Alright, I have website which is hosted in a Apache FTP server. This website have a form, and when submitted I want the data from the form to be transferred to a MySQL Database.
Example of HTML form:
<form action="process.php" method="post">
<input type="text" name="username" placeholder="Username">
<input type="email" name="email" placeholder="Email">
<input type="submit" value="Submit">
</form>
Example of php script:
<?php
$servername = "localhost";
$username = "db_user";
$password = "db_password";
$dbname = "your_database";
// Create a connection
$conn = new mysqli($servername, $username, $password, $dbname);
// Check connection
if ($conn->connect_error) {
die("Connection failed: " . $conn->connect_error);
}
// Retrieve form data
$username = $_POST['username'];
$email = $_POST['email'];
// Insert data into the database
$sql = "INSERT INTO users (username, email) VALUES ('$username', '$email')";
if ($conn->query($sql) === TRUE) {
echo "New record created successfully";
} else {
echo "Error: " . $sql . "<br>" . $conn->error;
}
// Close the connection
$conn->close();
?>
My problem is, what's happening in the action prop exactly? Is the client directly accessing the php script and executing it? or, The action prop just says to the server to execute this specific script and there's no risk it can be accessed by the client?
How am I sure this php file can't be accessed by the client?
My only problem is with the database credentials and the sql command.
Is there a 100% safe way to do this, or is this code already "safe" enough?
Additional info:
- My website is in the folder public_html
