I have the following script which I need to secure. I need to add parametric binding to it.

Along using PDO's prepared statements and making sure the script data comes from the same script. (which I believe I did it right already)

(contactcrudsecured.php)

//Error error_reporting(0);

//Security conditions if(isset($_POST['fullname']) && isset($_POST['email']) && isset($_POST['email']) && isset($_GET['deleteid']) && isset($_POST['idtoupdate']) && isset($_GET['editid']) && isset($_POST['submit'])) {

//Create new PDO

$dbh = new PDO('mysql:host=localhost;dbname=test', 'root', '');

//Full name

$fullname = $_POST['fullname'];

//Email

$email = $_POST['email'];

//Phone

$phone = $_POST['phone'];

//Deleted

$deleteid = $_GET['deleteid'];

//Uptodate

$idtoupdate = $_POST['idtoupdate'];

//If edit is clicked

$editid = $_GET['editid'];

//If condition satisfies

if ($_POST['submit'] == 'Submit')

{ //If condition satisfies if (!$idtoupdate) { //Prepare

$inssql = $dbh->prepare("insert into contacts (fullname,email,phone) values ('$fullname','$email','$phone')");

//Echo

echo "Your record has been inserted!";

//Execute

$inssql->execute();

//Header

header("location: crud.php?message=insert"); } }

//If condition satisfies if ($deleteid) { //Delete $delsql= $dbh->prepare("delete from contacts where id = '$deleteid'"); //Execute $delsql->execute(); }

//If condition satisfies if ($idtoupdate)

{

//Prepare

$upsql = $dbh->prepare("update contacts set fullname = '$fullname',email='$email',phone='$phone' where id = '$idtoupdate'");

//Exit

$upsql->execute();

} //Prepare $selsql = $dbh->prepare("select id,fullname from contacts");

//Execute $selsql->execute();

//Loop

while ($row = $selsql->fetch()) { //Full name echo $row['fullname']; //Output link echo ''; //Output echo ' Edit '; }

//If condition satisfies if (isset($editid)) { //Prepare $getupsql = $dbh->prepare("select fullname,email,phone from contacts where id = '$editid'"); //Execute $getupsql->execute(); //Fetch $row = $getupsql->fetch(); //Full name $upfullname = $row['fullname']; //Email $upemail = $row['email']; //Phone $upphone = $row['phone']; } } ?>