Analysis and Optimization of PHP Form Submission Failures with Error Handling

Problem Background and Phenomenon Analysis

Form submission is a common requirement in web development. However, when form data fails to be written to the database without any error messages displayed, developers often struggle to identify the root cause. This situation typically occurs when database queries fail but error information is not captured and displayed.

Error Reporting Mechanism Implementation

In the original PHP code, the mysqli_query() function executes database insertion operations without error handling mechanisms. When the query fails, the function returns false, but the program continues execution, preventing users from knowing the reason for the failure.

By adding or die(mysqli_error($db)) to the end of the query statement, MySQL error information can be immediately captured and displayed:

mysqli_query($db, "INSERT INTO stockdetails (`itemdescription`,`itemnumber`,`sellerid`,`purchasedate`,`otherinfo`,`numberofitems`,`isitdelivered`,`price`) VALUES ('$itemdescription','$itemnumber','$sellerid','$purchasedate','$otherinfo','$numberofitems','$numberofitemsused','$isitdelivered','$price')") or die(mysqli_error($db));

This approach helps quickly identify SQL syntax errors, field mismatches, or connection issues during development. When the query fails, mysqli_error($db) returns specific error descriptions, and the die() function terminates script execution while outputting the error message.

SQL Injection Security Risk Analysis

The original code contains serious security vulnerabilities. Although str_replace("'", "", $variable) attempts to filter single quotes, this protection measure is extremely weak and cannot effectively prevent SQL injection attacks.

Attackers can bypass simple character replacement through various methods:

• Using double quotes or other quote variants
• Utilizing encoding or escape sequences
• Injecting through numeric parameters

Prepared Statements Security Solution

To prevent SQL injection, prepared statements should be used. Below is an improved secure code example:

<?php
// Connect to database
include("connectmysqli.php");

// Prepare prepared statement
$stmt = mysqli_prepare($db, "INSERT INTO stockdetails (itemdescription, itemnumber, sellerid, purchasedate, otherinfo, numberofitems, isitdelivered, price) VALUES (?, ?, ?, ?, ?, ?, ?, ?)");

// Bind parameters
mysqli_stmt_bind_param($stmt, "sssssiis", $itemdescription, $itemnumber, $sellerid, $purchasedate, $otherinfo, $numberofitems, $isitdelivered, $price);

// Execute query
if (mysqli_stmt_execute($stmt)) {
    echo "Data inserted successfully";
} else {
    echo "Error: " . mysqli_error($db);
}

// Close statement
mysqli_stmt_close($stmt);
?>

Error Handling Best Practices

Beyond basic error display, more comprehensive error handling strategies should be considered:

// Set error reporting level
error_reporting(E_ALL);
ini_set('display_errors', 1);

// Use trigger_error instead of die for production environment control
$sql = "INSERT INTO stockdetails (...) VALUES (...)";
$result = mysqli_query($db, $sql);

if (!$result) {
    trigger_error("Database query failed: " . mysqli_error($db), E_USER_ERROR);
}

Data Validation and Sanitization

Strict data validation should be performed before accepting user input:

// Validate required fields
if (empty($_POST['itemdescription'])) {
    die("Item description cannot be empty");
}

// Data type validation
if (!is_numeric($_POST['price'])) {
    die("Price must be numeric");
}

// Date format validation
if (!strtotime($_POST['purchasedate'])) {
    die("Purchase date format is incorrect");
}

Conclusion and Recommendations

By implementing appropriate error handling mechanisms, developers can quickly locate and resolve database operation issues. Meanwhile, adopting prepared statements effectively prevents SQL injection attacks, ensuring application security. It is recommended to enable detailed error reporting during development and log errors instead of displaying them directly to users in production environments, balancing debugging needs with security requirements.