- First turn on errors
ini_set('display_errors', '1');
ini_set('display_startup_errors', '1');
error_reporting(E_ALL);
- Use Prepared Statement with either PDO (My Recommendation) or mysqli
- Not really a rule, but a suggestion or Free Help. Have the form bring in data in an array format.
A detailed example:
<form id="formData" class="checkStyle" action="create_procedural.php" method="post" enctype="multipart/form-data">
<input type="hidden" name="cms[user_id]" value="3">
<input type="hidden" name="cms[author]" value="<?= Login::full_name() ?>">
<input type="hidden" name="action" value="upload">
<div class="file-style">
<input id="file" class="file-input-style" type="file" name="image">
<label for="file">Select file</label>
</div>
<select class="select-css" name="cms[page]">
<option value="index">Home</option>
<option value="blog" selected>Blog</option>
<option value="about">About</option>
</select>
<div class="heading-style">
<label class="heading_label_style" for="heading">Heading</label>
<input class="enter_input_style" id="heading" type="text" name="cms[heading]" value="" tabindex="1" required
autofocus>
</div>
<div class="content-style">
<label class="text_label_style" for="content">Content</label>
<textarea class="text_input_style" id="content" name="cms[content]" tabindex="2"></textarea>
</div>
<div class="submit-button">
<button class="form-button" type="submit" name="submit" value="enter">submit</button>
</div>
</form>
That way all you have to do is something like the followoing:
if (($_SERVER['REQUEST_METHOD'] === 'POST') && isset($_POST['submit'], $_FILES['image'])) {
$data = $_POST['cms'];
then continuing this example inserting the data is easy →
function insertData(array $data, $pdo, $table) {
try {
/* Initialize an array */
$attribute_pairs = [];
/*
* Set up the query using prepared states with the values of the array matching
* the corresponding keys in the array
* and the array keys being the prepared named placeholders.
*/
$sql = 'INSERT INTO ' . $table . ' (' . implode(", ", array_keys($data)) . ')';
$sql .= ' VALUES ( :' . implode(', :', array_keys($data)) . ')';
/*
* Prepare the Database Table:
*/
$stmt = $pdo->prepare($sql);
/*
* Grab the corresponding values in order to
* insert them into the table when the script
* is executed.
*/
foreach ($data as $key => $value)
{
if($key === 'id') { continue; } // Don't include the id:
$attribute_pairs[] = $value; // Assign it to an array:
}
return $stmt->execute($attribute_pairs); // Execute and send boolean true:
} catch (PDOException $e) {
/*
* echo "unique index" . $e->errorInfo[1] . "<br>";
*
* An error has occurred if the error number is for something that
* this code is designed to handle, i.e. a duplicate index, handle it
* by telling the user what was wrong with the data they submitted
* failure due to a specific error number that can be recovered
* from by the visitor submitting a different value
*
* return false;
*
* else the error is for something else, either due to a
* programming mistake or not validating input data properly,
* that the visitor cannot do anything about or needs to know about
*
* throw $e;
*
* re-throw the exception and let the next higher exception
* handler, php in this case, catch and handle it
*/
if ($e->errorInfo[1] === 1062) {
return false;
}
throw $e;
} catch (Exception $e) {
echo 'Caught exception: ', $e->getMessage(), "\n"; // Not for a production server:
}
return true;
}
to call it the function in this function →
$result = insertData($data, $pdo, 'cms');
if ($result) {
header("Location: index.php");
exit();
}
The above is just an example and here are some useful links:
https://phpdelusions.net/pdo - PDO Explaned
and my GitHub repository where you can see more code that might help you.
