now using prepared statements for guestbook

diff --git a/guestbook.php b/guestbook.php
index 6ddd1e50259cfa6662bbfe37f613615e8aae4188..a5dfcb689beb544172614838751e160d6bf5e2ef 100644 (file)
--- a/guestbook.php
+++ b/guestbook.php
@@ -44,8 +44,22 @@
                                                        
                                                        // query
                                                        $sql = "INSERT INTO entries (name, country, website, email, comment, ip_addr)
-                                                                                       VALUES ('$name', '$country', '$website', '$email', '$comment', '$ip_addr');";
-                                                       $conn->query($sql); // submit query
+                                                                                       VALUES (?, ?, ?, ?, ?, ?);";
+                                                       
+                                                       $stmt = $conn->prepare($sql);
+                                                       if(!$stmt){
+                                                               die("Prepare failed: {$conn->error}");
+                                                       }
+                                                       
+                                                       // s = string
+                                                       $stmt->bind_param("ssssss", $name, $country, $website, $email, $comment, $ip_addr);
+                                                       if(!$stmt->execute()){
+                                                               die("Execute failed: {$stmt->error}");
+                                                       }
+                                                       
+                                                       $stmt->close();
+                                                       
+                                                       //~ $conn->query($sql); // submit query
                                                        
                                                        header("Location: " . $_SERVER["PHP_SELF"]);
                                                        die();