Keyword Search with PHP PDO and MySQL

A keyword-search form usually needs two separate jobs: convert visitor text into search terms, then execute a safe SQL query. The SQL should never be built by concatenating raw visitor input directly into the statement.

Demo of Keyword Search

This example uses PHP trim functions, string splitting, loops and PDO. For result presentation, see displaying MySQL data and pagination.

Normalize the search text

$searchText = trim($searchText);

Split multiple keywords

$keywords = preg_split('/\s+/', $searchText, -1, PREG_SPLIT_NO_EMPTY);

The loop replaces the old removed each() pattern with foreach; see the PHP condition, substring, and string length tutorials for the related operations.

Build LIKE conditions and parameters

$conditions = [];
$params = [];
foreach ($keywords as $i => $word) {
    $name = ':kw' . $i;
    $conditions[] = 'name LIKE ' . $name;
    $params[$name] = '%' . $word . '%';
}
$sql = 'SELECT * FROM student WHERE ' . implode(' OR ', $conditions);

Each keyword receives its own named placeholder. The wildcard characters are added to the parameter value, not injected into SQL syntax.

Exact-match search

$stmt = $dbo->prepare('SELECT * FROM student WHERE name = :name');
$stmt->execute([':name' => $searchText]);

Complete PDO example

<?php
require &#x27;config.php';

$searchText = trim($_POST[&#x27;search_text'] ?? '');
$type = $_POST[&#x27;type'] ?? 'any';
$rows = [];

if ($searchText !== &#x27;') {
    if ($type === &#x27;exact') {
        $stmt = $dbo->prepare(&#x27;SELECT * FROM student WHERE name = :name');
        $stmt->execute([&#x27;:name' => $searchText]);
    } else {
        $keywords = preg_split(&#x27;/\s+/', $searchText, -1, PREG_SPLIT_NO_EMPTY);
        $conditions = [];
        $params = [];

        foreach ($keywords as $i => $word) {
            $name = &#x27;:kw' . $i;
            $conditions[] = &#x27;name LIKE ' . $name;
            $params[$name] = &#x27;%' . $word . '%';
        }

        if ($conditions) {
            $sql = &#x27;SELECT * FROM student WHERE ' . implode(' OR ', $conditions);
            $stmt = $dbo->prepare($sql);
            $stmt->execute($params);
        }
    }

    if (isset($stmt)) {
        $rows = $stmt->fetchAll(PDO::FETCH_ASSOC);
    }
}
?>

This replaces the older string-concatenation approach and avoids SQL injection while preserving the original exact-match versus match-anywhere behavior.

AJAX keyword search with MySQL

Download the original keyword-search package

Subhendu Mohapatra

Author & Instructor at plus2net

I write and maintain practical tutorials on Python, PHP, SQL, JavaScript, HTML, jQuery, and web development at plus2net. The tutorials focus on clear explanations, working examples, and code that readers can test and adapt while learning.

About the author   Watch on YouTube

Connect: