I've constructed code using prepared statements to try and avoid chances of SQL injections. This code is meant to insert the employees information. It does what I need it to do but I want to know if the php or html used in this is suitable for a proper application or if its vulnerable.

```
    <form name="register" action="" method="post">

            <label for = "fname"> <b>First name</b> </label>
            <input type="text" name="fname" size="48"> 

            <label for = "lname"> <b>Last name</b> </label>
            <input type="text" name="lname" size="48"> 

            <label for = "dob"> <b>Date of birth</b> </label>
            <input type="date" name="dob" size="48">   

            <label for = "address"> <b>Address</b> </label>
            <input type="text" name="address" size="48"> 

            <label for = "position"> <b>Position</b> </label>
            <input type="text" name="position" size="48"> 

            <label for = "email"> <b>Email</b> </label>
            <input type="text" name="email" size="48">

            <label for = "password"> <b>Password</b> </label>
            <input type="password" name="password" size="48"> 

            <button type="submit" name="submit1"> Register a new administrator</button>
            <button type="submit" name="submit2"> Register a new employee</button>

    </form>

    </div>
    <?php
 include("dbcon.php");

 if(isset($_POST["submit1"]))

    { 
        $stmt = $conn->prepare ("insert into admin(Adminfnam,Adminlnam,DOB,Aemail,AAddress,APosition,Apassword) values(?,?,?,?,?,?,?)"); //Insert query to register a person
        $stmt ->bind_param("sssssss",$fname,$lname,$dob,$email,$address,$position,$password);

            $fname = $_POST["fname"];
            $lname = $_POST["lname"];
            $dob = $_POST["dob"];
            $email = $_POST["email"];
            $address = $_POST["address"];
            $position = $_POST["position"];
            $password = $_POST["password"];

            $stmt-> execute();
        echo "Registered";

        $stmt-> close();

    }

```