Applying prepare statements

Question

I don't feel that my code is secure, and would like some help in using prepare statements for the following;

$track = "INSERT INTO resources_record (name,email,stage,format,topic,max_cost,mentor,total_cost,duration)
 VALUES ('".$fullName."', '".$email."', '".$stage."', '".$format."', '".$topic."', '".$cost."', '".$mentor."', '".$price."', '".$duration."')";
// Execute track query
 mysqli_query($con, $track);

Answer 1

You are right, your code is indeed very insecure. I'm not sure which part of using prepared statements you are having trouble with, and rewriting your code for you seems off-topic, but the guide for PDO prepared statements is very clear. It's first example is even an INSERT. The guide for Mysqli prepared statements also contains an example for an INSERT. Just choose either Mysqli or PDO and follow the example.

Your code is quite short, so I only have a couple of points about it:

• your comment is not needed, as it doesn't add any information.
• your code could use more spaces to increase readability. Eg after , and between ..
• I would use the same names for the variables as the db columns have to avoid confusion. Your db column names also seem to be more accurate. I can easily understand the meaning of max_cost and total_cost, but it's not that clear what cost and price stand for.