Submit form data to MYSQL table with PHP execute I have written code to send a simple email submission form to a sql table so that I can manage the data. I would like feedback on whether or not the code that I have written is efficient and secure. I have a config file that defines constants for database credentials.

HTML FORM

&lt;form method="post" action="index.php"&gt;
    &lt;input class="bt-email" type="email" name="email" placeholder="enter email address"&gt;
    &lt;input class="bt-submit" type="submit" value="let's get moving!"&gt;
&lt;/form&gt;


PHP Database Code File

try {
    $db = new PDO("mysql:host=" . DB_HOST . ";dbname=" . DB_NAME . ";port=" . DB_PORT,DB_USER,DB_PASS);
    $db-&gt;setAttribute(PDO::ATTR_ERRMODE,PDO::ERRMODE_EXCEPTION);
    $db-&gt;exec("SET NAMES 'utf8'");
} catch (Exception $e) {
    echo "Could not connect to the database.";
    exit;
}


PHP/SQL Submission Code

&lt;?php
require_once("inc/config.php");
if ($_SERVER["REQUEST_METHOD"] == "POST") {
    $email = $_POST["email"];
    require(ROOT_PATH . "inc/database.php");
    try {
        $db-&gt;exec("REPLACE INTO launch_email VALUES ('$email')");
    } catch (Exception $e) {
        echo "Data could not be submitted to the database.";
        exit;
    }
    header("Location: index.php?status=thanks");
    exit;
}
?&gt;
You could possibly move the database include before the server checks and sets the $_POST variable, as it would not be needed if the database is unable to connect.

I notice there is no sanitization of the email variable. This may be helpful.