PDO multi insert statement

Question

I've got a working insert for a single input field but when I try to add a couple more it seems to break everything. I have a database connection working fine and including that correctly at the top of the page when I change the "isset" to have the 3 columns it breaks.

This is my set statement;

if(isset($_POST['title, question, tags']))
{
$success = insertData('questions', 'title', $_POST['title']);
$success = insertData('questions', 'question', $_POST['question']);
$success = insertData('questions', 'tags', $_POST['tags']);
if(!$success)
    echo 'Sorry failed :(';
}

The function I call from a functions php file;

function insertData($tablename, $columnName, $value)
{
$sql = 'INSERT into '.$tablename.'('.$columnName.') VALUES(:Value)';
$mysqlConnection = getConnection();
$statement = $mysqlConnection->prepare($sql);
$statement->bindValue(":Value", $value, PDO::PARAM_STR);

$bReturn = false;

try
{
    $statement->execute();
    $bReturn = true;
}
catch(PDOExecption $e)
{
    echo $e->getMessage();
}
return $bReturn;
}

Does anyone know where I'm going wrong here?

Answer 1

if(isset($_POST['title, question, tags']))

Is not correct syntax

instead You can do:

if(isset($_POST['title']) && isset($_POST['question']) && isset($_POST['tags']))

or even

if(isset($_POST['title'], $_POST['question'], $_POST['tags']))

---

It would be easier to do execute it without binding:

insertData

function insertData($tablename, $params){
//build query string
$column_string = implode(',', array_keys($params));
$value_string = implode(',', array_fill(0, count($params), '?'));
$sql_string = "INSERT INTO {$tablename} ({$columnString}) VALUES ({$value_string})";
//prepare query
$mysqlConnection = getConnection();
$statement = $mysqlConnection->prepare($sql_string);

//execute query
$success = $statement->execute(array_values($params));

//return boolean success
return $success;
}  

But If you really need to bind, you can do it the following way:

function insertDataBind($tablename, $params){
//build query string
$column_string = implode(',', array_keys($params));
$value_string = implode(',:', array_keys($params));
$sql_string = "INSERT INTO {$tablename} ({$column_string}) VALUES (:{$value_string})";
//prepare query
$mysqlConnection = getConnection();
$statement = $mysqlConnection->prepare($sql);
//bind 
    foreach($params as $key=>$value){
        $statement->bindValue($key, $value);
    }
//execute query
$success = $statement->execute();

//return boolean success
return $success;
}

usage:

if(isset($_POST['title'], $_POST['question'], $_POST['tags'])){

$params = array('title' => $_POST['title'],
                'question'=>$_POST['question'],
                'tags'=>$_POST['tags']
                );

$success = insertData('questions', $params);

if(!$success)
    echo 'Sorry failed :(';
}