MySQL PHP pdo insert value is not working

Question

I have a table with id - integer AUTO INCREMENT productid varchar photo varchar I use pdo for mysql connection the code below is giving my an error please any help

$photo = $_POST['photo'];
$product = $_SESSION['prd'];
$todo = $dblink->query("INSERT INTO productphotos VALUES (NULL, '".$product."', '".$photo."'") or die ("Erorr");

Best Reagrds Thank You

Answer 1

Save yourself the trouble of concatenating values into your SQL and use a prepared statement

$stmt = $dblink->prepare('INSERT INTO productphotos VALUES (NULL, ?, ?)');
$stmt->execute([$product, $photo]);

Answer 2

if(isset($_POST['photo'], $_SESSION['prd'])){
//data
$photo = $_POST['photo'];
$product = $_SESSION['prd'];

$query = "INSERT INTO productphotos VALUES (NULL, :product, :photo)"
$stmt = $dblink->prepare($query);;
$stmt->bindValue(':product', $product, PDO::PARAM_STR); 
$stmt->bindValue(':photo', $photo, PDO::PARAM_STR);

$stmt->execute(); 
}

And you should really make sure you set your connection to throw errors

$dblink->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);