Confirming safety of SQL injection I believe with everyone's help on Stack Overflow, I got my code safe guarded from SQL injection. I'm trying to confirm that is correct, just in case I misinterpreted the help and advice I received.

&lt;?php
$username = "xxxx";
$password = "xxxx"; 
?&gt;

&lt;font size="+3" face="Verdana"&gt;xxxx&lt;/font&gt;
&lt;br&gt;&lt;br&gt;
&lt;form name="form" action="xxxx.php" method="get"&gt;
&lt;input type="text" name="q" size="60" /&gt;
&lt;input type="submit" name="Submit" value="Search"&gt;
&lt;/form&gt;

&lt;table&gt;

&lt;?

$var = $_GET['q'];

try {
$conn = new PDO('mysql:host=localhost;dbname=xxxx', $username, $password);
$stmt = $conn-&gt;prepare("SELECT * FROM xxxx WHERE xxxx LIKE :search");
$stmt-&gt;execute(array(':search' =&gt; '%'.$var.'%'));

$result = $stmt-&gt;fetchAll();

if ( count($result) ) {
foreach($result as $row) {
echo "&lt;tr&gt;&lt;td align=center width=100&gt;" 
. $row['xxxx'] .
"&lt;/td&gt;&lt;td align=center width=100&gt;"
. $row['xxxx'] .
"&lt;/td&gt;&lt;td align=center width=100&gt;"
. $row['xxxx'] .
"&lt;/td&gt;&lt;td align=center width=100&gt;"
. $row['xxxx'] .
"&lt;/td&gt;&lt;td align=center width=100&gt;&lt;img src=http://www.xxx.com/"
. $row['image'] . " height=50&gt;" .
"&lt;/td&gt;&lt;td align=left width=500&gt;http://www.xxx.com/" . $row['image'] . "&lt;/a&gt;
&lt;/td&gt;&lt;td align=center valign=middle width=100&gt;
&lt;form action=xxx.php method=POST&gt;
&lt;input type=hidden value=" . $row['id'] . " name=edit&gt;
&lt;input type=image src=http://www.xxx.com/images/edit.png height=30&gt;
&lt;/form&gt;
&lt;/td&gt;&lt;td align=center valign=middle width=100&gt;      &lt;form action=xxx.php    
method=POST&gt;
&lt;input type=hidden value=" . $row['id'] . " name=delete&gt;
&lt;input type=image src=http://www.xxx.com/images/delete.png height=30&gt;
&lt;/form&gt;
&lt;/td&gt;&lt;/tr&gt;";  
}  
} 
else {
echo "No results found.";
}
} 
catch(PDOException $e) {
echo 'ERROR: ' . $e-&gt;getMessage();
}
?&gt;
&lt;/table&gt;
You should not mix PHP logic and HTML. All logic should be placed on top of the document and HTML (+ some minor PHP loops/echos/ifs) below it;
$var = $_GET['q']; is unneeded and you loose memory;
never use the shorttag (&lt;?);
You forgot to set the errormode for PDO, that means it doesn't throw exceptions. To set it, use PDO::setAttribute:

$pdo-&gt;setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);

I do not recommend to use * in your queries. The query will be faster and easier to use if you specify which columns you want;
You should specify the fetch style of PDOStatement::fetchAll. Otherwise it defaults to PDO::FETCH_BOTH, which means your array get to big and your script slower. You can specify it with a parameter in the function:

$stmt-&gt;fetchAll(PDO::FETCH_ASSOC);


Or specify it for the PDOstatement:

$stmt-&gt;setFetchMode(PDO::FETCH_ASSOC);

A small tip: Indent your code within each block with a tab or 4 spaces, that makes your code much easier to read. Also, choose a coding standard and use it everywhere. Consistent scripts are a pleasure to write, read and use!


Some none PDO/PHP things:


The &lt;font&gt; element is outdated. You should do this with CSS;
You should not use inline CSS (like style=, align=, width=), put it in a CSS stylesheet instead;
When you are using 2 &lt;br&gt; next to eachother, you almost always know you do something wrong and you should take a look at how to solve it with CSS margins/paddings.