Insert into table class

Question

This class should function as a simple insert into table. What do you think about it? How can I make my code better?

class addProfile{
private $profileName;
private $profileEmail;
private $profileFromName;
private $profileReplaytToEmail;

public function __construct($profileName,$profileEmail,$profileFromName,$profileReplayToEmail){
    $this->profileEmail = $profileEmail;
    $this->profileFromName = $profileFromName;
    $this->profileName = $profileName;
    $this->profileReplaytToEmail = $profileReplayToEmail;
}

public function postProfile($profileName,$profileEmail,$profileFromName,$profileReplayToEmail){
    $stmt = $this->mysqli->prepare("INSERT INTO SendingProfiles (fromemail,Fromname,Profilename,replaytoemail)
    VALUES ('$profileName','$profileEmail','$profileFromName','$profileReplayToEmail')");
    $stmt->bind_param($profileName,$profileEmail,$profileFromName,$profileReplayToEmail);

    if ($stmt->execute()){
        echo "the record added";
    }else{
        echo "Failed";
    }

    $stmt->close();


}

public function __destruct(){
    $this->mysqli->close();
}

}

$profileName = $_POST['profilename'];
$profileEmail = $_POST['fromemail'];
$profileFromName = $_POST['fromname'];
$profileReplayToEmail = $_POST['replaytoemail'];

$var = new addProfile();
$var->postProfile($profileName, $profileEmail, $profileFromName, $profileReplayToEmail)

There's something wrong with your use of MySQLi. You insert the values into the SQL command string first, and after that you bind them to the statement. It might work, but the binding serves no purpose and the values are inserted without escaping them, or checking their validity. Apart from that, there is the problem that this code is so minimal that there's not much to review. — KIKO Software
– KIKO Software, Commented Dec 5, 2014 at 8:22

Abandoned Account · Accepted Answer · 2014-12-06 04:48:05Z

There's very little to review.

Variable Names

Use full names for variables, avoid short forms of those words/abbreviations. For example, you wrote, $stmt, instead you could write $statement to increase the readability of the code.

Class Names

Your class name, addProfile is not really suitable to give the image of the class. Why not name it, CreateUserProfile since that is what it does?

Also, class names should be declared StudlyCaps.

Validation Checks

Why not perform validation checks for what user has input? For example check if the variables are empty or not.

Coding Standards

Your coding style does not meet the coding standards.

Working Code

You have not provided us with a working code, as there would be an error with bind_param() because you haven't used any '?' and directly injected the variables like this, which is vulnerable to SQL injection.

$stmt = $this->mysqli->prepare("INSERT INTO SendingProfiles (fromemail,Fromname,Profilename,replaytoemail)
    VALUES ('$profileName','$profileEmail','$profileFromName','$profileReplayToEmail')");

Instead, do this:

$stmt = $this->mysqli->prepare("INSERT INTO SendingProfiles(fromemail, Fromname, Profilename, replaytoemail) VALUES(?, ?, ?, ?)");

\$\begingroup\$ I did include that. \$\endgroup\$

Abandoned Account
– Abandoned Account

2014-12-06 14:35:21 +00:00
Commented Dec 6, 2014 at 14:35 — Abandoned Account
– Abandoned Account, Commented Dec 6, 2014 at 14:35

200_success · Accepted Answer · 2014-12-06 08:51:06Z

3

Also to add onto @HassanAlthaf's answer above you need to bind parameters like below:

 $stmt->bind_param('ssss',$profileName,$profileEmail,$profileFromName,$profileReplayToEmail);

The s is for strings and matches each parameter variable. i is for integer, d for double, b for blob. Refer to the PHP Manual for more info.

edited Dec 6, 2014 at 8:51

200_success

146k22 gold badges191 silver badges481 bronze badges

answered Dec 6, 2014 at 6:08

Rambo kanambo

311 bronze badge

Add a comment |

Stack Exchange Network

Insert into table class

2 Answers 2

You must log in to answer this question.

Hot Network Questions

Insert into table class

2 Answers 2

You must log in to answer this question.

Related

Hot Network Questions