Adding validation into PDO [closed] - php

Question

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center.
Closed 9 years ago.
Got this working how I want, but what updates can i do to it to make it better?
code: ----------------------------------------
$odb = new PDO('mysql:host=localhost;dbname=db371885849', $user, $pass);
$odb->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
if(isset($_POST['firstname'])) {
$firstname = $_POST['firstname'];
$lastname = $_POST['lastname'];
$email = $_POST['email'];
$q = "INSERT INTO jobform(firstname, lastname, email) VALUES (:firstname, :lastname, :email);";
$query = $odb->prepare($q);
$results = $query->execute(array(
":firstname" => $firstname,
":lastname" => $lastname,
":email" => $email
));
}
++++++++++++++++++++++++Updated Working ++++++++++++++++++++++++++
$odb = new PDO('mysql:host=localhost;dbname=db371885849', $user, $pass);
$odb->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
if(isset($_POST['firstname'])) {
$firstname = $_POST['firstname'];
$lastname = $_POST['lastname'];
$email = $_POST['email'];
if (!empty($firstname))
{
$q = "INSERT INTO jobform(firstname, lastname, email) VALUES (:firstname, :lastname, :email);";
$query = $odb->prepare($q);
$results = $query->execute(array(
":firstname" => $firstname,
":lastname" => $lastname,
":email" => $email
));
} else {
echo "not today";
}
}

Answer 1

if(!empty($_POST['firstname']) && !empty($_POST['lastname']) && filter_var($_POST['email'],FILTER_VALIDATE_EMAIL)) {
$firstname = $_POST['firstname'];
$lastname = $_POST['lastname'];
$email = $_POST['email'];
$q = "INSERT INTO jobform(firstname, lastname, email) VALUES (:firstname, :lastname, :email);";
$query = $odb->prepare($q);
$results = $query->execute(array(
":firstname" => $firstname,
":lastname" => $lastname,
":email" => $email
));
}else echo 'make an error';

Answer 2

It seems you don't need no validation at all.
So, how I'd did it, based on the code from the tag wiki
<?php
if ($_SERVER["REQUEST_METHOD"] == "POST") {
$allowed = array('firstname', 'lastname', 'email');
$sql = "INSERT INTO jobform SET ".pdoSet($fields,$values);
$stm = $dbh->prepare($sql);
$stm->execute($values);
header("Location: ".$_SERVER['PHP_SELF']);
exit;
}
However, if you want to validate user input, you'd meed more complex code:
<?
$allowed = array('firstname', 'lastname', 'email');
if ($_SERVER['REQUEST_METHOD']=='POST') {
$err = array();
//performing all validations and raising corresponding errors
if (empty($_POST['firstname']) $err[] = "Firstname is required";
if (empty($_POST['lastname']) $err[] = "Lastname is required";
if (!filter_var($_POST['email'],FILTER_VALIDATE_EMAIL) {
$err[] = "Wrong email format";
}
if (!$err) {
$sql = "INSERT INTO jobform SET ".pdoSet($fields,$values);
$stm = $dbh->prepare($sql);
$stm->execute($values);
header("Location: ".$_SERVER['PHP_SELF']);
exit;
} else {
// all field values should be escaped according to HTML standard
foreach ($_POST as $key => $val) {
$form[$key] = htmlspecialchars($val);
}
} else {
foreach ($allowed as => $val) {
$form[$val] = '';
}
}
include 'form.tpl.php';

Answer 3

PDO is used to communicate with the database, not to validate values (apart from quoting them for safe inserts). You will have to perform validation before you get to launching your SQL queries with PDO:
<?php
if ($_SERVER["REQUEST_METHOD"] == "POST") {
if (
// your empty() checks
) {
// your query
}
}