . $user_id;
102 chars
3 lines

In the above example, we concatenate the value of $user_id into the SQL statement using the . operator.

Prepared Statements:

main.php
$user_id = 1; // the variable to be interpolated
$stmt = $pdo->prepare("SELECT * FROM users WHERE id = ?");
$stmt->execute([$user_id]);
136 chars
4 lines

In the above example, we use a prepared statement with a placeholder ? where the variable will be interpolated. We then pass an array that contains the value of $user_id to the execute() method of the $stmt object. This method will automatically interpolate the value into the SQL statement, while also handling any necessary escaping of characters to prevent SQL injection attacks.

Using prepared statements is generally recommended as it provides an extra layer of security.