php - Parse error: syntax error, unexpected '%', search a database injection proof -

i need simple search feature search database, examples found on google sql injection prone.

on using code:

select userid, fullname, website, birth, image profile fullname ? or website ?", %{$_post["searchname"]}%, %{$_post["searchurl"]}% 

i getting

parse error: syntax error, unexpected '%' in /usr/share/nginx/html/public/search.php on line 15  

although found example in docs(example 6), uses execute, while in code, calling function.

my query function- link codepad

my search function -

http://codepad.org/pfgzdww5 (link not allowed.) 

please me correct it! if need more information code, ask.

thanks!

you should prepare query:

$handle= new pdo('mysql:host=localhost;dbname=test', $user, $pass); $handle->setattribute(pdo::attr_errmode, pdo::errmode_exception); $query = 'select userid, fullname, website, birth, image            profile            fullname ? or website ?';  $stmt = $handle->prepare($query); $stmt->execute(array('%'.$_post['searchname'].'%', '%'.$_post['searchurl'].'%'));