HTML file with a submit form

Question

I have an HTML file that contains a submit form, which asks the users the fill in their personal info:

then it will post and store into the DB by method of PHP SQL:

 // Check input errors before inserting in database
if (empty($CName_err) && empty($Address_err) && empty($amount_err) && empty($Phone_err)) {
    // Prepare an insert statement
    $pdo = Database::connect();
    $pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
    $sql = "INSERT INTO database (CName, Address, Phone, Amount ,Ticket, Purpose) VALUES (?, ?, ?, ? ,?, ?)";

    $q = $pdo->prepare($sql);
    $q->execute(array($CName, $Address, $Phone, $amount ,$Ticket ,$Purpose));
    Database::disconnect();

Hence, any risks of an SQL injection attack in this case?

What should I do to improve my coding?

Answer 1

What should I do to improve my coding?

Address_err, amount_err

Your variable names have inconsistent capitalization.

CName, Address, Phone, Amount ,Ticket, Purpose
$CName, $Address, $Phone, $amount ,$Ticket ,$Purpose

The commas are sometimes on the left, sometimes on the right.

$sql

The contents are not "structured query language". Maybe name it "$query".

$pdo = Database::connect();

You should check to make sure you are connected before continuing.

$q

What does "q" stand for?

if (empty($CName_err) && empty($Address_err) && empty($amount_err) && empty($Phone_err))

Might be better to stop processing on first error.

if (!empty($CName_err)) {
    ...
    return
}

if (!empty($Address_err)) {
    ...
    return
}

[normal processing here]

If you don't need to handle separate errors, simply use a boolean.

if (errorOccurred) {...}