PHP Form to Insert data in Database

Question

I've created a form that inserts data into a database. I've been given the two functions to get the data and display it, these are located in a file called queryDb.php:

function addCustomer($fname, $lname, $address, $phone) {
    $db = new MyDB();
    if(!$db){
        echo '<script type="text/javascript">alert("'.$db->lastErrorMsg().'");</script>';
    } else {
        //echo "Opened database successfully\n";
    }

    $sql ='INSERT INTO CUSTOMERS (FIRSTNAME, LASTNAME, ADDRESS, PHONE) VALUES ("'.$fname.'", "'.$lname.'", "'.$address.'", "'.$phone.'");';
    $db->query($sql);
}

get function:

function getCustomers($searchTerm = null) {      
    $db = new MyDB();

    if(!$db){
        echo '<script type="text/javascript">alert("'.$db->lastErrorMsg().'");</script>';
    } else {
        //echo "Opened database successfully\n";
    }

    if(!$searchTerm) {
        $sql ='SELECT * from CUSTOMERS;';
    } else {
        $sql ='SELECT * FROM CUSTOMERS WHERE FIRSTNAME LIKE "'.$searchTerm.'" OR LASTNAME LIKE "'.$searchTerm.'" OR ADDRESS LIKE "'.$searchTerm.'" OR PHONE  LIKE "'.$searchTerm.'"';
    }
    $ret = $db->query($sql);
    $array = [];

    if(!$ret){
       echo $db->lastErrorMsg();
       return [];
    } else {
        while($row = $ret->fetchArray(SQLITE3_ASSOC) ){
            $array[] = $row;
        }
        $db->close();
        return $array;
    }
}

In my reviewsubmit.php I have this up the top:

<?php
    require_once "queryDb.php";
    $firstname = $_POST["firstname"];
    $lastname = $_POST["lastname"];
    $address = $_POST["address"];
    $phone = $_POST["phone"];
    addCustomer($firstname, $lastname, $address, $phone);
?>

And this is my form:

<form action="reviewsubmit.php" method="post">
    Firstname
    <input type="text" id="firstname" name="firstname">  />
    Lastname
    <input type="text" id="lastname" name="lastname"">  />
    Address
    <input type="text" id="address" name="address">  />
    Phone
    <input type="text" id="phone" name="phone">  />
    <input type="submit" name="Submit" value="Submit" />
</form>

The problem is when I submit information into the Database using the form, it submits empty values for everything when I click submit the first time. Then when I hit submit again it submits the actual values: image

Answer 1

Your HTML Mark-up is not really the best and that could cause some anomalies. Simultaneously, it would be ideal to add the required Attribute to your Fields to ensure that all the necessary Fields are filled before submitting like so:

<!-- TO GUARD AGAINST ACCIDENTALLY INSERTING EMPTY VALUES -->
<!-- WHY NOT MAKE THE INPUT FIELDS MANDATORY -->
<form action="reviewsubmit.php" method="post">
    <label for="firstname">Firstname</label>
    <input type="text" id="firstname" name="firstname" required  />

    <label for="lastname">Lastname</label>
    <input type="text" id="lastname" name="lastname" required />

    <label for="address">Address</label>
    <input type="text" id="address" name="address" required />

    <label for="phone">Telephone</label>
    <input type="text" id="phone" name="phone" required/>

    <input type="submit" name="Submit" value="Submit" />
</form>

On the PHP Side, you may also go the extra mile of checking that the submitted values are not empty or null before submitting to the Database. That way you are both sure of what is going on at the Front and Back-ends. This could be a way of doing that:

<?php
    // FILE: index.php
    require_once "queryDb.php";
    $firstname  = isset($_POST["firstname"])? htmlspecialchars(trim($_POST["firstname"]))   : null;
    $lastname   = isset($_POST["lastname"]) ? htmlspecialchars(trim($_POST["lastname"]))    : null;
    $address    = isset($_POST["address"])  ? htmlspecialchars(trim($_POST["address"]))     : null;
    $phone      = isset($_POST["phone"])    ? htmlspecialchars(trim($_POST["phone"]))       : null;

    // CHECK THAT YOU DON'T HAVE NULL OR EMPTY FIELD VALUES BEFORE INSERTING ANYTHING INTO DATABASE
    if(!is_null($firstname) && !is_null($lastname) && !is_null($address) && !is_null($phone) ){
        addCustomer($firstname, $lastname, $address, $phone);
    }

?>