title: Trying to avoid sql injection attack - leads to data not being inserted
body: <p>I'm trying to avoid an SQL injection attack and thanks to @Matthew Johnson, I'm nearly there ( I think ).</p>
  
  <p>When I submit the form, the data is not added to my table.  Is there something I am missing in this code? </p>
  
  <p><strong>Why isn't the data inserting into my table?</strong></p>
  
  <pre><code> &lt;?php
  
   if (isset($_POST['submit'])) {
  
   include ('cc_connect.php');
  
   if (!$dbcon) {
  die("Can not Connect: " . mysql_error());
  
  }
  
  mysql_select_db("cooperstown",$dbcon);
  
  $first_name = isset($_POST['first_name']) ? $_POST['first_name'] : '';
  $last_name = isset($_POST['last_name']) ? $_POST['last_name'] : '';
  $street = isset($_POST['street']) ? $_POST['street'] : '';
  $city = isset($_POST['city']) ? $_POST['city'] : '';
  $state = isset($_POST['state']) ? $_POST['state'] : '';
  $zip = isset($_POST['zip']) ? $_POST['zip'] : '';
  $home_phone = isset($_POST['home_phone']) ? $_POST['home_phone'] : '';
  $email = isset($_POST['email']) ? $_POST['email'] : '';
  $birth_month = isset($_POST['birth_month']) ? $_POST['birth_month'] : '';
  $birth_day = isset($_POST['birth_day']) ? $_POST['birth_day'] : '';
  $birth_year = isset($_POST['birth_year']) ? $_POST['birth_year'] : '';
  $grade = isset($_POST['grade']) ? $_POST['grade'] : '';
  $school = isset($_POST['school']) ? $_POST['school'] : '';
  $tryout_date = isset($_POST['tryout_date']) ? $_POST['tryout_date'] : '';
  $guard1_first_name = isset($_POST['guard1_first_name']) ? $_POST['guard1_first_name'] : '';
  $guard1_last_name = isset($_POST['guard1_last_name']) ? $_POST['guard1_last_name'] : '';
  $guard1_email = isset($_POST['guard1_email']) ? $_POST['guard1_email'] : '';
  $guard1_phone = isset($_POST['guard1_phone']) ? $_POST['guard1_phone'] : '';
  $guard1_cell = isset($_POST['guard1_cell']) ? $_POST['guard1_cell'] : '';
  $guard2_first_name = isset($_POST['guard2_first_name']) ? $_POST['guard2_first_name'] : '';
  $guard2_last_name = isset($_POST['guard2_last_name']) ? $_POST['guard2_last_name'] : '';
  $guard2_email = isset($_POST['guard2_email']) ? $_POST['guard2_email'] : '';
  $guard2_phone = isset($_POST['guard2_phone']) ? $_POST['guard2_phone'] : '';
  $guard2_cell = isset($_POST['guard2_cell']) ? $_POST['guard2_cell'] : '';
  
  
  if ($first_name &amp;&amp; $last_name &amp;&amp; $street &amp;&amp; $city &amp;&amp; $state &amp;&amp; $zip &amp;&amp; $home_phone &amp;&amp; $email &amp;&amp; $birth_month &amp;&amp; $birth_day &amp;&amp; $birth_year &amp;&amp; $grade &amp;&amp; $school &amp;&amp; $tryout_date &amp;&amp; $guard1_first_name &amp;&amp; $guard1_last_name &amp;&amp; $guard1_email &amp;&amp; $guard1_phone &amp;&amp; $guard1_cell &amp;&amp; $guard2_first_name &amp;&amp; $guard2_last_name &amp;&amp; $guard2_email &amp;&amp; $guard2_phone &amp;&amp; $guard2_cell) {
  
  $stmt = $mysqli-&gt;prepare("INSERT INTO cobra_registration (first_name,last_name,street,city,state,zip,home_phone,email,birth_month,birth_day,birth_year,grade,school,tryout_date,guard1_first_name,guard1_last_name,guard1_email,guard1_phone,guard1_cell,guard2_first_name,guard2_last_name,guard2_email,guard2_phone,guard2_cell) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)");
  $stmt-&gt;bind_param("sssssiisiiiisssssiisssii", $first_name, $last_name, $street, $city, $state, $zip, $home_phone, $email, $birth_month, $birth_day, $birth_year, $grade, $school, $tryout_date, $guard1_first_name, $guard1_last_name, $guard1_email, $guard1_phone, $guard1_cell, $guard2_first_name, $guard2_last_name, $guard2_email, $guard2_phone, $guard2_cell)
  $stmt-&gt;execute();
  }
  
  
  }
  
  ?&gt; 
  </code></pre>