How secure is it to implement a search function in a website that retrieves data from a database?

When implementing a search function in a website that retrieves data from a database, it is important to ensure the security of the search functionality to prevent SQL injection attacks. One way to do this is by using prepared statements with parameterized queries to sanitize user input before executing the query. 

// Establish database connection
$servername = "localhost";
$username = "username";
$password = "password";
$dbname = "database";

$conn = new mysqli($servername, $username, $password, $dbname);

// Check connection
if ($conn->connect_error) {
    die("Connection failed: " . $conn->connect_error);
}

// Retrieve search term from user input
$searchTerm = $_GET['search'];

// Prepare and execute a parameterized query
$stmt = $conn->prepare("SELECT * FROM table WHERE column LIKE ?");
$stmt->bind_param("s", $searchTerm);
$stmt->execute();

// Process and display search results
$result = $stmt->get_result();
while ($row = $result->fetch_assoc()) {
    echo $row['column'] . "<br>";
}

// Close statement and connection
$stmt->close();
$conn->close();

Keywords

SQL injection prepared statements data validation cross-site scripting encryption

Related Questions