sql injection.php

<?php
http: //testphp.vulnweb.com/search.php?test=query

$pdo = new PDO('msql:host=vulnweb.com;dbname=vulnweb', 'dbuser', 'dbpassword');
$query = "SELECT * FROM searchabletable WHERE topic LIKE :keyword";
$stmt = $pdo->prepare($query);
$stmt->bindValue(':keyword', '%' . $variable . '%');
$stmt->execute();

// fetch results 
$fetch = $statement->fetchAll(PDO::FETCH_ASSOC);

if ($fetch) {
    // do something
} else {
    //do something else
}

Fixing a search page with sql injection