Speed vs security vs compatibility over methods to do string concatenation in Python <p><a href="http://stackoverflow.com/questions/1225637/python-string-formatting">Similar</a> questions <a href="http://stackoverflow.com/questions/376461/string-concatenation-vs-string-substitution-in-python/376508#376508">have been brought</a> (good speed comparison there) on this same <a href="http://en.wikipedia.org/wiki/Concatenation" rel="nofollow noreferrer">subject</a>. Hopefully this question is different and updated to Python <em>2.6</em> and <em>3.0</em>.</p> <p>So far I believe the faster and most compatible method (among different Python versions) is the plain simple <code>+</code> sign:</p> <pre><code>text = "whatever" + " you " + SAY </code></pre> <p>But I keep hearing and reading it's not secure and / or advisable.</p> <p>I'm not even sure how many methods are there to manipulate strings! I could count only about 4: There's <a href="http://en.wikipedia.org/wiki/Variable_interpolation#Interpolation" rel="nofollow noreferrer">interpolation</a> and all its sub-options such as <code>%</code> and <code>format</code> and then there's the simple ones, <code>join</code> and <code>+</code>.</p> <p>Finally, the <a href="http://docs.python.org/release/3.0.1/whatsnew/3.0.html#pep-3101-a-new-approach-to-string-formatting" rel="nofollow noreferrer">new approach to string formatting</a>, which is with <code>format</code>, is certainly not good for backwards compatibility at same time making <code>%</code> not good for forward compatibility. But should it be used for every string manipulation, including every concatenation, whenever we restrict ourselves to 3.x only?</p> <p>Well, maybe this is more of a wiki than a question, but I do wish to have an answer on <strong>which is the proper usage of each string manipulation method</strong>. And which one could be generally used with each focus in mind (best all around for compatibility, for speed and for security).</p> <p>Thanks.</p> <p>edit: I'm not sure I should accept an answer if I don't feel it really answers the question... But my point is that all them 3 together do a proper job.</p> <p>Daniel's most voted answer is actually the one I'd prefer for accepting, if not for the "note". I highly disagree with <em>"concatenation is strictly using the + operator to concatenate strings"</em> because, for one, <code>join</code> does string concatenation as well, and we can build any arbitrary library for that.</p> <p><strong>All current 3 answers are valuable</strong> and I'd rather having some answer mixing them all. While nobody volunteer to do that, I guess by choosing the one less voted (but fairly broader than THC4k's, which is more like a large and very welcomed comment) I can draw attention to the others as well.</p>