All right, welcome back, everybody. Let's keep going right where we left off at the conclusion of the last video. So we now know how to respond to when the user submits a form. So next up, let's dd the $_POST superglobal and have a look. So back to Firefox, right here, and you'll notice behind the scenes, I've cleared out all of the notes so that we can start from scratch. Okay, so we will add some gibberish here, submit the form, and sure enough, we get an array of all of the inputs or the values from the form. Okay, so now the next step would be to take those values and insert them into the database, right?

Okay, so now the next step would be to take those values and insert them into the database, right? Into the notes table. All right, well, let's see how we might do that. All right, so let's do this. Let's go into notes.php, and maybe one more time, I'm going to copy and paste this, and then I'll show you a cleaner way that we can allow for things like this. Okay, so now I can say DB::table('notes')->insert([...]), and you know what? We haven't yet reviewed the syntax for an insert query, but I'll show you a little trick. Let's go to TablePlus and manually add a note, something, user_ideas_1, and I'll hit save.

We haven't yet reviewed the syntax for an insert query, but I'll show you a little trick. Let's go to TablePlus and manually add a note, something, User Ideas one, and I'll hit save. And you'll notice if I go to the history tab, here I can see a list of all of the actual SQL queries that are being executed within TablePlus. So yeah, in this case, it looks like we say insert into the name of the table, and then the columns, and then values, and then the corresponding values. Great. So this is especially useful during the learning phase. So let's go back to phpStorm, and I'll use that. insert into notes, the body and the user_id, and yeah, for the values, exact same thing.

So let's go back to phpStorm, and I'll use that. Insert into notes, the body and the user ID, and yeah, for the values, exact same thing. We're going to leverage prepared statements so that we avoid any risk of funny business or SQL injection. So yeah, the values will be wildcards or parameters here, body and user ID. And I will pass those through as the second argument. All right, so body will be postBody. So grab the body value or attribute from the form. And then we will do user ID. And yeah, we haven't yet reviewed session handling or authentication.

And then we will do userId. And yeah, we haven't yet reviewed session handling or authentication. So I'm going to hard code this, but I promise we're going to get to it. All right, let's just see what happens now. So back to Firefox, give it a refresh. Keep learning php. We save it. And we're not really providing feedback, which we probably should. But if I go to TablePlus and give this a refresh, and there we go. It works.

But if I go to TablePlus and give this a refresh, and there we go. It works. We're in business. So very cool, but also very risky. And here's what I mean. Yes, you wrote prepared statements, which is great. You've avoided that potential pitfall. But that doesn't mean all of your security concerns are solved. So have a look here. Let's create a new note.

So have a look here. Let's create a new Note. And I'm just going to say, work on. And then I'll say within <strong> tags, something. And then why don't we add some classes here? So I know this website uses Tailwind, right? So why don't we say text-red-500 and font-bold. All right, interesting, right? What do you think is going to happen here? We save it.

But then always escape it when you display it on the page. And I'll show you what that looks like. Let's go into our list of notes. And yeah, right up here, here's where we display the notes. And yeah, right here, instead of blindly echoing whatever the user has typed into that form, why don't we first pass it to a built-in php function called htmlspecialchars? All right, so first, let's see what happens, and then we'll talk a little more.

Just assume that they're trying to do something bad. Even if 99% of people are good, you have to assume that they're going to try something malicious. So that's why we run any user-provided input or values through functions like this, htmlspecialchars. And you can see here, it's going to convert all applicable characters to HTML entities. Yeah, so if I close this out, back to Firefox, view the source.

now it is treated as HTML, which is why we see that alert. All right, good to know. So let's update this, and then I'm going to do the exact same thing anywhere else we display the note. So how about one right here? And I will paste that. All right, but as always, and I'm going to tell you this a million times, we're not done yet. There's still more things to consider. For example, what if I try to create a note

And if I come back to the list here, well, it's collapsed. But if I hit Shift-Command-C, yeah, here's all of the list items that are being rendered to display what is empty notes. And again, we don't want to allow that. So yeah, it can be a little overwhelming at times. I get it. There's so many things you have to think about. In this video alone, we leveraged prepared statements to avoid the risk of SQL injection.

In this video alone, we leveraged prepared statements to avoid the risk of SQL injection. And then we used the htmlspecialchars function to convert any potential HTML into their HTML entity equivalents. And now it seems like we also need a layer of validation to ensure that the User, when they sip at the form, is providing to us the values and the data and the types that we expect. So we'll take a look at that last element, validation,