Converting deprecated PHP SQL commands to PDO - php

Question

Recently looking through some old files and realised that they are now deprecated. I've tried converting them into the newer PDO variant, but I'm stuck on something. Here's the code:
<?php
$team=$_POST['team'];
$user=$_POST['user'];
$dbHandle=new PDO("mysql:host=localhost;dbname=databasename;","user","password",array(PDO::ATTR_EMULATE_PREPARES=>false));
$query=$dbHandle->prepare("INSERT INTO tablename VALUES(?,?,?)");
if(!is_numeric($user)){
echo "Error message 1";
}elseif($user=="123"){
echo "Error message 2";
}else{
$query->execute(array($user,$team,"pending"));
if(mysql_affected_rows()>0){
echo "Success message";
}else{
echo "Error message 3";
}
}
?>
Nothing I've tried seems to get the success message. It looks like most of the code is working, because it always ends up giving me the third error message every time, and I can confirm that nothing has been added to the database. Not shown above are the three lines of code for enabling all PHP error messages, but the page isn't throwing up any such messages.
Also, while I'm at it, I'm still not entirely familiar with PDO, but from the way I understood it, it's much more secure. From what I have above, are there any security risks, and if so, how should I fix them?
EDIT: The code is currently as thus:
<?php
$team=$_POST['team'];
$user=$_POST['user'];
$dbHandle=new PDO("mysql:host=localhost;dbname=databasename;","user","password",array(PDO::ATTR_EMULATE_PREPARES=>false));
$query=$dbHandle->prepare("INSERT INTO tablename VALUES(?,?,?)");
if(!is_numeric($user)){
echo "Error message 1";
}elseif($user=="123"){
echo "Error message 2";
}else{
$query->execute(array($user,$team,"pending"));
if($query->rowCount()>0){
echo "Success message";
}else{
echo "Error message 3";
}
}
?>

Answer 1

<?php
ini_set('display_errors',1);
error_reporting(E_ALL);
$dsn = "mysql:host=localhost;dbname=test;charset=utf8";
$opt = array(
PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION,
PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC
);
$pdo = new PDO($dsn,"user","password", $opt);
$stm = $pdo->prepare("INSERT INTO tablename VALUES(?,?,?)");
$stm->execute(array($_POST['user'],$_POST['team'],"pending"));
echo "Success message";

Answer 2

The problem is that mysql_affected_rows() function is not PDO, you should use ->rowCount() method to know the value of affected rows. Also, I would preffer to add parameters in a separated instruction specifying the correct type with constants like PDO::PARAM_INT and PDO::PARAM_STR, so you can avoid errors:
$query=$dbHandle->prepare("INSERT INTO tablename VALUES(?,?,?)");
if(!is_numeric($user)){
echo "Error message 1";
}elseif($user=="123"){
echo "Error message 2";
}else{
$status = "pending";
$query->bindParam(1, $user, PDO::PARAM_INT);
$query->bindParam(2, $team, PDO::PARAM_STR);
$query->bindParam(3, $status, PDO::PARAM_STR);
$query->execute();
if($query->rowCount() > 0){
echo "Success message";
}else{
echo "Error message 3";
}
}