Member Avatar for johng123

have problems understanding the logic of using variables inside this code. why ist it possible to use %s for different variables and how is it possible to use them as %1$s and %2$s...without even defining them somewhere...i just dont get it, the complete code can be viewed in the thread: hyperlink from url
could anybody help:


$hyperlink = sprintf('<a href="" target="%2$s">%3$s</a>', $url, $target, $showingtext);

// Build the SQL query. This function will again replace each placeholder with the listed variable values respectively
$sql = sprintf("INSERT INTO `hyperlinktable2` SET `url` = '%s', `target` = '%s', `showingtext` = '%s', `hyperlink` = '%s'",
$url, $target, $showingtext, $hyperlink);

here is the form code to the variables
<form action="insert.php" method="post">
url: <input type="text" name="url" />
target: <input type="text" name="target" />
showingtext: <input type="text" name="showingtext" />

Edited by johng123 because: n/a
  • 3 Contributors
  • 2 Replies
  • 199 Views
  • 10 Hours Discussion Span
  • Latest Post Latest Post by vibhaJ

Dani AI

Generated

— quick clarification and some practical tips that build on what and pointed out.

sprintf takes a format string as its first argument and then the values to insert as the following arguments. A plain %s just means “take the next argument and format it as a string.” Numbered placeholders like %1$s or %2$s let you pick which argument to use (the numbers are 1-based). That is why one format string can refer to different variables without “declaring” them inside the string — the values come from the additional arguments you pass to sprintf.

A couple of important details:

  • The type letter is required: use %1$s, not %1 (the s says “string”). So ’s suggestion to drop the s is incorrect.
  • If you put the format string in double quotes, PHP may try to interpolate $ as a variable. Either use single quotes ('%2$s %1$s') or escape the dollar ("%2\$s %1\$s").

Example (different order):

echo sprintf('%2$s then %1$s', 'first', 'second'); // outputs: "second then first"

Security and correctness tips for your form/SQL use:

  • Don’t build SQL by concatenating or sprintf-ing user input — that’s an SQL injection risk. Use prepared statements (PDO or mysqli) with bound parameters instead:
    $stmt = $pdo->prepare('INSERT INTO hyperlinktable2 (url,target,showingtext,hyperlink) VALUES (?, ?, ?, ?)');
$stmt->execute([$url, $target, $showingtext, $hyperlink]);
  • Validate and sanitize inputs: use filter_var($url, FILTER_VALIDATE_URL) for URLs and htmlspecialchars($text, ENT_QUOTES, 'UTF-8') before outputting into HTML to avoid XSS.

Finally, positional specifiers are handy for reordering placeholders (useful for localization). ’s pointer to the manual is useful for exact format options; keep the s, d, f types clear, validate inputs, and use prepared statements for DB work.

Recommended Answers

All 2 Replies

Member Avatar for C#Jaap

Maybe this will help:

Member Avatar for vibhaJ

See .
In you code you can change %1$s to %1 as all 3 string order is fixed.

echo $hyperlink = sprintf('<a href="" target="%s">%s</a>', 'url', 'target', 'showingtext');
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.