convert into bind_param type
<p>I'm still new on php  bind_param and i'm wandering how to convert this (search) part of the script to avoid sql injection?
And i'm  still stuck (actually do not know what to do with this: </p>

<pre><code> $rest.="where name like '%".$name."%'";
 $rest.="where country='".$country."' 
 $rest.="where ip = '".$ip."'   
</code></pre>

<p>////////////////////////////////////////////////////////////////////////////
    

<pre><code>  $name = $_POST['name'];  
  $country = $_POST['country']; 
  $ip = $_POST['ip']; 
  $o="AND";
  $rest="";
  $text="Search Keywords : ";                    
                     if($name!="")
                     {
                        if($rest=="")
                            {
                         $rest.="where name like '%".$name."%'";
                         $text.="Name like ".$name." ";
                         }
                         else {
                         $rest.="$o name like '%".$name."%'";
                         $text.="Name like ".$name." ";
                         }
                     }           
                     if($country!="")
                     {
                        if($rest=="")
                            {
                            $rest.="where country='".$country."' ";
                            $text.="Country = ".$country."";
                            }
                            else
                            {
                            $rest.=" $o country='".$country."' ";
                            $text.=", Country = ".$country."";
                            }
                     }                           
                      if($ip!="")
                     {
                        if($rest=="")
                            {
                                $rest.="where ip = '".$ip."' ";
                                $text.="Ip Address = ".$ip." ";
                            }
                            else
                            {
                            $rest.=" $o  ip = '".$ip."' ";
                            $text.=", Ip Address = ".$ip." ";
                            }
                     }
                    if($rest!="")
                    {
                    $rest=$rest;
                    }
                    else
                    {

                    } 
$stmt = $mysqli-&gt;prepare("select $search.* from $search $rest order by id"); 
$stmt-&gt;execute(); 
$stmt-&gt;store_result();
$num = $stmt-&gt;num_rows;
</code></pre>
