I have written code to send a simple email submission form to a sql table so that I can manage the data. I would like feedback on whether or not the code that I have written is efficient and secure. I have a config file that defines constants for database credentials.
HTML FORM
<form method="post" action="index.php">
<input class="bt-email" type="email" name="email" placeholder="enter email address">
<input class="bt-submit" type="submit" value="let's get moving!">
</form>
PHP Database Code File
try {
$db = new PDO("mysql:host=" . DB_HOST . ";dbname=" . DB_NAME . ";port=" . DB_PORT,DB_USER,DB_PASS);
$db->setAttribute(PDO::ATTR_ERRMODE,PDO::ERRMODE_EXCEPTION);
$db->exec("SET NAMES 'utf8'");
} catch (Exception $e) {
echo "Could not connect to the database.";
exit;
}
PHP/SQL Submission Code
<?php
require_once("inc/config.php");
if ($_SERVER["REQUEST_METHOD"] == "POST") {
$email = $_POST["email"];
require(ROOT_PATH . "inc/database.php");
try {
$db->exec("REPLACE INTO launch_email VALUES ('$email')");
} catch (Exception $e) {
echo "Data could not be submitted to the database.";
exit;
}
header("Location: index.php?status=thanks");
exit;
}
?>