cv-plsphp qualifies for SOCVR attention because of NATO; the OP didn't realize that they were feeding an empty value from
$_POST
element; the page could also be closed with many duplicates like how to protect against sql injection attacks and how to use a prepared statement with PDO.
stackoverflow.com/q/53650611/2943403