Address book with database tables This is my first time messing with PHP and I tried to put together a simple address book that when the user fills out the form it would update a database table, then display the row data on the page after submission.

It works fine, but I just want to make sure I'm headed in the right direction.

index.php:

&lt;?php

if ($_SERVER["REQUEST_METHOD"] == "POST") {

// connect to database
include("inc/dbconnect.php");

// assigns form data to table columns
$assign = "INSERT INTO contacts(firstName,lastName,email,phone,birthday) VALUES ('$_POST[firstName]','$_POST[lastName]','$_POST[email]','$_POST[phone]','$_POST[birthday]')";

// execute query
if (mysqli_query($database,$assign)) {
    header("Location:http://localhost/address-book/");
    exit;
} else {
    echo "Everything blew up!" . mysqli_error($database);
}

// closes database connection
mysqli_close($database);

}

?&gt;

&lt;!DOCTYPE html&gt;
&lt;html&gt;
&lt;head&gt;
&lt;title&gt;Address Book&lt;/title&gt;
&lt;/head&gt;
&lt;body&gt;

&lt;h1&gt;Address Book&lt;/h1&gt;

&lt;table cellpadding="5" cellspacing="0"&gt;
    &lt;thead&gt;
        &lt;tr&gt;
            &lt;th&gt;Contact name&lt;/th&gt;
            &lt;th&gt;Email address&lt;/th&gt;
            &lt;th&gt;Phone&lt;/th&gt;
            &lt;th&gt;Birth Date&lt;/th&gt;
        &lt;tr&gt;
    &lt;/thead&gt;
    &lt;tbody&gt;
        &lt;?php include("inc/records.php"); ?&gt;
    &lt;/tbody&gt;
&lt;/table&gt;


&lt;h3&gt;Add new contact&lt;/h3&gt;

&lt;form method="post" action="index.php"&gt;
    &lt;input type="text" name="firstName" id="firstName" placeholder="First name"&gt;
    &lt;input type="text" name="lastName" id="lastName" placeholder="Last Name"&gt;&lt;br /&gt;
    &lt;input type="text" name="email" id="email" placeholder="Email address"&gt;
    &lt;input type="text" name="phone" id="phone" placeholder="Phone"&gt;&lt;br /&gt;
    &lt;input type="text" name="birthday" id="birthday" placeholder="Birthday"&gt;
    &lt;input type="submit" value="Save record" placeholder="Save"&gt;
&lt;/form&gt;


&lt;/body&gt;
&lt;/html&gt;


dbconnect.php:

// database connect
$database = mysqli_connect(
            "localhost",
            "user",
            "password",
            "database"
);


records.php:

// connects to database
include("dbconnect.php");

// targets the database table contacts
$records = mysqli_query($database,"SELECT * FROM contacts");

// pull row data from database
while($record = mysqli_fetch_array($records)) {
    echo "&lt;tr&gt;";
    echo "&lt;td&gt;" . $record['firstName'] . " " . $record['lastName'] . "&lt;/td&gt;";
    echo "&lt;td&gt;&lt;a href='mailto:" . $record['email'] . "'&gt;" . $record['email'] . "&lt;/a&gt;&lt;/td&gt;";
    echo "&lt;td&gt;" . $record['phone'] . "&lt;/td&gt;";
    echo "&lt;td&gt;" . $record['email'] . "&lt;/td&gt;";
    echo "&lt;/tr&gt;";
}

mysqli_close($database);
I think there are two major issues you should address right in the beginning when you start with PHP.

Separation of Layout and Logic

This means in general that you shouldn't mix HTML and PHP code. Later this will lead you to the MVC-Pattern.

index.php

&lt;?php
// connect to database
include("inc/dbconnect.php");

if ($_SERVER["REQUEST_METHOD"] == "POST") {
    //...
}

$result = mysqli_query($database,"SELECT * FROM contacts");

$records=array();
while($row = mysqli_fetch_array($result)) {
    $record[]=$row;
}

mysqli_close($database);

include 'template.php';


template.php

&lt;!DOCTYPE html&gt;
&lt;html&gt;
...
    &lt;tbody&gt;
        &lt;?php foreach ($records as $record):?&gt;
        &lt;tr&gt;
             &lt;td&gt;&lt;?= $record['firstName']?&gt; &lt;?= $record['lastName']?&gt;&lt;/td&gt;
             &lt;td&gt;&lt;a href="mailto:&lt;?= $record['email']?&gt;"&gt;&lt;?= $record['email']?&gt;&lt;/a&gt;&lt;/td&gt;
             &lt;td&gt;&lt;?= $record['phone']?&gt;&lt;/td&gt;
             &lt;td&gt;&lt;?= $record['email']?&gt;&lt;/td&gt;
        &lt;/tr&gt;
        &lt;?php endforeach;?&gt;
    &lt;/tbody&gt;
...
&lt;/html&gt;


Prevent SQL Injection

You are passing user input directly to the query you send to the database. Wikipedia will elaborate some examples in detail and shows how queries can be manipulated.

The easies way for you to prevent this, is using PHP Data Objects and Prepared Statements. I think there is no need for going in detail here if you don't have a specific question, there are many good tutorials out there. The important part is, that the user is no longer able to change the query you send to the database.

Minor issues


If you only have one database connection PHP will use this connection automatically with the mysqli_ methods so you don't have to pass the $database around.
It is best practice to leave away the final '?>' in plain php files. This will prevent that you send any whitespace after ?&gt; to the browser accidentally. (Important if you change the header later.)
echo "Everything blew up!" . mysqli_error($database); . May you should use die.