PDO insert validation - php

Question

I've got the code to insert correctly, but am failing to get it to give me a success message. It always returns failed to add the device to the database, but then I go check the database and it is in fact successfull. Any ideas?
<?php
// Start or resume the session
session_start();
//Check to ensure the user is authorized to view this page
if (isset($_SESSION['loggedin']) && $_SESSION['loggedin'] == true) {
// Include Header
include("includes/header.php");
echo "
<div class='form_description'>
<h2>French Lick Resort</h2>
<p>STATUS - Add Ingenico Device to Inventory</p>
</div>
<form id='update' class='fieldset' method='post' action=''>";
$serial=$_POST['serial'];
$model=$_POST['model'];
$deviceCondition=$_POST['deviceCondition'];
$sealCondition=$_POST['sealCondition'];
$location=$_POST['location'];
$deployDate=$_POST['deployDate'];
$weight=$_POST['weight'];
$notes=$_POST['notes'];
//NEW PDO connection
try{
$conn = new PDO("mysql:host=$sql_server;dbname=$sql_db", $sql_user, $sql_pass);
$sql = "INSERT INTO web01dev4s2.ingenicoInfo (serial, model, deviceCondition, sealCondition, location, deployDate, weight, notes) VALUES ('".$serial."', '".$model."', '".$deviceCondition."', '".$sealCondition."', '".$location."', '".$deployDate."', '".$weight."', '".$notes."')";
$q = $conn->prepare($sql);
$result_1=mysql_query($sql);
$q->execute();
}
catch (PDOEException $pe) {
die("Could not connect to the database" . $pe->getMessage());
}
//End pdo connection
// Display "GO" or "NO GO"
if($result_1){
echo "Device successfully added to the database.";
header( "refresh:2;url=devicelist.php" );
}
else {
echo "Failed to add the device to the database. Please ensure that the device is not already in the database and that all fields are filled out. Notes should be NA if there are no notes to add. Also, ensure the name does not containt any special characters such as quotes.<br />";
Echo "<a href=create.php>Back</a>" ;
}
}
else {
header('Location:login.php');
}
echo "
</form>
</div>
</body>
</html>";
?>

Answer 1

You are mixing your use of PDO and the mysql extension. Don't do that.
If you are going to use PDO, use the prepare statements correctly, as well. You should not put your variables into the raw SQL string, instead use '?' where you expect a value to be inserted. Then pass an array of variables into the statement's execute. This is the PDO way, and it will help prevent SQL injections against your code.
$sql = "INSERT INTO web01dev4s2.ingenicoInfo (serial, model, deviceCondition, sealCondition, location, deployDate, weight, notes) VALUES (?, ?, ?, ?, ?, ?, ?, ?)";
$q = $conn->prepare($sql);
// This line should fix your problem
$result_1 = $q->execute(array($serial, $model, $deviceCondition, $sealCondition, $location, $deployDate, $weight, $notes));