html form INSERT INTO database - php

Question

It may be a minor error but I am currently trying to post from a html form into the database to add a new entry.
Here is the code:
<div>
<?php
$menu = "INSERT INTO content (id, path, name)
**VALUES ('".$_POST['id']."', '".$_POST['path']."', '".$_POST['name']."')";**
if ($connnect->query($menu) === TRUE) {
echo "New page added successfully";
} else {
echo "Error";
}
?>
<form action="" method="post" name="menus" id="menus">
<table style="width: 500px;">
<tbody>
<tr>
<td>
<textarea name="id" id="id"></textarea>
</td>
</tr>
<tr>
<td>
<textarea name="path" id="path"></textarea>
</td>
</tr>
<tr>
<td>
<textarea name="name" id="name"></textarea>
</td>
</tr>
<tr>
<td>
<input type="submit" name="button" id="button" value="Upload">
</td>
</tr>
</tbody>
</table>
</form>
</div>
However obviously you cannot put each $_POST from the form into each value is there another way to do this or can someone help me?
Kind Regards,
Lewis

Answer 1

use sprintf which can make it a bit more readable in the order of the parameters passed to the values:
$menu = sprintf("INSERT INTO content (id, path, name) VALUES ('%s', '%s', '%s')", mysql_real_escape_string($_POST['id']), mysql_real_escape_string($_POST['path']), mysql_real_escape_string($_POST['name']));

Answer 2

Considering this is your full code, one major problem is that you are inserting the form contents every time the page is loaded. If your form processing is in the same page, you may want to add a simple check. For example:
<?php
if (isset($_POST['submit'])) {
# form information received, process it
}
# else continue with your normal script and display the form
?>
In this case, in a first page load the $_POST data is not set so only the form will apear. When the form is submitted though, the script will detect there is data and process it.
And explained in the comments, PHP Data Objects (or PDO for short) is a much more modern, portable and safe way to deal with databases. There are plenty of explanations over the internet on how and why; and the manual page itself is pretty straight forward to read. You can prepare statements, and then the class itself will handle all the escaping needed to make your script secure. Quick example:
# make a connection
$db = new PDO(/* database info */);
# prepare your statement with the placeholders for your data
$st = $db->prepare("
INSERT INTO content (id, path, name)
VALUES (?,?,?)
");
# execute the query with the POST data
$success = $st->execute([
$_POST['id'],
$_POST['path'],
$_POST['name']
]);
if (!$success) {
# error ...
}