PHP form update best practices - php

Question

I'm sure i've badly written this. I have a simple form which you enters bits into, which sends the info onto a process page and inserts a row into a table on the database. My problem is that the insert part works fine. But my template class within the page or anything else is shown. Just a blank page. Its driving me nuts.
The function
Public function UpdateReason($reason, $bundlereference) {
error_reporting(E_ALL ^ E_NOTICE);
$db_selected = mysql_select_db(DB_DATABASE_NAME, $this->conn);
if (!$db_selected) {
die("Can't use db : " . mysql_error());
}
$_reason = mysql_real_escape_string($reason,$this->conn);
$_bundlereference = mysql_real_escape_string($bundlereference,$this->conn);
$sql = "UPDATE `ArchiveBundle`
SET `Issue` = '" . $_reason . "'
WHERE `BundleReference` = '" . $_bundlereference . "'";
mysql_query($sql, $this->conn);
die(mysql_error());
exit;
}
The form
<table>
<form method='post' action='addissue.php'>
<p>Reason: <input type='text' name='reason' /></p><br/>
<p><input type='hidden' name='bundlereference' id='Username'
value='" . $x['Reference'] . "' /></p>
<input type='submit' name ='add'/>
</form>
</table>
The process page
<?php
// First of all initialise the user and check for permissions
require_once "/var/www/users/user.php";
$user = new CHUser(2);
// Initialise the template
require_once "/var/www/template/template.php";
$template = new CHTemplate();
// And create a cid object
require_once "/var/www/Testing/DisplayWIPOnLocation.php";
$BundleProgress= new CHWIPProgress();
$reason = $_POST['reason'];
$reference = $_POST['bundlereference'];
$issue = $BundleProgress->UpdateReason($_POST['reason'],$_POST['bundlereference']);
Print "Your information has been successfully added to the database.";
$template->SetTag("content", $content);
echo $template->Display();
?>
I also want to know/learn what the best practices are for forms in php

Answer 1

The reason you aren't getting output is the following two lines. This is killing your script in place. Just remove these.
die(mysql_error());
exit;
Overall, it's not terrible. You're using objects, and you're sanitizing your user input before inserting into the db. I do have a couple suggestions.
Don't use die() in a production script. Handle errors and exceptions properly.
Look into prepared statements (PDO) or stored procedures for mysql.
Instead of the print "Your information has been added..." line, can you create a field in your template and pass in that value through your template class?
You set $reason and $reference then pass in the value from $_POST, making those unused variables. Maybe this is just due to testing code though?
Depending on your needs, you may want to consider checking that the data the form has received is valid before running an update query. What if $reason or $bundlereference aren't valid values?