Why you can't put array variables right into a string

Code like this can be seen on SO a lot of times:

header("Location: $_SERVER[HTTP_REFERER]");

echo "$array['variable']

$test = "$array[USERID]$array[display]");

What’s wrong with it?

It’s first of all, it’s the very opposite of clean and proper code style.

Properly:

echo $array['variable'] . "

…is the way to go.

Yep, the serious issues come in when using associative arrays without quotations, like in the first example:

header("Location: $_SERVER[HTTP_REFERER]");

Using an associative array without putting quotes arround the element means, the element is defined by a constant. Consider the following example:

<?php

define('TEST', 1234);

$array = array(

'TEST' => 'left',

1234 => 'right'

);

// Surprise:

echo $array[TEST];

echo '

echo $array['TEST'];

Try it and see, why you should use quotations and concatenate strings properly!

P.S Using the Referer directly in a header() function, without validating the user input, leaves your script open for header injection!