I'm trying to create a secure website. Can someone let me know if this is susceptible to SQL injection? If it is, could you provide me with an exmaple of a statement that would work for injection? I've tried to inject it myself but my connection just times out. Thanks.
$db = new PDO("mysql:host=$dbhost;dbname=$dbname", $dbuser, $dbpass); $db->query("INSERT INTO Name(Name) VALUES ('$firstname')");