Learning PDO simple form input not submitting to database - php

Question

I've started learning PDO yesterday and I thought I had it down but I've run into an error again while trying to submit a simple form. I'm using the example on w3schools but with a form input.
index.php
<form action="submit.php" method="post">
<input type="text" id="name" placeholder"Enter Your Name">
<button type="submit">Submit</button>
</form>
Here is my page that processes the form:
submit.php
<?php
$servername = "localhost";
$username = "testuser";
$password = "testpassword";
$dbname = "testdb";
$nickname = $_POST['name'];
try {
$conn = new PDO("mysql:host=$servername;dbname=$dbname", $username, $password);
//Set PDO Error Mode to Exception
$conn->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
$sql = "INSERT INTO test (name)
VALUES (:nickname)";
// use exec() because no results are returned
$conn->exec($sql);
echo "New record created successfully";
}
catch(PDOException $e)
{
echo $sql . "<br>" . $e->getMessage();
}
$conn = null;
?>
The Error I'm getting is:
INSERT INTO test (name) VALUES (:nickname)
SQLSTATE[42000]: Syntax error or access violation: 1064 You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ':nickname)' at line 2

Answer 1

You have to use prepared statments, try something like this:
// query
$sql = "INSERT INTO test (name)
VALUES (:nickname)";
$q = $conn->prepare($sql);
$q->execute(array(':nickname'=>$nickname));

Answer 2

First, you need to create a prepared statement, then bind to it a value, that you want to insert. You can more read about PDO from official php.net (http://php.net/manual/en/pdo.prepared-statements.php)
<?php
$servername = "localhost";
$username = "testuser";
$password = "testpassword";
$dbname = "testdb";
$nickname = $_POST['name'];
try {
$conn = new PDO("mysql:host=$servername;dbname=$dbname", $username, $password);
//Set PDO Error Mode to Exception
$conn->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
$sql = "INSERT INTO test (name)
VALUES (:nickname)";
$stm = $conn->prepare($sql);
$stm->bindParam(':nickname', $nickname);
// use exec() because no results are returned
$stm->execute();
echo "New record created successfully";
}
catch(PDOException $e)
{
echo $sql . "<br>" . $e->getMessage();
}
$conn = null;
?>

Answer 3

Your form input needs a name attribute, as this is how it is referenced.
<input type="text" id="name" placeholder="Enter Your Name">
You cannot rely on an "id" alone.
<input type="text" name="name" id="name" placeholder="Enter Your Name">
^^^^^^^^^^^
Having used error reporting, would have signalled an "Undefined index name..." notice.
The name attribute is the value that is in the PHP $_POST array so the above example will give:
$_POST['name'] = <the value you entered into the name input box>
To further clarify, the id value of the <input> element does not appear in the PHP $_POST data. The POST data requires a name attribute to submit data from the form.

Answer 4

you're almost there, you have missed a couple of steps. By using the :name marker in the sql string you are identifying that you will bind variables to this marker. this means that you need to have PDO prepare the sql query statement first, then bind your variable to it, then send it to the server.
like the following example:
...
$name = $_POST['name']
$sql = "INSERT INTO nameTable (name) VALUES(:name)";
//this is what you missed
$stmt= $con->prepare($sql);
$stmt->bindParam(':name', $name, PDO::PARAM_STR);
//the following is the way of executing a prepared statement, you keep using the $stmt variable, rather than the $con one.
$stmt->execute();
That should get it working.

Answer 5

What about
$q = $conn->prepare("INSERT INTO test (name) VALUES (:nickname)");
// Variant #1
$q->bindParam(':nickname', $nickname, PDO::PARAM_STR);
$q->execute();
// Variant #2
$q->bindValue(':nickname', $nickname, PDO::PARAM_STR);
$q->execute();
// Variant #3
$q->execute([':nickname' => $nickname]);
Also note:
bindParam() unlike bindValue(), bounds the variable as a reference and it will only be evaluated at the time execute() is called.

Answer 6

you are missing two steps:
try {
$conn = new PDO("mysql:host=$servername;dbname=$dbname", $username, $password);
//Set PDO Error Mode to Exception
$conn->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
$sql = "INSERT INTO test (name)
VALUES (:nickname)";
$conn->prepare($sql, array(PDO::ATTR_CURSOR => PDO::CURSOR_FWDONLY));
// use exec() because no results are returned
$conn->exec($sql,array(':nickname' => $username));
echo "New record created successfully";
}