title: Bootstrap HTML + MySQL PHP Form Security
body: <p>I've made a html form using Bootstrap. I've used "required" to ensure data is populated in certain fields for the form to be submitted. This form goes to a php script that opens a database connection, inputs the values as per form submitted, directs to a thank you page and closes the connection. </p>
  
  <p>Its my first hand coded form and my concern is security. How do I keep hackers/spammers at bay? </p>
  
  <p>Can you point out, please, issues with my code so I can address them before I put this live. Please be gentle, Im a newbie with about 3 months of coding experience.</p>
  
  <p>Please note the original form actually has 9 fields but I've omitted it presuming those details wont be necessary for this discussion.</p>
  
  <p>HTML Code</p>
  
  <pre><code>&lt;form class="form-horizontal" method="post" action="vacancy.php"&gt;
    &lt;div class="form-group"&gt;
      &lt;label for="company" class="col-sm-3 control-label"&gt;Company Name *&lt;/label&gt;
        &lt;div class="col-sm-6"&gt;
          &lt;input type="text" name="company" class="form-control" placeholder="Enter Company Name" required /&gt;
        &lt;/div&gt;
    &lt;/div&gt;    
    &lt;div class="form-group"&gt;
      &lt;label for="contactperson" class="col-sm-3 control-label"&gt;Contact Person *&lt;/label&gt;
        &lt;div class="col-sm-6"&gt;
          &lt;input type="text" name="contactperson" class="form-control" placeholder="Enter Full Name" required /&gt;
        &lt;/div&gt;
    &lt;/div&gt;
    &lt;div class="form-group"&gt;
      &lt;label for="designation" class="col-sm-3 control-label"&gt;Designation *&lt;/label&gt;
        &lt;div class="col-sm-6"&gt;
          &lt;input type="text" name="designation" class="form-control" placeholder="Enter Designation" required /&gt;
        &lt;/div&gt;
    &lt;/div&gt;  
    &lt;div class="form-group"&gt;
      &lt;div class="col-sm-offset-3 col-sm-6"&gt;
        &lt;button type="submit" class="btn btn-primary"&gt;Submit&lt;/button&gt;
        &lt;button type="reset" class="btn btn-default"&gt;Clear&lt;/button&gt;
      &lt;/div&gt;
    &lt;/div&gt;
  &lt;/form&gt;
  </code></pre>
  
  <p>PHP Code</p>
  
  <pre><code>&lt;?php
    $con=mysqli_connect("localhost","db2u","password","db2");
      if (mysqli_connect_errno())
       {
        echo "Failed to connect to MySQL: " . mysqli_connect_error();
       }
    $sql="INSERT INTO vacancy (Company, ContactPerson, Designation)
    VALUES
    ('$_POST[company]','$_POST[contactperson]','$_POST[designation]')";
      if (!mysqli_query($con,$sql))
       {
        die('Error: ' . mysqli_error($con));
       }
      header("Location: thankyou.html");
    mysqli_close($con);
  ?&gt;
  </code></pre>
  
  <p>EDIT : So it seems I need validation. Im looking at jqBootstrapValidation. Even considering htmlspecialchars (which ever is easier). I believe both would do an equally good job right? PDO is a bit too much for me at the moment.</p>