Calling PHP variables in a MySQL query

[La_Parka]

Is there any difference between the following, such as one being more secure than the other?:

$sql = "DELETE FROM mytable
WHERE keyid = '".$keyID."'
";

$sql = "DELETE FROM mytable
WHERE keyid = '$keyID'
";

[laserlight]

There is no difference in security between the two. The former is potentially faster, though the difference is negligible, hence I tend to prefer the latter as I find it more readable.

For security, look into prepared statements say with the PDO extension. If that is not available to you, use the appropriate escaping mechanism for your database API.