PHP & Mysqli Code - Is this code safe for a simple search?

Question

I am writing some code to search my database and show results. Is the below code ok and safe enough? new to PHP and Mysqli so really appreciate any help that I can get on this subject. Thanks

<?php

    $conn = mysqli_connect("localhost", "root", "", "tutorial");

    if(mysqli_connect_errno()){
        echo "Failed to connect: " . mysqli_connect_error(); 
    }

    error_reporting(0);

    $output = '';

    if(isset($_GET['q']) && $_GET['q'] !== ' '){
        $searchq = $_GET['q'];

        $q = mysqli_query($conn, "SELECT * FROM search WHERE keywords LIKE '%$searchq%' OR title LIKE '%$searchq%'") or die(mysqli_error());
        $c = mysqli_num_rows($q);
        if($c == 0){
            $output = 'No search results for <b>"' . $searchq . '"</b>';
        } else {
            while($row = mysqli_fetch_array($q)){
                $id = $row['id'];
                $title = $row['title'];
                $desc = $row['description'];
                $link = $row['link'];

                $output .= '<a href="' . $link . '">
                            <h3>' . $title . '</h3>
                                <p>' . $desc . '</p>
                            </a>';
            }
        }
    } else {
        header("location: ./");
    }
    print("$output");
    mysqli_close($conn);

?>

Answer 1

It is not safe, you are completely open to SQL Injection. You need to use prepared statements.

Apart from that:

• don't use short variables names (q, c, etc)
• don't just echo an error, but actually handle it (if there is no db connection, there is no need to execute queries)
• try to reduce your nesting, eg by including guard clauses:

Example of guard clauses:

if(!isset($_GET['q']) || $_GET['q'] == ' '){
    // return, die, etc
}

// perform query

if($c == 0){
    // return, die, etc
}

// handle query output