Insert Data

Inserting Records into MySQL Tables with PDO

Inserting new record rows into a database table is performed using SQL INSERT INTO statements executed via PDO prepared statements.

Insert Operation Pipeline

flowchart LR
    A["Prepare SQL Statement"] -->|'$pdo->prepare()'|| B["Bind Named Parameters"]
    B -->|'$stmt->execute()'|| C["Insert Row into Database"]

Practical Code Example

<?php
declare(strict_types=1);

try {
    $pdo = new PDO("mysql:host=127.0.0.1;dbname=ecommerce_db;charset=utf8mb4", 'root', 'secret_password', [
        PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION
    ]);

    // Prepared SQL query template with named placeholders
    $sql = "INSERT INTO users (username, email, status) VALUES (:username, :email, :status)";
    $stmt = $pdo->prepare($sql);

    // Bind values and execute
    $userData = [
        'username' => 'maksudur_dev',
        'email' => '[email protected]',
        'status' => 'active'
    ];

    $stmt->execute($userData);
    echo "User record inserted successfully!
";
} catch (PDOException $e) {
    die("Insert Error: " . $e->getMessage());
}

Best Practices

• Always Use Prepared Statements: Never concatenate user variables directly into raw SQL query strings ("INSERT INTO users VALUES ('$name')"), which creates severe SQL Injection vulnerabilities.
• Use Named Placeholders (:username): Named parameters make complex queries readable and maintainable.
• Catch PDOException: Handle duplicate key constraint violations (1062 Duplicate entry) gracefully.

Self-Check Challenge

Write a SQL INSERT INTO template using named parameters :title and :price!