用php插入mysql数据库

Question

I imagine this is a simple issue, I simply cannot find out where or why. (hope this isn't a duplicate)..

My intent is to grab the info from an input and from a textarea and insert it into my database into the proper table that already exists "journals". However after hitting submit and without receiving any errors there is nothing added to the database... thoughts?

here is my "view" (post.php):

<fieldset>
    <form method="post" action="push.php">
        <input type="text" name="datetitle" /><br />
        <textarea name="journalcontent"></textarea><br />
        <input type="submit" />
    </form>
    <?php echo $datetitle ?>
    <p><?php $output ?></p>
</fieldset>

here is my "index" (push.php) with obvious parts omitted:

<?php

$dsn = '*';
$username = '*';
$password = '*';

include "model.php";

try {
    $db = new PDO($dsn, $username, $password);
} catch (PDOException $exc) {

    echo 'connection failed';
    exit;
}

echo 'goodzo';

$datetitle = $_POST['datetitle'];
$journalcontent = $_POST['journalcontent'];

if (!empty($datetitle)) {
    $output = add_entry($datetitle, $journalcontent);
} else {
    $output = "empty";
}

include "post.php";

?>

and lastly my model.php:

<?php
function add_entry($datetitle, $journalcontent) {
    global $db;
    $query = 'INSERT INTO journals
                (entry_date, contents)
              VALUES
                 ($datetitle, $journalcontent)';
    try {
        $statement = $db->prepare($query);
        $statement->execute();
        $statement->closeCursor();
    } catch (PDOException $e) {
        $error_message = $e->getMessage();
        display_db_error($error_message);
    }
}
?>

Answer 1

When you use a single quote, it doesn't expand the variables in the string. Also, your parameters need to be in quotes if they're not integers. So the query assignment should look like this:

$query = "INSERT INTO journals
            (entry_date, contents)
          VALUES
             ('$datetitle', '$journalcontent')";

That said, you should really be using bind parameters to pass the values to the query. Something like this:

$query = 'INSERT INTO journals
            (entry_date, contents)
          VALUES
             (?, ?)';

$statement = $db->prepare($query);
$statement->bindParam(0, $datetitle, PDO::PARAM_STR);
$statement->bindParam(1, $journalcontent, PDO::PARAM_STR);
$statement->execute();

Answer 2

You should turn PDO's error reporting on first of all; I would use

$db->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);

Unless $datetitle and $journalcontent are both integers, the query will fail due to an SQL syntax error and a lack of string quoting. You should parameterize the query to avoid this problem as well as possible injection.

$query = <<<SQL
    INSERT INTO journals
        (entry_date, contents)
    VALUES
        (?, ?)
SQL;
$statement = $db->prepare($query);
$statement->execute(array($datetitle, $journalcontent));