Issue with PHP and MySQL Database

Question

Here is my main PHP code:

<?php

define('dbServer', 'localhost');
$dbUsername = 'root';
$dbPassword = '';
define('dbName', '1');

$dbConnection = mysqli_connect(dbServer, $dbUsername, $dbPassword, dbName);

if(!$dbConnection){
    die("Unsuccessful Connection: " . mysqli_connect_error());
}



// All user data will be taken from the form //

$emailAddress = $_POST['emailaddress'];
$firstName = $_POST['firstname'];
$lastName = $_POST['lastname'];
$streetAddress = $_POST['streetaddress'];
$phoneNumber = $_POST['phonenumber'];
$comments = $_POST['comments'];

$sql = "INSERT INTO user-submission (email, firstName, lastName, address, phoneNumber, comment) VALUES ('$emailAddress', '$firstName', '$lastName', '$streetAddress', '$phoneNumber', '$comments')";

$result = mysqli_query($dbConnection, $sql);

if (!$result){
    die('Error: ' . mysqli_connect_error());
}

?>

My SQL database contains the rows ID, email, firstName, lastName, address, phoneNumber, comment. They are in a database called '1' (for testing purposes) and a table called 'user-submission'.

I have been unable to query this information into my table. I have been successful prior to this on other SQL and PHP pairings. What am I doing wrong this time?

Answer 1

Add this right below the opening php tag at the top then the server will tell you what the error is. Copy the error here if you need help decyfering

error_reporting( E_ALL );

Answer 2

First you need to make changes so hackers don't abuse your code. Just wait till johnny;drop tables; comes by and wipes out your database.

// All user data will be taken from the form //

$emailAddress = mysqli_real_escape_string($dbConnections,$_POST['emailaddress']);
$firstName = mysqli_real_escape_string($dbConnections,$_POST['firstname']);
$lastName = mysqli_real_escape_string($dbConnections,$_POST['lastname']);
$streetAddress = mysqli_real_escape_string($dbConnections,$_POST['streetaddress']);
$phoneNumber = mysqli_real_escape_string($dbConnections,$_POST['phonenumber']);
$comments = mysqli_real_escape_string($dbConnections,$_POST['comments']);


$sql = "INSERT INTO `user-submission` (email, firstName, lastName, address, phoneNumber, comment) VALUES (?,?,?,?,?,?)";
$prep=$dbConnections->prepare($sql);
$prep->bind_param("ssssss",$emailAddress,$firstName,$lastName,$streetAddress,$phoneNumber,$comments);

#actually puts everything together, and puts it in the database
$prep-execute();