Security of code snippets Last time I made a website using PHP, I didn't know of PDO, so someone dropped all my tables. I think I've made an improvement now. I'm sorry if there's a lot to go through, but I want to make sure its safe (most importantly) and also using the best practices.

Here are some snippets:

1)

$form = $_POST;     $name = $form[ 'name' ];    $desc = $form[ 'desc' ]; $link = $form[ 'link' ];   $tag = $form[ 'tag' ];  $category = $form[ 'category' ];

$sql = "INSERT INTO items ( `name`, `desc`, `link`, `tag`, `category` ) VALUES ( :name, :desc, :link, :tag, :category )";

$query = $db-&gt;prepare( $sql );  $query-&gt;execute( array( ':name'=&gt;$name, ':desc'=&gt;$desc, ':link'=&gt;$link, ':tag'=&gt;$tag, ':category'=&gt;$category ) );


2)

$db = new PDO('mysql:host=mywebsite.com;dbname=thisdb;charset=utf8','root', '');


3)

if (isset($_GET['search'])) {
   $searchStmt = $db-&gt;prepare('SELECT * FROM items WHERE tag LIKE    :usersearch'); $searchStmt-&gt;execute(['usersearch' =&gt;    "%".$_GET['search']."%"]);

   foreach ($searchStmt as $row) { ?&gt; &lt;?php    include('includes/results-layout.php'); ?&gt; &lt;?php }} else {    header('Location: http://localhost/photo'); }
   if ($_GET['search'] == "") {     header('Location:    http://mywebsite.com/photo');  }
   if ($searchStmt-&gt;rowCount() === 0) {     echo "Sorry, your search for    &lt;i&gt;\"".$_GET['search']."\"&lt;/i&gt; was not found...";   }


4)

$page1Stmt = $db-&gt;query("SELECT * FROM items WHERE category = 1 ORDER BY id DESC");


5)

$downloadStmt = $db-&gt;prepare('SELECT * FROM items WHERE id = :downloadID'); $downloadStmt-&gt;execute(['downloadID' =&gt; $_GET['id']]); ?&gt; $tags = explode(" ",$row['tag']);
foreach($tags as $tag) {echo "&lt;a href='search.php?search=".$tag."'&gt;&lt;span class='itemTag'&gt;".$tag."&lt;/span&gt;&lt;/a&gt;";} $relatedStmt = $db-&gt;prepare("SELECT * FROM items WHERE tag = (select tag from items where id = :downloadID)");
$relatedStmt-&gt;execute(['downloadID' =&gt; $_GET['id']]); ?&gt;


6)

$pageStmt = $db-&gt;query("SELECT * FROM items ORDER BY id DESC");
foreach ($pageStmt as $row) { ?&gt;
&lt;?php include('includes/results-layout.php'); ?&gt;
&lt;?php } ?&gt;
Okay

All of them


Don't have multiple statements on the same line like that.
Use either spaces or tabs, don't use both.
&lt;?php something; ?&gt; &lt;?php somethingElse; ?&gt; is pointless. Don't do that.
Be consistent. Sometimes you're doing funcName( $param ) and sometimes funcName($param). Pick one and stick with it.


1)


Looks good security wise. See above All of them for improving.


2)


Looks good, but too little information to know. If you haven't already, set PDO::ATTR_ERRMODE to PDO::ERRMODE_EXCEPTION and PDO::ATTR_EMULATE_PREPARES to false. See `PDO::setAttribute().


3)


Sometimes you are redirecting to localhost, sometimes to mywebsite. Use a variable. See $_SERVER.
}} is horrible.


4)


Very good. Queries that don't use parameters don't need to be prepared. Note however that there's a very fine line! Every time you need a variable inside of a query, you want a prepared statement.


5)


You are vulnerable to XSS attacks on your tags. This can be prevented by escaping your tags for HTML output.


6)


Look at the all of them list for details on how to improve.




All in all, you must improve your code-style. Your code is extremely unreadable and will be hard to maintain in the future.

Aside from that one XSS vulnerability, it looks good to me, but again, it's hard to tell just with the code you've given.