I normally use MySQLi and this is my first time trying out PDO. I am doing this because this is my first web application that is going to be used by the public, hence I want it to be secure. The code I wrote, following a W3 tutorial is working flawlessly, however due to a few other posts on Stack Overflow I have read, I am worried it might not be as secure as I would like.
<?php
if (isset($_SERVER["HTTP_CF_CONNECTING_IP"])) {
$_SERVER['REMOTE_ADDR'] = $_SERVER["HTTP_CF_CONNECTING_IP"];
}
include 'dbconfig.php';
$pickuploc = ($_POST['pickuploc']);
$droploc = ($_POST['droploc']);
$pickupdate = ($_POST['pickupdate']);
$pickuptime = ($_POST['pickuptime']);
$dropdate = ($_POST['dropdate']);
$droptime = ($_POST['droptime']);
$class = ($_POST['cclass']);
$numofdrivers = ($_POST['numdrivers']);
$coverage = ($_POST['coverage']);
$driversage = ($_POST['agedrivers']);
$roadsideass = ($_POST['roadsideass']);
$afterhoursdrop = ($_POST['afterhoursdrop']);
$promo = ($_POST['promo']);
$fname = ($_POST['fname']);
$lname = ($_POST['lname']);
$address = ($_POST['address']);
$city = ($_POST['city']);
$state = ($_POST['state']);
$country = ($_POST['country']);
$post = ($_POST['post']);
$dlnum = ($_POST['dlnum']);
$dlexpm = ($_POST['dlexpm']);
$dlexpy = ($_POST['dlexpy']);
$dlcountry = ($_POST['dlcountry']);
$phone = ($_POST['phone']);
$email = ($_POST['email']);
$addcomments = ($_POST['addcomments']);
$predropdatetime = $dropdate . " " . $droptime;
$date = new DateTime($predropdatetime);
$dropdatetime = $date->format('Y-m-d H:i:s');
$prepickupdatetime = $pickupdate . " " . $pickuptime;
$date = new DateTime($prepickupdatetime);
$pickupdatetime = $date->format('Y-m-d H:i:s');
$date = new DateTime('now');
$bookingdatetime = $date->format('Y-m-d H:i:s');
$dlexp = "20" . $dlexpy . "-" . $dlexpm . "-01";
if (!empty($_SERVER['HTTP_CLIENT_IP'])) {
$remoteip = $_SERVER['HTTP_CLIENT_IP'];
} elseif (!empty($_SERVER['HTTP_X_FORWARDED_FOR'])) {
$remoteip = $_SERVER['HTTP_X_FORWARDED_FOR'];
} else {
$remoteip = $_SERVER['REMOTE_ADDR'];
}
$date = new DateTime($pickupdate);
$sqlpickupdate = $date->format('Y-m-d');
$conn = new PDO("mysql:host=$servername;dbname=$dbname", $username, $password);
$sql = "SELECT COUNT(*) AS num FROM blackout WHERE :pickupdate BETWEEN start_date AND end_date AND city=:pickuploc AND class=:class";
$stmt = $conn->prepare($sql);
$stmt->bindValue(':class', $class);
$stmt->bindValue(':pickupdate', $sqlpickupdate);
$stmt->bindValue(':pickuploc', $pickuploc);
$stmt->execute();
$row = $stmt->fetch(PDO::FETCH_ASSOC);
if($row['num'] > 0){
$blackout = true;
} else{
$blackout = false;
}
$conn = null;
if ((($dlcountry == "US" || $dlcountry == "JP") && ($driversage == "19" || $driversage == "20") && $coverage == "inclusive") || ($class == "suv" || $class == "minivan" || $class == "convert") && ($driversage == "19" || $driversage == "20") || ($pickuploc == "oc") || ($blackout == true)) {
echo "RESERVATION NOT BOOKED YOU NEED TO TAKE ACTION!!<br><br><br>";
$status = "Unconfirmed";
}else{
$status = "Confirmed";
}
try {
$conn = new PDO("mysql:host=$servername;dbname=$dbname", $username, $password);
// set the PDO error mode to exception
$conn->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
// prepare sql and bind parameters
$stmt = $conn->prepare("INSERT INTO reservations (bookingdatetime, firstname, lastname, address, city, state, country, post, dlnum, dlexp, dlcountry, phone, email, addcomments, pickuploc, droploc, pickupdatetime, dropdatetime, class, numofdrivers, coverage, driversage, roadsideass, afterhoursdrop, promo, status, remoteip)
VALUES (:bookingdatetime, :firstname, :lastname, :address, :city, :state, :country, :post, :dlnum, :dlexp, :dlcountry, :phone, :email, :addcomments, :pickuploc, :droploc, :pickupdatetime, :dropdatetime, :class, :numofdrivers, :coverage, :driversage, :roadsideass, :afterhoursdrop, :promo, :status, :remoteip)");
$stmt->bindParam(':bookingdatetime', $bookingdatetime);
$stmt->bindParam(':firstname', $fname);
$stmt->bindParam(':lastname', $lname);
$stmt->bindParam(':address', $address);
$stmt->bindParam(':city', $city);
$stmt->bindParam(':state', $state);
$stmt->bindParam(':country', $country);
$stmt->bindParam(':post', $post);
$stmt->bindParam(':dlnum', $dlnum);
$stmt->bindParam(':dlexp', $dlexp);
$stmt->bindParam(':dlcountry', $dlcountry);
$stmt->bindParam(':phone', $phone);
$stmt->bindParam(':email', $email);
$stmt->bindParam(':addcomments', $addcomments);
$stmt->bindParam(':pickuploc', $pickuploc);
$stmt->bindParam(':droploc', $droploc);
$stmt->bindParam(':pickupdatetime', $pickupdatetime);
$stmt->bindParam(':dropdatetime', $dropdatetime);
$stmt->bindParam(':class', $class);
$stmt->bindParam(':numofdrivers', $numofdrivers);
$stmt->bindParam(':coverage', $coverage);
$stmt->bindParam(':driversage', $driversage);
$stmt->bindParam(':roadsideass', $roadsideass);
$stmt->bindParam(':afterhoursdrop', $afterhoursdrop);
$stmt->bindParam(':promo', $promo);
$stmt->bindParam(':status', $status);
$stmt->bindParam(':remoteip', $remoteip);
// insert a row
$stmt->execute();
echo "New records created successfully";
}
catch(PDOException $e)
{
echo "Database Error: " . $e->getMessage();
}
$conn = null;
echo "pick up location: " . $pickuploc . "<br> drop off locaiton: " . $droploc . "<br>pick up date: " . $pickupdate . "<br>pick up time: " . $pickuptime . "<br>drop date: " . $dropdate . "<br>drop time: " . $droptime . "<br>class: " . $class . "<br> number of drivers: " . $numofdrivers . "<br> coverage: " . $coverage . "<br>drivers age: " . $driversage . "<br>roadside assitance: " . $roadsideass . "<br>after hours drop:" . $afterhoursdrop . "<br>promo: " . $promo ."<br><br>first name: " . $fname . "<br>last name: " . $lname . "<br>address: " . $address . "<br>city: " . $city . "<br>state: " . $state . "<br>country: " . $country . "<br>post code: " . $post . "<br>dl number: " . $dlnum . "<br>dl exp month: " . $dlexpm . "<br>dl exp yesr: " . $dlexpy . "<br>dl country: " . $dlcountry . "<br>phone: " . $phone . "<br>email: " . $email . "<br>add comments: " . $addcomments;