form for inserting using php and pdo - php

Question

I am losing my mind on this and I could really use some direction. Just trying to learn PDO along with PHP and failing to understand the logic. I keep trying to find something online that shows a good example of the flow for this test attempt and I'm having a real hard time.
Could someone, even if you have to flame the heck out of me (although like anyone, I'd prefer you not), give me some direction on what I'm doing horribly wrong? I'm building this to start my understanding. There's plenty of info on using mysqli but not pdo and it's driving me nuts.
Thanks in advance. Here's the code:
<?php
# connection info to the db
$host = "--shadowed--";
$dbname = "--shadowed--";
$user = "--shadowed--";
$pass = "--shadowed--";
# pdo options/attributes
$opt = array( PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION ); // not getting errors
# data source name
$dsn = "mysql:host=$host;dbname=$dbname";
# basic pdo connection (with added option for error handling)
if (isset($_POST['submit'])) {
try {
$DBH = new PDO($dsn, $user, $pass, $opt);
$STH = $DBH->prepare("INSERT INTO data (name,email,phone,detail,cost) VALUES (:name,:email,:phone,:detail,:cost)");
$STH->bindParam(':name', $name);
$STH->bindParam(':email', $email);
$STH->bindParam(':phone', $phone);
$STH->bindParam(':detail', $detail);
$STH->bindParam(':cost', $cost);
$name = $_POST['name'];
$email = $_POST['email'];
$phone = $_POST['phone'];
$detail = $_POST['detail'];
$cost = $_POST['cost'];
$STH->execute();
echo $STH; // attempted to echo back the data, but nothing happens
} catch (PDOException $e) {
echo $e->getMessage(); // no errors
}
}
echo '<form method="POST" action="">';
echo '<p>Enter the below information if you want to live:</p>';
echo 'Name: <input type="text" name="name"><br />';
echo 'E-mail: <input type="text" name="email"><br />';
echo 'Phone: <input type="text" name="phone"><br />';
echo 'Order will be generated randomly from class (once built)<br />';
echo 'Description: <input type="text" name="detail"><br />';
echo 'Cost: <input type="text" name="cost"><br />';
echo '<input type="submit" value="Do-It"></form>';
# close the connection
$DBH = null;
?>
------------- Final Code after Resolution Reached -------------
------------- Final Code after Resolution Reached -------------
(still a newb so can't answer my own question currently)
So first off, I didn't come up with this... it's a mix of everyone here really. I appreciate everyone's help and time with this while I try to learn all the missing links from my knowledge.
The main issues seems to be that when I used my original attempt to utilize if (isset($_POST['submit'])), it didn't actually do or send anything. No errors... no database issues... just a bunch of nothing. We removed that to find it was holding back ( ty #Fred ). Although this didn't change how the code works, it became more efficient using #hjpotter92 suggestion. Then we looked how to submit using this single page. I ended up using a mix of #Fred's and #david strachan suggestions as neither was giving me the right reaction, then I added an if/else statement to perform the check and if it passed, run the try/catch.
It's no work of art, but I learned quite a bit and appreciate the help. Also, I think it will be nice to get something out there people can bump into to see a full example. If any of you guys have any additional suggestions, please let me know. Along with learning the base knowledge, I'm also reviewing how to help against sql injection (which may not be fully covered in this test).
#------------------ Working Code ------------------#
# pdo options/attributes
$opt = array( PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION );
# data source name
$dsn = "mysql:host=$host;dbname=$dbname";
# basic pdo connection (with added option for error handling)
if ($_SERVER['REQUEST_METHOD'] == "POST") {
if (!$_POST['name'] || !$_POST['email'] || !$_POST['phone'] || !$_POST['detail'] || !$_POST['cost']) {
echo "<p>Please supply all of the data! You may press your back button to attempt again minion!</p>";
exit;
} else {
try {
$DBH = new PDO($dsn, $user, $pass, $opt);
$STH = $DBH->prepare("INSERT INTO data (name,email,phone,detail,cost) VALUES (:name,:email,:phone,:detail,:cost)");
$STH->bindParam(':name', $_POST['name']);
$STH->bindParam(':email', $_POST['email']);
$STH->bindParam(':phone', $_POST['phone']);
$STH->bindParam(':detail', $_POST['detail']);
$STH->bindParam(':cost', $_POST['cost']);
$STH->execute();
} catch (PDOException $e) {
echo $e->getMessage();
}
echo "<p>Data submitted successfully</p>";
}
}
echo '<form method="POST" action="">';
echo '<p>Enter the below information if you want to live:</p>';
echo 'Name: <input type="text" name="name"><br />';
echo 'E-mail: <input type="text" name="email"><br />';
echo 'Phone: <input type="text" name="phone"><br />';
echo 'Order will be generated randomly<br />';
echo 'Description: <input type="text" name="detail"><br />';
echo 'Cost: <input type="text" name="cost"><br />';
echo '<input type="submit" value="Do-It"></form>';
# close the connection
$DBH = null;
?>

Answer 1

To check if the request is POST type use $_SERVER['REQUEST_METHOD'] Documentation
// Get POST variables
$name = isset($_POST['name']) ? $_POST['name'] : '';
$name = isset($_POST['email']) ? $_POST['email'] : '';
$name = isset($_POST['phone']) ? $_POST['phone'] : '';
$name = isset($_POST['detail']) ? $_POST['detail'] : '';
$name = isset($_POST['cost']) ? $_POST['cost'] : '';
If($_SERVER['REQUEST_METHOD'] == "POST") {
Try{
Remainder of code

Answer 2

Switch the ordering from the following
$STH->bindParam(':name', $name);
$STH->bindParam(':email', $email);
$STH->bindParam(':phone', $phone);
$STH->bindParam(':detail', $detail);
$STH->bindParam(':cost', $cost);
$name = $_POST['name'];
$email = $_POST['email'];
$phone = $_POST['phone'];
$detail = $_POST['detail'];
$cost = $_POST['cost'];
to
$name = $_POST['name'];
$email = $_POST['email'];
$phone = $_POST['phone'];
$detail = $_POST['detail'];
$cost = $_POST['cost'];
$STH->bindParam(':name', $name);
$STH->bindParam(':email', $email);
$STH->bindParam(':phone', $phone);
$STH->bindParam(':detail', $detail);
$STH->bindParam(':cost', $cost);
or simply use:
$STH->bindParam(':name', $_POST['name']);
$STH->bindParam(':email', $_POST['email']);
$STH->bindParam(':phone', $_POST['phone']);
$STH->bindParam(':detail', $_POST['detail']);
$STH->bindParam(':cost', $_POST['cost']);

Answer 3

This is not an answer but a form validation function that could be of help.
I'm sure there are multiple ways of achieving this, but it will surely get you started.
$name = $_POST['name'];
$email = $_POST['email'];
$phone = $_POST['phone'];
$detail = $_POST['detail'];
$cost = $_POST['cost'];
if (isset($_POST['submit'])) {
if (empty($name) || empty($email) || empty($phone))) || empty($detail))) || empty($cost)) {
// do something
exit;
}
if (!empty($name) || !empty($email) || !empty($phone))) || !empty($detail))) || !empty($cost)) {
// do something else
// for example, write the data in database
exit;
}
}

Answer 4

Why would you let the user send a blank form? Handle the "please supply all of the data" warning on the client side with javascript. Don't allow the form to get past javascript without fulfilling all of the requirements.