Where can there be an error in the request?

Question

PHP

Hey! There is such a POST processing:

if ( $_POST["func"] == "AddNewPerson" )
{

 if (isset($_POST['fio'])) { $fio = $_POST['fio'];  if ($fio == '')  unset($fio); }
 if (isset($_POST['pn']))  { $pn  = $_POST['pn'];   if ($pn  == '')  unset($pn);  }
 if (isset($_POST['vt']))  { $vt  = $_POST['vt'];   if ($vt  == '')  unset($vt);  }
 if (isset($_POST['sr']))  { $sr  = $_POST['sr'];   if ($sr  == '')  unset($sr);  }
 if (isset($_POST['cht'])) { $cht = $_POST['cht'];  if ($cht == '')  unset($cht); }
 if (isset($_POST['pt']))  { $pt  = $_POST['pt'];   if ($pt  == '')  unset($pt);  }
 if (isset($_POST['sb']))  { $sb  = $_POST['sb'];   if ($sb  == '')  unset($sb);  }
 if (isset($_POST['vs']))  { $vs  = $_POST['vs'];   if ($vs  == '')  unset($vs);  }

 $user_id = $_SESSION["user_id"];

 // id, fio, pn, vt, sr, cht, pt, sb, vs, user_id, group_id, data_reg
 $result = $mysqli->query("INSERT INTO personal VALUES ( NULL,'".$fio."','".$pn."','".$vt."','".$sr."','".$cht."','".$pt."','".$sb."','".$vs."','".$user_id."',154,'",GETDATE(),"')" );
 if (!$result) error($mysqli->error);
 
 $result->free();
 $result->close();
 $mysqli->close();
}

Data does not come to the table, Mysql does not return an error. Where can be an error?

Answer 1

The mistake is that you do not provide the SQL query code that actually goes into the database.

Answer 2

Preparing a query and filtering variables? No, I haven't heard...
php.net/manual/ru/mysqli.prepare.php is for mysqli . Life will become easier) And then maybe you will switch to PDO :)

Answer 3

And you are not embarrassed that if, say, $_POST['vs'] does not come , then you will not have a $vs variable .
And below in the code you refer to it ( $vs ). This is Notice - Undefined variable and uncontrolled behavior.
Besides you directly in a request body push input from POST. This is the direct path to SQL injection.