la mia tabella è caduta in PDO [chiuso]

Questo è il mio metodo PDO ho usato questo metodo per salvare il valore di input in SQL Dopo aver letto questo istruzioni pdo-prepared-enough-to-prevent-sql-injection Da quando ho iniziato a imparare PHP non so che questo proteggerà la forma Iniezione SQL

codice

    <?php

$db_username = 'sanoj';
$db_password = '123456';
$newname = md5(rand() * time());
if (isset($_FILES['files'])) {
    $uploadedFiles = array();
    foreach ($_FILES['files']['tmp_name'] as $key => $tmp_name) {
        $errors = array();
        $file_name = md5(uniqid("") . time());
        $file_size = $_FILES['files']['size'][$key];
        $file_tmp = $_FILES['files']['tmp_name'][$key];
        $file_type = $_FILES['files']['type'][$key];

        if ($file_type == "image/gif") {
            $sExt = ".gif";
        } elseif ($file_type == "image/jpeg" || $file_type == "image/pjpeg") {
            $sExt = ".jpg";
        } elseif ($file_type == "image/png" || $file_type == "image/x-png") {
            $sExt = ".png";
        }
        if (!in_array($sExt, array('.gif', '.jpg', '.png'))) {
            $errors[] = "Image types alowed are (.gif, .jpg, .png) only!";
        }
        if ($file_size > 2097152000) {
            $errors[] = 'File size must be less than 2 MB';
        }
        $desired_dir = "user_data/";
        if (empty($errors)) {
            if (is_dir($desired_dir) == false) {
                mkdir("$desired_dir", 0700);        // Create directory if it does not exist
            }
            if (move_uploaded_file($file_tmp, "$desired_dir/" . $file_name . $sExt)) {
                $uploadedFiles[$key] = array($file_name . $sExt, 1);
            } else {
                echo "Couldn't upload file " . $_FILES['files']['name'][$key];
                $uploadedFiles[$key] = array($_FILES['files']['name'][$key], 0);
            }
        } else {

        }
    }

    foreach ($uploadedFiles as $key => $row) {
        if (!empty($row[1])) {
            $codestr = '$file' . ($key + 1) . ' = $row[0];';
            eval($codestr);
        } else {
            $codestr = '$file' . ($key + 1) . ' = NULL;';
            eval($codestr);
        }
    }
}
$orig_directory = "$desired_dir";    //Full image folder
$thumb_directory = "thumb/";    //Thumbnail folder

/* Opening the thumbnail directory and looping through all the thumbs: */
$dir_handle = @opendir($orig_directory); //Open Full image dirrectory
if ($dir_handle > 1) { //Check to make sure the folder opened
    $allowed_types = array('jpg', 'jpeg', 'gif', 'png');
    $file_type = array();
    $ext = '';
    $title = '';
    $i = 0;

    while ($file_name = @readdir($dir_handle)) {
        /* Skipping the system files: */
        if ($file_name == '.' || $file_name == '..')
            continue;

        $file_type = explode('.', $file_name);    //This gets the file name of the images
        $ext = strtolower(array_pop($file_type));

        /* Using the file name (withouth the extension) as a image title: */
        $title = implode('.', $file_type);
        $title = htmlspecialchars($title);

        /* If the file extension is allowed: */
        if (in_array($ext, $allowed_types)) {

            /* If you would like to inpute images into a database, do your mysql query here */

            /* The code past here is the code at the start of the tutorial */
            /* Outputting each image: */

            $nw = 100;
            $nh = 100;
            $source = "$desired_dir{$file_name}";
            $stype = explode(".", $source);
            $stype = $stype[count($stype) - 1];
            $dest = "thumb/{$file_name}";

            $size = getimagesize($source);
            $w = $size[0];
            $h = $size[1];

            switch ($stype) {
                case 'gif':
                    $simg = imagecreatefromgif($source);
                    break;
                case 'jpg':
                    $simg = imagecreatefromjpeg($source);
                    break;
                case 'png':
                    $simg = imagecreatefrompng($source);
                    break;
            }

            $dimg = resizePreservingAspectRatio($simg, $nw, $nh);
            imagepng($dimg, $dest);
        }
    }

