INSERT INTO not inserting using bindparam

Question

Trying to insert a single row into my table. Having a mare, tried to use tens of examples on the tinterweb to no success, I must just not understand how PDO works yet.

$stmt = $dbh->prepare ("INSERT INTO table_name (date, link, desc) 
VALUES (:date,:name,:desc)");
$stmt -> bindParam(':date', $date);
$stmt -> bindParam(':name', $name);
$stmt -> bindParam(':desc', $desc);
$stmt -> execute();

move_uploaded_file($_FILES["file"]["tmp_name"], $upload);

Then your code is vulnerable to SQL injection

Your Common Sense
– Your Common Sense

2013-04-08 08:30:16 +00:00
Commented Apr 8, 2013 at 8:30 — Your Common Sense
– Your Common Sense, Commented Apr 8, 2013 at 8:30
via the <select> tag

Brobina
– Brobina

2013-04-08 08:32:34 +00:00
Commented Apr 8, 2013 at 8:32 — Brobina
– Brobina, Commented Apr 8, 2013 at 8:32

Community · Accepted Answer · 2017-05-23 12:14:40Z

1

You shouldn't allow any direct input to your query from user.
There shouldn't be user-defined table names as well. Your database structure is wrong. It ought to be a single predefined table to store data for all users. So, it must be a field content, not table name
You need to connect to PDO first, and make it properly. See example in PDO tag wiki
So, you'll be able to see errors.
From the error you have to know that desc is a reserved word and have to be formatted.

So, the code have to be

$stm = $dbh->prepare("INSERT INTO table (date,link,`desc`,type) VALUES (?,?,?,?)");
$stm->execute(array($date,$name,$desc,$type));

move_uploaded_file($_FILES["file"]["tmp_name"], $upload);

edited May 23, 2017 at 12:14

CommunityBot

11 silver badge

answered Apr 8, 2013 at 8:33

Your Common Sense

158k42 gold badges226 silver badges373 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

INSERT INTO not inserting using bindparam

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related