Question: I have a basic website in PHP that is a search engine and run's off a mysql database but I need to protect it from sql injections can someone explain to me how I can do this?

My PHP script:

```
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>Search Engine - Search</title>
</head>
<body>

<h2>Search Engine</h2>
<form action='./search.php' method='get'>
<input type='text' name='k' size='50' value='<?php echo $_GET['k']; ?>' />
<input type='submit' value='Search'>
</form>
<hr />
<?php
$k = $_GET['k'];

$terms = explode (" ", $k);
$query = "SELECT * FROM search WHERE ";

foreach ($terms as $each) {
$i++;

if ($i == 1)
$query .= "keywords LIKE '%$each%' ";
else
$query .= "OR keywords LIKE '%$each%' ";
}

// connect
mysql_connect("*******", "******", "*******");
mysql_select_db(*******);

$query = mysql_query("$query");
$numrows = mysql_num_rows($query);
if ($numrows > 0) {

while ($row = mysql_fetch_assoc($query)) {
$id = $row['id'];
$title = $row['title'];
$description = $row['description'];
$keywords = $row['keywords'];
$link = $row['link'];

echo "<h2><a href='$link'>$title</a></h2>
$description<br /><br />";
}

}
else
echo "No results found for \"<b>$k</b>\"";

// disconnect
mysql_close();

?>
</body>
</html>

```

Answer: 
The PHP documentation has an article about this, [see here](http://php.net/manual/en/security.database.sql-injection.php).

Using the [mysqli](http://php.net/manual/en/book.mysqli.php) library over mysql is an even better idea, since it supports prepared statements and does the escaping mostly for you.
As always, [the manual](http://php.net/manual/en/security.database.sql-injection.php) is a very good place to start. Read the article, it includes various examples and relevant techniques. 

The gist of it is that you should never trust user input, and user input includes everything that comes from the environment, including `$_GET`, `$_POST`, `$_COOKIE`, `$_SESSION`, even ``$_SERVER`. 

In your code you blindly trust:

```
$k = $_GET['k'];

```

and use its contents as is in your queries: 

```
if ($i == 1)
$query .= "keywords LIKE '%$each%' ";
else
$query .= "OR keywords LIKE '%$each%' ";
}

```

**Never do that again**. 

You need to validate that user input is what you expect it to be, and sanitize it before you use it in SQL queries. You can easily do both with the [Filter](http://www.php.net/manual/en/intro.filter.php) functions.

Additionally you should really forget about `mysql_*` functions, they are [*essentially* deprecated](http://www.php.net/manual/en/mysqlinfo.api.choosing.php), the extension's development status is maintenance only and [long term deprecation was announced recently](http://news.php.net/php.internals/53799). Instead you should move on to the [`mysqli_*` functions](http://php.net/manual/en/book.mysqli.php) (notice the i at the end? it stands for *improved*).

But I would suggest you skip those as well, and start using [PDO](http://www.php.net/manual/en/book.pdo.php) and [prepared statements](http://php.net/manual/en/pdo.prepared-statements.php). PDO offers a database agnostic object oriented interface and prepared statements sanitize your variables for you.

That's about it.