    /* Closing the directory */
    @closedir($dir_handle);
}

try {
#connection 
    $conn = new PDO('mysql:host=localhost;dbname=localtest', $db_username, $db_password);
    $conn->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
    $data = $conn->prepare('INSERT INTO agriculture (cacat, mtype, mtitle, image1, image2, image3, image4, image5, description, mcondition, cmodel, price, youare, mname, email, phone, ylocation, ystreet) VALUES (:cacat, :mtype, :mtitle, :image1, :image2, :image3, :image4, :image5, :description, :mcondition, :cmodel, :price, :youare, :mname, :email, :phone, :ylocation, :ystreet)');
    $cacat = filter_input(INPUT_POST, 'cacat', FILTER_SANITIZE_STRING, FILTER_FLAG_ENCODE_AMP);
    $mtype = filter_input(INPUT_POST, 'mtype', FILTER_SANITIZE_STRING, FILTER_FLAG_ENCODE_AMP);
    $mtitle = filter_input(INPUT_POST, 'mtitle', FILTER_SANITIZE_STRING, FILTER_FLAG_ENCODE_AMP);
    $description = filter_input(INPUT_POST, 'description', FILTER_SANITIZE_STRING, FILTER_FLAG_ENCODE_AMP);
    $mcondition = filter_input(INPUT_POST, 'mcondition', FILTER_SANITIZE_STRING, FILTER_FLAG_ENCODE_AMP);
    $cmodel = filter_input(INPUT_POST, 'cmodel', FILTER_SANITIZE_STRING, FILTER_FLAG_ENCODE_AMP);
    $price = filter_input(INPUT_POST, 'price', FILTER_SANITIZE_STRING, FILTER_FLAG_ENCODE_AMP);
    $youare = filter_input(INPUT_POST, 'youare', FILTER_SANITIZE_STRING, FILTER_FLAG_ENCODE_AMP);
    $mname = filter_input(INPUT_POST, 'mname', FILTER_SANITIZE_STRING, FILTER_FLAG_ENCODE_AMP);
    $email = filter_input(INPUT_POST, 'email', FILTER_SANITIZE_STRING, FILTER_FLAG_ENCODE_AMP);
    $phone = filter_input(INPUT_POST, 'phone', FILTER_SANITIZE_STRING, FILTER_FLAG_ENCODE_AMP);
    $ylocation = filter_input(INPUT_POST, 'ylocation', FILTER_SANITIZE_STRING, FILTER_FLAG_ENCODE_AMP);
    $ystreet = filter_input(INPUT_POST, 'ystreet', FILTER_SANITIZE_STRING, FILTER_FLAG_ENCODE_AMP);
    $data->execute(array(':cacat' => $cacat,
        ':mtype' => $mtype,
        ':mtitle' => $mtitle,
        'image1' => $file1,
        'image2' => $file2,
        'image3' => $file3,
        'image4' => $file4,
        'image5' => $file5, ':description' => $description, ':mcondition' => $mcondition, ':cmodel' => $cmodel, ':price' => $price, ':youare' => $youare, ':mname' => $mname, ':email' => $email, ':phone' => $phone, ':ylocation' => $ylocation, ':ystreet' => $ystreet));
#exception handiling
} catch (PDOException $e) {
    echo $e->getMessage();
}

function resizePreservingAspectRatio($img, $targetWidth, $targetHeight) {
    $srcWidth = imagesx($img);
    $srcHeight = imagesy($img);

    // Determine new width / height preserving aspect ratio
    $srcRatio = $srcWidth / $srcHeight;
    $targetRatio = $targetWidth / $targetHeight;
    if (($srcWidth <= $targetWidth) && ($srcHeight <= $targetHeight)) {
        $imgTargetWidth = $srcWidth;
        $imgTargetHeight = $srcHeight;
    } else if ($targetRatio > $srcRatio) {
        $imgTargetWidth = (int) ($targetHeight * $srcRatio);
        $imgTargetHeight = $targetHeight;
    } else {
        $imgTargetWidth = $targetWidth;
        $imgTargetHeight = (int) ($targetWidth / $srcRatio);
    }

    // Creating new image with desired size
    $targetImg = imagecreatetruecolor($targetWidth, $targetHeight);

    // Add transparency if your reduced image does not fit with the new size
    $targetTransparent = imagecolorallocate($targetImg, 255, 0, 255);
    imagefill($targetImg, 0, 0, $targetTransparent);
    imagecolortransparent($targetImg, $targetTransparent);

    // Copies image, centered to the new one (if it does not fit to it)
    imagecopyresampled($targetImg, $img, 0, 0, 0, 0, $targetWidth, $targetHeight, $srcWidth, $srcHeight);

    return $targetImg;
}

?>

esperti hanno detto che c'è un problema di sicurezza durante il caricamento dell'immagine basename
Qualcuno può aiutarmi a proteggerlo dall'iniezione SQL