Already many days I'm documenting about the SQL Injection. I was wondering if the code I wrote is vulnerable in some of its parts.
<?php
if($_POST['nameone'] AND $_POST['nametwo'])
{
$conn = new PDO("mysql:host=localhost;dbname=dbname;charset=utf8", 'dbuser', 'dbpass');
mysql_query('SET NAMES utf8');
$conn->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
$conn->setAttribute(PDO::ATTR_EMULATE_PREPARES, false);
$stmt = $conn->prepare("INSERT INTO `test_PDO`(`nameone`, `nametwo`) VALUES (:nomeone,:nometwo)");
$nameone = $_POST['nameone'];
$nametwo = $_POST['nametwo'];
$stmt->bindParam(':nomeone', $nameone);
$stmt->bindParam(':nometwo', $nametwo);
$stmt->execute();
echo "New records created successfully $nameone -- $nametwo";
$conn = null;
}
?>
<form method="POST">
Name one: <input type="text" name="nameone"><br>
Name two: <input type="text" name="nametwo"><br>
<input type="submit">
</form>
It would be great if somebody could review and confirm that this code is indeed not vulnerable to SQL injection. Or if it is vulnerable, kindly point out where, and how to make it better.