title: convert into bind_param type
body: <p>I'm still new on php  bind_param and i'm wandering how to convert this (search) part of the script to avoid sql injection?
  And i'm  still stuck (actually do not know what to do with this: </p>
  
  <pre><code> $rest.="where name like '%".$name."%'";
   $rest.="where country='".$country."' 
   $rest.="where ip = '".$ip."'   
  </code></pre>
  
  <p>////////////////////////////////////////////////////////////////////////////
      
  
  <pre><code>  $name = $_POST['name'];  
    $country = $_POST['country']; 
    $ip = $_POST['ip']; 
    $o="AND";
    $rest="";
    $text="Search Keywords : ";                    
                       if($name!="")
                       {
                          if($rest=="")
                              {
                           $rest.="where name like '%".$name."%'";
                           $text.="Name like ".$name." ";
                           }
                           else {
                           $rest.="$o name like '%".$name."%'";
                           $text.="Name like ".$name." ";
                           }
                       }           
                       if($country!="")
                       {
                          if($rest=="")
                              {
                              $rest.="where country='".$country."' ";
                              $text.="Country = ".$country."";
                              }
                              else
                              {
                              $rest.=" $o country='".$country."' ";
                              $text.=", Country = ".$country."";
                              }
                       }                           
                        if($ip!="")
                       {
                          if($rest=="")
                              {
                                  $rest.="where ip = '".$ip."' ";
                                  $text.="Ip Address = ".$ip." ";
                              }
                              else
                              {
                              $rest.=" $o  ip = '".$ip."' ";
                              $text.=", Ip Address = ".$ip." ";
                              }
                       }
                      if($rest!="")
                      {
                      $rest=$rest;
                      }
                      else
                      {
  
                      } 
  $stmt = $mysqli-&gt;prepare("select $search.* from $search $rest order by id"); 
  $stmt-&gt;execute(); 
  $stmt-&gt;store_result();
  $num = $stmt-&gt;num_rows;
  </code></pre>