POST方法不将数据插入数据库表

Question

I'm trying to play around with databases and inserting data dynamically with php. At the moment I have a form with 'post' method and everything seems logical to me but it isn't inserting the data into the table.

Code is attached below, would appreciate if someone could point me into the right direction.

index.php:

<form action="index.php" method="post">

<label for="name">Name</label>
<input type="text" name="name" required>

<label for="breed">Breed</label>
<input type="text" name="breed">

<label for="age">Age</label>
<input type="text" name="age">

<input type="submit" name="submit" value="Submit">

</form>

<?php

require "connect.php";

if('submit') {
    $name = $_POST['name'];
    $breed = $_POST['breed'];
    $age = $_POST['age'];

    $newdog = mysqli_query('INSERT INTO `dogs`(`name`, `breed`, `age`) VALUES ([$name],[$breed],[$age)');

    if ($newdog) {
        echo "$name has been added to the database";
    } else {
        echo "$name has not been added to database.";
    };
};

?>

connect.php:

<?php

$connect = mysqli_connect('localhost', 'max', 'password', 'db_test');

?>

Answer 1

Change if('submit') {

TO

if(isset($_POST['submit'])){//check if it is set

}

Also change this line:

$newdog = mysqli_query('INSERT INTOdogs(name,breed,age) VALUES ([$name],[$breed],[$age)');

TO

$newdog = mysqli_query($connect, 'INSERT INTOdogs(name,breed,age) VALUES ($name,$breed,$age)');//remove square bracktes and add connection variable

Your code is very well vulnerable to SQL injection

Using prepared statements,

$stmt = $connect->prepare("INSERT INTO dogs (`name`, `breed`, `age`) VALUES (?, ?, ?)");
$stmt->bind_param("sss", $name, $breed, $age);
if($stmt->execute() == true){
   echo 'Saved';
} else {
   echo 'Error '. $stmt->error;
 }