Another Variable Question

When a user updates their contact details I save the changes but get an "unexpected T_ENCAPSED_AND_WHITESPACE, expecting T_STRING or T_VARIABLE or T_NUM_STRING" error when using the below code.

PHP Code:

---

$field_str .= "firstname = '$_POST['firstname']', ";
$field_str .= "lastname = '$_POST['lastname']' "; 


---

How can I get the above to work without having to declare the variables like in the below example?

PHP Code:

---

//eg.
$firstname = $_POST['firstname'];
$lastname = $_POST['lastname'];

$field_str .= "firstname = '$firstname', ";
$field_str .= "lastname = '$lastname' "; 


---

EDIT: Got it working :)

PHP Code:

---

$field_str .= "firstname = '$_POST[firstname]', ";
$field_str .= "lastname = '$_POST[lastname]', "; 


---

Quote:

---

Originally Posted by lintz

EDIT: Got it working :)

PHP Code:

---

$field_str .= "firstname = '$_POST[firstname]', ";
$field_str .= "lastname = '$_POST[lastname]', "; 


---

---

Its alot better to use this method, then PHP doesn't have to work out whether the index you have used is a constant or a string. I.e: less resources are used.

PHP Code:

---

$field_str .= "firstname = '{$_POST['firstname']}', ";
$field_str .= "lastname = '{$_POST['lastname']}', "; 


---

P.s: are you checking that you post data has been escaped. What if someone puts a username in lile " ' OR 1 "??