process_contact.php

<?php

if (!empty($_POST)) {
    //$msg = array();
    $msg = '';


    if (empty($_POST['nm']) || empty($_POST['email']) || empty($_POST['query'])) {
        //$msg[] = "Please fill up everything";
        $msg = '<p style="color:red;font-size: 23px; font-weight: bold;">Please fill up everything</p>';
    }


    /*if($_SESSION['unm'] != $_POST['nm'])
    {
        $msg .= '<p style="color:red;font-size: 23px; font-weight: bold;">Please enter your username.</p>';
    }*/

    if (is_numeric($_POST['nm'])) {
        //$msg[] = "Name must be in String Format...";
        $msg .= '<p style="color:red;font-size: 23px; font-weight: bold;">Name must be in String Format.</p>';
    }

    if (is_numeric($_POST['email'])) {
        //$msg[] = "Email must be in appropriate format(ex : someone@gmail.com)...";
        $msg .= '<p style="color:red;font-size: 23px; font-weight: bold;">Email must be in appropriate format(ex : someone@gmail.com).</p>';
    }


    if (!empty($msg)) {
        header("location:contact.php?errorforcontact=".$msg);
    } else {
        $nm = $_POST['nm'];
        $email = $_POST['email'];
        $question = $_POST['query'];


        $db = new mysqli("localhost", "root", "", "matrixmp_cent_db") or die("Can't Connect to database");
        //with prepare statement//
        $sql = 'INSERT INTO contact(con_nm,con_email,con_query)
        VALUES(?, ?,?)';
        $statement = $db->prepare($sql);
        $statement->bind_param("sss", $nm, $email, $question);
        $statement->execute();
        $statement->close();
        $db->close();

        //prepare statement ends here

        /*$query = "insert into contact(con_nm,con_email,con_query)
			values('$nm','$email','$question')";

        $db->query($query) or die("Can't Execute Query...");*/

        header("location:contact.php?okcontact=1");
    }
} else {
    header("location:index.php");
}
?>