Prepared Statement to Prevent SQL Injection (mysqli)

Code

<?php

/*
 * Copyright (c) 2026 Jeffery L. Paris <jparis@phpog.com>.
 * Free for personal and internal use. Paid project use requires visible credit
 * to Jeffery L. Paris. Corporate use requires a paid license fee unless a
 * separate written license states otherwise.
 */

/**
 * Prepared Statement to Prevent SQL Injection (mysqli).
 *
 * Purpose:
 * Searches records with a procedural mysqli prepared statement so user input
 * never becomes concatenated SQL.
 *
 * @param mysqli $connection Open procedural mysqli connection.
 * @param string $search_term User-supplied search text.
 * @return array Matching rows and a safe public status message.
 */
function ogSnippetPreparedStatementMysqli(mysqli $connection, string $search_term): array {
	$search_term = trim($search_term);

	if ($search_term === '') {
		return array('success' => false, 'rows' => array(), 'message' => 'Search term is required.');
	}

	$like_term = '%'.$search_term.'%';
	$sql = 'SELECT id, title, slug FROM items WHERE title LIKE ? AND is_published = 1 ORDER BY title ASC LIMIT 25';
	$statement = mysqli_prepare($connection, $sql);

	if ($statement === false) {
		return array('success' => false, 'rows' => array(), 'message' => 'Search preparation failed.');
	}

	mysqli_stmt_bind_param($statement, 's', $like_term);
	$executed = mysqli_stmt_execute($statement);

	if ($executed === false) {
		mysqli_stmt_close($statement);
		return array('success' => false, 'rows' => array(), 'message' => 'Search execution failed.');
	}

	mysqli_stmt_bind_result($statement, $id, $title, $slug);

	$rows = array();
	while (mysqli_stmt_fetch($statement)) {
		$rows[] = array(
			'id' => (int) $id,
			'title' => $title,
			'slug' => $slug
		);
	}

	mysqli_stmt_close($statement);

	return array(
		'success' => true,
		'rows' => $rows,
		'message' => 'Prepared search completed.'
	);
}

/*
$result = ogSnippetPreparedStatementMysqli($connection, 'stargate');
print_r($result['rows']);
*/