Confirming safety of SQL injection
You should not mix PHP logic and HTML. All logic should be placed on top of the document and HTML (+ some minor PHP loops/echos/ifs) below it;
$var = $_GET['q']; is unneeded and you loose memory;
never use the shorttag (&lt;?);
You forgot to set the errormode for PDO, that means it doesn't throw exceptions. To set it, use PDO::setAttribute:

$pdo-&gt;setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);

I do not recommend to use * in your queries. The query will be faster and easier to use if you specify which columns you want;
You should specify the fetch style of PDOStatement::fetchAll. Otherwise it defaults to PDO::FETCH_BOTH, which means your array get to big and your script slower. You can specify it with a parameter in the function:

$stmt-&gt;fetchAll(PDO::FETCH_ASSOC);


Or specify it for the PDOstatement:

$stmt-&gt;setFetchMode(PDO::FETCH_ASSOC);

A small tip: Indent your code within each block with a tab or 4 spaces, that makes your code much easier to read. Also, choose a coding standard and use it everywhere. Consistent scripts are a pleasure to write, read and use!


Some none PDO/PHP things:


The &lt;font&gt; element is outdated. You should do this with CSS;
You should not use inline CSS (like style=, align=, width=), put it in a CSS stylesheet instead;
When you are using 2 &lt;br&gt; next to eachother, you almost always know you do something wrong and you should take a look at how to solve it with CSS margins/paddings.