What are common mistakes to avoid when creating a search form in PHP?

One common mistake to avoid when creating a search form in PHP is not properly sanitizing user input, which can lead to security vulnerabilities such as SQL injection attacks. To solve this issue, always use prepared statements or parameterized queries when interacting with a database to prevent malicious input. 

// Example of using prepared statements to sanitize user input in a search form
$searchTerm = $_GET['searchTerm'];

// Establish a database connection
$pdo = new PDO('mysql:host=localhost;dbname=database', 'username', 'password');

// Prepare a SQL statement with a placeholder
$stmt = $pdo->prepare("SELECT * FROM table WHERE column LIKE :searchTerm");

// Bind the sanitized search term to the placeholder
$stmt->bindValue(':searchTerm', "%$searchTerm%", PDO::PARAM_STR);

// Execute the statement
$stmt->execute();

// Fetch the results
$results = $stmt->fetchAll();

Keywords

validation SQL injection XSS attacks form submission error handling

Related Questions