INSERT INTO不使用bindparam插入

Question

Trying to insert a single row into my table. Having a mare, tried to use tens of examples on the tinterweb to no success, I must just not understand how PDO works yet.

$stmt = $dbh->prepare ("INSERT INTO table_name (date, link, desc) 
VALUES (:date,:name,:desc)");
$stmt -> bindParam(':date', $date);
$stmt -> bindParam(':name', $name);
$stmt -> bindParam(':desc', $desc);
$stmt -> execute();

move_uploaded_file($_FILES["file"]["tmp_name"], $upload);    

Answer 1

1. You shouldn't allow any direct input to your query from user.
2. There shouldn't be user-defined table names as well. Your database structure is wrong. It ought to be a single predefined table to store data for all users. So, it must be a field content, not table name
3. You need to connect to PDO first, and make it properly. See example in PDO tag wiki
4. So, you'll be able to see errors.
5. From the error you have to know that desc is a reserved word and have to be formatted.

So, the code have to be

$stm = $dbh->prepare("INSERT INTO table (date,link,`desc`,type) VALUES (?,?,?,?)");
$stm->execute(array($date,$name,$desc,$type));

move_uploaded_file($_FILES["file"]["tmp_name"], $upload);