db.php

<?php

// Define the connection variables.
$dbHost = "localhost";
$dbUser = "root";
$dbPass = "";
$dbName = null;

// Connect to the database.
$conn = new mysqli($dbHost, $dbUser, $dbPass);

if($conn -> connect_errno != 0) {
	die("Failed to connect to database: " . $conn -> connect_error);
}

// Prepare the statement to be executed.
// This send the data separately to the query itself, so as to avoid SQL injection attacks.
$query = $conn -> prepare("INSERT INTO orders (first, second, size, color) VALUES (?, ?, ?, ?)");
$query -> bind_param("ssss", $_POST["first"], $_POST["second"], $_POST["size"], $_POST["color"]);
if($query -> execute()) {
	echo "Query executed.";
	$query -> close();
	$conn -> close();
} else {
	echo "Failed to execute query: " . $query -> error;
	$query -> close();
	$conn -> close();
	die();
}

?>