What does using var_dump() or print_r() on both $_POST and $Values show? The code is just looping over the keys and values in the $_POST data (which in itself is a bad idea since hackers can submit anything they want.) If you end up with 45 entries in the $Values array, that means there are 45 keys/values in $_POST that were not filtered out.
I recommend two fundamental changes -
- Use the much simpler and better designed PDO extension. The mysqli extension is overly complicated and full of special case uses that are not general purpose. For example, the array of values you supply to the ->execute() call are all treated as strings, and don’t work with values that must be numeric, such as in a LIMIT … clause, don’t work with boolen values, and don’t work with null values.
- Take a proactive approach, where you define an array of the expected fields and their characteristics for any operation, rather than a reactive approach of trying to remove or filter out the things that you don’t want, which will miss things that hackers add to the submitted data, and depending on your code building the query will allow sql injection via any hacker supplied field name you use in the query.
Also -
- The $_POST array is always set, even if it is empty. You should instead detect if
$_SERVER['REQUEST_METHOD'] === 'POST'and then test if the $_POST array is not empty. If the post data size exceeds the post_max_size setting, both the $_POST and $_FILES arrays will be empty. Your code must handle this case. - md5() was never intended for password hashing. Use php’s password_hash() and password_verify() instead.
- Applying array_unque() to the array of values doesn’t make sense. What if some field = ‘abc’ and some other field = ‘abc’. This will completely remove a field and its value.
- Likewise, using array_filter() will prevent you from inserting/updating a field with a numerical zero or an empty string.