Krdytkyu

I have a live search project and I don't know if it's secure enough or not. I don't access it directly, but I get data by JSON so I shouldn't worry about slashes or quotes, right?

The PHP code:

<?php

if (isset($it_server)) {

    class search{

        public function gettingvalues($search_value){

            require_once('db_conx.php');

            $dir = "usersimage/";

            $search_value = htmlspecialchars($search_value,ENT_QUOTES,'UTF-8');

            $sql = "SELECT name,img,username FROM users WHERE username like '$search_value%' || name like '$search_value%'";

            $query = mysqli_query($conx,$sql);

            if ($query) {

                if (mysqli_num_rows($query) > 0) {

                    while ($row = mysqli_fetch_array($query)) {

                        $img = $row['img'];

                        $name = $row['name'];

                        $username = $row['username'];

                        $json = array('img' => $img, 'name' => $name, 'username' => $username);

                        $results = $json;

                    }

                    echo json_encode($results);

                }else{

                    $json['name'] = '';

                    $json['img'] = '';

                    $json['username'] = '';

                    $json['error'] = 'No results.';

                    $results = $json;

                    echo json_encode($results);

                }

            }else{

                $json['name'] = '';

                $json['img'] = '';

                $json['username'] = '';

                $json['error'] = "There's a problem, please try later!";

                $results = $json;

                echo json_encode($results);

            }

        }

    }

}else{

    header('location: 404');

    die();

}

?>

I call the function from index.php:

<?php

    $its_server = 'yes';

    if (isset($_POST['data'])) {

        require('search.php');

        $search = new search;

        $search->gettingvalues($_POST['data']);

        header('Content-Type: application/json; charset=utf-8');

        die();

    }

?>

<script src="https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js"></script>

<script type="text/javascript">

    $(document).ready(function(){

        $('input').keyup(function(){

            var value= $('input').val();

            $.ajax({

                type: "POST",

                url: "",

                data: {data: value},

                datatype: "json",

                success: function(json_data) {

                    var img = ;

                    var username = ;

                    var name = ;

                    var html = '';

                    $.each(json_data, function(index, e) {

                        if (e.error) {

                            html += `${e.error}`;

                        }else{

                            html += `${e.name} ${e.username} ${e.img}<br>`;

                        }

                    })

                    $("#feedback").html(html);

                }

            })

        });

    });

</script>

<input type="text" name="search" placeholder="looking for?">

<div id="feedback"></div>

I don't know if I'm doing well with security or not and it's a big deal to me. So what you see from 1-10, how secure is my page?

One quite big security issue I see here is your vulnerability to SQL-Injection attacks. Even when you use htmlspecialchars(), there are still some ways to circumvent it, as shown in Is htmlspecialchars enough to prevent an SQL injection on a variable enclosed in single quotes?.

Basically, you are allowing the user to directly manipulate the SQL-Query, which has to be prevented. For this case, there are Prepared Statements, which - if used correctly - will prevent the user from doing anything nasty with your database. There is an answer to How can I prevent SQL injection in PHP? regarding this topic, so I suggest you read and understand that.

Also, you might have a look at the manual to learn more about prepared statements using either mysqli or PDO.