Question

The code is simple- take a value from a form, insert it into the mysql DB. Here’s a snippet:

//connect to DB
$dbh = new PDO($db_pdo, $db_user_name, $db_password);

//capture value from form
$first_name = $_POST['first_name'];

//insert value into DB (doesn't work- no new entry created in requests)
$dbh->exec("INSERT INTO requests(first_name) VALUES($first_name)");

//this echo statement works (outputs the value of $first_name):
echo "\$first_name ".$first_name;

//this insert statement works: 
$dbh->exec("INSERT INTO requests(first_name) VALUES('oleg')");

Answer 1

That’s right, you have to quote your string.

$dbh->exec("INSERT INTO requests(first_name) VALUES('$first_name')");

But this code is vulnerable to SQL Injection. I’m not sure how do you protect against that in PHP.