I have an HTML file that contains a submit form, which asks the users the fill in their personal info:

enter image description here

then it will post and store into the DB by method of PHP SQL:

 // Check input errors before inserting in database
if (empty($CName_err) && empty($Address_err) && empty($amount_err) && empty($Phone_err)) {
    // Prepare an insert statement
    $pdo = Database::connect();
    $sql = "INSERT INTO database (CName, Address, Phone, Amount ,Ticket, Purpose) VALUES (?, ?, ?, ? ,?, ?)";

    $q = $pdo->prepare($sql);
    $q->execute(array($CName, $Address, $Phone, $amount ,$Ticket ,$Purpose));

Hence, any risks of an SQL injection attack in this case?

What should I do to improve my coding?

  • \$\begingroup\$ Welcome to Code Review! I hope you get great answers. \$\endgroup\$ – Phrancis Jul 4 '18 at 0:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.