What are the potential pitfalls of not using quotes around text values in PHP queries?

Not using quotes around text values in PHP queries can lead to syntax errors or unexpected behavior, especially when dealing with strings that contain special characters. To avoid this issue, always enclose text values in single or double quotes when constructing SQL queries in PHP. 

// Example of using quotes around text values in a PHP query
$name = "John Doe";
$query = "SELECT * FROM users WHERE name = '$name'";
$result = mysqli_query($connection, $query);

Keywords

SQL injection security vulnerability mysqli_real_escape_string prepared statements data sanitization

Related Questions