Dollar ($) sign in password string treated as variable Dollar ($) sign in password string treated as variable php php

Dollar ($) sign in password string treated as variable


$_DB['password'] = 'mypas$word';

Single quote strings are not processed and are taken "as-is". You should always use single quote strings unless you specifically need the $variable or escape sequences (\n, \r, etc) substitutions. It's faster and less error prone.


PHP is interpolating the variable $word into the string mypas$word, as is normal behaviour for string literals delineated with double quotes. Since $word is presumably undefined, the resulting interpolated string is mypas.

The solution is to use single quotes. Single-quoted string literals do not undergo variable interpolation.


The other answers all work until there are single quotes embedded in the passsword.

Fail:

$_DB['password'] = 'my'pas$word';

Alternatives:

If you don't have other escaped characters, you can escape the $ with \$, e.g.

$_DB['password'] = "my'pas\$word";

Or it may be simpler to escape the single quote e.g.

$_DB['password'] = 'my\'pas$word';