PHP & MYSQL Blog system

Question

Hello guys i have problem with php code for blog... well i created mysql database and it's looks like this,

And everything works fine when i press submit button except that it doesn't want to insert into blog database the things i write into inputs....

Here is php code:

<?php
include 'dbconfig.php';

if(isset($_POST['submit'])){
$_title = $_POST['title'];
$_category = $_POST['category'];
$_content = $_POST['content'];

$sql = "INSERT INTO `blog`('title', 'category', 'content') VALUES ('$_title', '$_category', '$_content'))";
}else{
?>

<form action="post.php" method="post">
<p>Title: <input name="title" type="text" size="50"/></p>
<p>Category: <input name="category" type="text" size="50"/></p>
<p>Content: <textarea name="content" maxlength="50" placeholder="Content" type="text"></textarea></p>
<input type="submit" name="submit" value="Post"/>


</form>
<?php
}
?>

dbconfig.php looks like

<?php


    $db_host = "localhost";
    $db_name = "a3584167_test";
    $db_user = "a3584167_test";
    $db_pass = "test";

    try{

        $db_con = new PDO("mysql:host={$db_host};dbname={$db_name}",$db_user,$db_pass);
        $db_con->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
    }
    catch(PDOException $e){
        echo $e->getMessage();
    }


?>

If you guys can share me your help option what should i fix in this code i would be very happy. Thanks for ur time.

Answer 1

You don't actually execute the query, so the solution is simple - just execute it.

From the comments, you're using PDO, so you'll just need

$db_con->query($sql);

That being said, that is very vulnerable to SQL injection, so I recommend you use a prepared statement instead, making your execution like this

$stmt = $db_con->prepare("INSERT INTO `blog`(`title`, `category`, `content`) VALUES (:title, :category, :content)");
$stmt->execute(array("title" => $_title, "category" => $_category, "content" => $_content));

References

• http://php.net/manual/en/pdo.prepare.php
• http://php.net/manual/en/pdo.query.php
• How can I prevent SQL injection in PHP?