Question

I have decided for security to convert my simple php with mysql code to PDO,since it will tighten my security.My old code:

$host = "localhost"; 
$user = "username"; 
$pass = "pass"; 
$database = "mydatabase"; 

$linkID = mysql_connect($host, $user, $pass) or die("Could not connect to host."); 
mysql_select_db($database, $linkID) or die("Could not find database."); 
$name=$_POST['name'];
$message=$_POST['message'];
$ip = $_SERVER['REMOTE_ADDR'];
$query="INSERT INTO table (date_time, name, message,ip) VALUES     (NOW(),'$name','$message','$ip')";
If (mysql_query($query,$linkID)){
    //Success
    }else{
    //Failure
    }

My new code is:

$hostname = 'localhost';
$username = 'username';
$password = 'pass';
$dbname = 'mydatabase';

$dbh = new PDO("mysql:host=$hostname;dbname=$dbname", $username, $password);
if($_POST['name'] && $_POST['message']) {
    $name = $_POST['name'];
    $message = $_POST['message'];
    $ip = $_SERVER['REMOTE_ADDR']; 
    $sql = "INSERT INTO table (date_time, name, message,ip)VALUES (NOW(), :name, :message,'$ip')";
    $stmt = $dbh->prepare($sql);
    $stmt->bindParam(':name', $name, PDO::PARAM_STR);
    $stmt->bindParam(':message', $message, PDO::PARAM_STR);
    if ($stmt->execute()) {
      echo "OK";
    }
}

It’s very strange that when i point my browser to index.php?name=someName&message=someMessage my PDO code won’t echo a single thing(even echo "ok" ) or an error so i can fugure out where is the problem.

I can confirm that no data is inserted to the database.

I’ve even added try catch but nothing changed. My php is supporting PDO and the simple Mysql code is working.
Any ideas? Thanks

Answer 1

In your case,

if($_POST['name'] && $_POST['message']) {

Should be:

if($_GET['name'] && $_GET['message']) {