String Interpolation & Heredoc/Nowdoc
debt(d5/e3/b3/t5)
Closest to 'specialist tool catches' (d5), since semgrep/phpstan/phpcs from detection_hints can flag interpolation of variables into SQL/HTML patterns, but plain interpolation is normal PHP and only context-specific misuse is caught.
Closest to 'simple parameterised fix' (e3), per quick_fix: swap interpolated SQL for prepared statements or wrap HTML output in htmlspecialchars — pattern replacement, sometimes touching a few call sites.
Closest to 'localised tax' (b3), since interpolation choices are per-string and affect readability locally; tags are just syntax/strings, no architectural reach.
Closest to 'notable trap' (t5), matching the misconception that interpolation and concatenation are interchangeable, plus the documented gotchas around single vs double quotes and {$var} syntax for complex expressions.
Also Known As
TL;DR
Explanation
PHP offers four string literal syntaxes. Double-quoted strings interpolate simple variables ($name), array elements ({$arr['key']}), and complex expressions (${expr}). Heredoc (<<<EOT ... EOT) behaves like a double-quoted string across multiple lines — useful for SQL, HTML templates, and email bodies. Nowdoc (<<<'EOT' ... EOT) is the heredoc equivalent of single-quoted strings — no interpolation at all, ideal when the content contains dollar signs or backslashes that shouldn't be treated as escape sequences. PHP 8.3 tightened heredoc/nowdoc indentation rules: the closing marker's indentation defines the strip amount. Avoid interpolation of user data into SQL strings — use prepared statements regardless of how readable $query = "SELECT * FROM users WHERE id=$id" looks.
Common Misconception
Why It Matters
Common Mistakes
- Interpolating user input directly into SQL queries — even inside a string, this is SQL injection.
- Complex expressions in strings: "User {$user->getName()}" — use concatenation or sprintf for clarity.
- Confusing single-quoted (no interpolation) and double-quoted (interpolation) strings.
- Not using curly brace syntax for array access: "Hello $user[name]" vs "Hello {$user['name']}".
Code Examples
$q = "SELECT * FROM users WHERE email='$email'"; // SQLi via interpolation$stmt = $pdo->prepare('SELECT * FROM users WHERE email = ?');
$stmt->execute([$email]);