Update your insert statements to use $dbc->prepare() and bound variables