title: Creating a Form to POST into MySQL using PDO properly?
body: <p>I'm trying to use a PDO Wrapper Class and in general for proper security against SQL injections as good practice. Trying to learn the clean bare essentials for filling out a form to POST into MySQL.</p>
  
  <p>So, at one point my form was inserting data into the MySQL table, but was doing multiple records on refresh after submit. Then I researched a cleaner way to write the processor but am now having trouble making it insert into the table. Not sure if maybe there is a discrepancy between the Processor and the "class.db.php" file?</p>
  
  <p>I've searched a lot for "how-to's" having no success in a consistent answer. Trying to understand what I'm doing wrong, desiring an answer of best practice. Everything I've seen is all over the map.</p>
  
  <p>Here's where I'm at:
  For reference I started here first <a href="http://webdevelopingcat.com/php-mysql-tutorial-for-beginners-inserting-rows-with-pdo/" rel="nofollow">http://webdevelopingcat.com/php-mysql-tutorial-for-beginners-inserting-rows-with-pdo/</a></p>
  
  <p>Then at top of the document I'm Including if you google, the <a href="https://code.google.com/p/php-pdo-wrapper-class/" rel="nofollow">https://code.google.com/p/php-pdo-wrapper-class/</a> project for a basis of class implementation.</p>
  
  <pre><code>&lt;?php
  include("class.db.php");
  $version = "1.0.2";
  $released = "December 9, 2010";
  ?&gt;
  </code></pre>
  
  <p>Then a simple form within the body.</p>
  
  <pre><code>&lt;?php
  if ( empty( $_POST ) ){
  ?&gt;
  
  &lt;form name='registration' action='success.php' method='POST'/&gt;
  &lt;label for 'FName'&gt;First Name: &lt;/label&gt;
  &lt;input type="text" name="FName" /&gt;
  
  &lt;label for 'LName'&gt;Last Name: &lt;/label&gt;
  &lt;input type="text" name="LName" /&gt;
  
  &lt;label for 'Age'&gt;Age: &lt;/label&gt;
  &lt;input type="number" name="Age" /&gt;
  
  &lt;label for 'Gender'&gt;Gender: &lt;/label&gt;
  &lt;input type="text" name="Gender" /&gt;
  
  &lt;button type="submit"&gt;Submit&lt;/button&gt;
  &lt;/form&gt;
  </code></pre>
  
  <p>Finally the form processor also within the body.</p>
  
  <pre><code>&lt;?php
  } else {
  //process the form here
  //
  // Connect to database
  $db = new db("mysql:host=localhost;dbname=pdodb", "root", "root");
  
  $form = $_POST;
  $first = $form[ 'FName' ];
  $last = $form[ 'LName' ];
  $myage = $form[ 'Age' ];
  $gen = $form[ 'Gender' ];
  
  $sql = "INSERT INTO mytable ( FName, LName, Age, Gender ) VALUES ( :first, :last, :myage, :gen )";
  
  $query = $db-&gt;prepare( $sql );
  $query-&gt;execute( array( ':first'=&gt;$first, ':last'=&gt;$last, ':myage'=&gt;$myage, ':gen'=&gt;$gen ) );
  
  }
  ?&gt;
  </code></pre>
  
  <p>The MANUAL way works. Referenced culttt.com post about: prevent-php-sql-injection-with-pdo-prepared-statements</p>
  
  <pre><code>// Create array of data to insert
  $insert = array(
  "FName" =&gt; "John",
  "LName" =&gt; "Doe",
  "Age" =&gt; 26,
  "Gender" =&gt; "male"
  );
  // Insert the array into the table
  $db-&gt;insert("mytable", $insert);
  </code></pre>