Insert row into database using values from a html form submission I have a comments page on my site and I was wondering if it is vulnerable to some sort of sql attack or something else. At the moment users can type what they want, they can even write a php script and it will upload to the database. Is this a problem and how can I fix it.
This is the script I use:
$name= $_POST['name'];
$email= $_POST['e_mailaddress'];

if(isset($_POST['comments']) AND $_POST['comments']!=''){
    $comments= $_POST['comments'];
    $comments_sent = 'true';

$dbcn = new connection();

$sql= &quot;INSERT INTO contact (name, email, comments) VALUES (:name, :email, :comments);&quot;;

$query = $dbcn-&gt;dbconnect()-&gt;prepare($sql);

$results = $query-&gt;execute(array(
&quot;:name&quot;=&gt; $name,
&quot;:email&quot;=&gt; $email,
&quot;:comments&quot;=&gt; $comments
));
}
With prepared statements, I don't see anything that would immediately make it susceptible to sql injection (this isn't to say there isn't something that is there at a deeper level - I'm not a security auditor nor intimately familiar with php).  The "or something else" part remains quite large.

Look at OWASP (Open Web Application Security Project) which goes through a large set of possible attack vectors through the web.

Such a page is susceptible to various scripting injection where someone inserts a script (or flash, or even something like an image from another site) to be executed on another client machine. From the OWASP top 10 - 2013 pdf the XSS attack can be seen and described on page A3 (page 9).