Search form sample pattern

Question

I've just started to practice coding in OOP and just wanted to ask if my code's pattern is correct. I need your comments or suggestions so I can improve it.

sample_class.php:

<?php
$host = 'localhost';
$db = 'sample_db';
$user = 'sample_user';
$pass = 'sample_password';
$conn = new PDO("mysql:host=$host;dbname=$db", $user, $pass);
$conn->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
$conn->setAttribute(PDO::ATTR_EMULATE_PREPARES, false); 
Class MySearchClass {
 public function __construct(PDO $conn) {
 $this->pdo=$conn; 
 }
 public function search_name($keyword){
 $query = "SELECT * FROM table WHERE name = '$keyword'"; 
 $result = $this->pdo->prepare($query); 
 $result ->execute(); 
 return $result;
 }
 public function view_all(){
 $query = "SELECT * FROM table"; 
 $result = $this->pdo->prepare($query); 
 $result ->execute(); 
 return $result;
 } 
}

search_form.php:

<?php 
include('sample_class.php');
$search= new MySeachClass($database_connection);
if (isset($_POST['submit'])){ 
 $keyword = $_POST['keyword'];
 $go_search = $search->search_name($keyword);
 $data = $go_search->fetchAll(PDO::FETCH_ASSOC); 
 foreach($data as $row){
 echo $row['name']; 
 echo other rows....
 } 
}else{
 $view = $search->view_all();
 $data = $view->fetchAll(PDO::FETCH_ASSOC); 
 foreach($data as $row){
 echo $row['name']; 
 echo other rows....
 }
}
<form action="" method="POST"> 
<input type="text" name="keyword"> 
<input type="submit" name="search">
</form>

Answer 1

Here's a recommendation to bind parameters correctly. This sort of thing is used to prevent against SQL injection attacks.

$query = "SELECT * FROM table WHERE name = :keyword"; 
$statement = $this->pdo->prepare($query);
$statement->bindParam(':keyword', $keyword, PDO::PARAM_STR);
$result $statement->execute(); 

Read more about PDOStatement#bindParam here

Answer 2

The caller of MySearchClass methods should not know that there is a PDO access layer to database - the caller should not know about database at all! The class might internally query cache first or return hardcoded values - but return ready to use php collections (arrays)!

So I suggest moving all the fetchAll calls into MySearchClass methods.

Answer 3

If you're on PHP 5.2.0 you should also use filter_input_array or filter_input() rather than $_POST as this allows you to sanitize the string before it goes anywhere else.

For example:

$post_copy = filter_input_array(INPUT_POST, FILTER_SANITIZE_SPECIAL_CHARS);

or

$keyword = filter_input(INPUT_POST, 'keyword', FILTER_SANITIZE_SPECIAL_CHARS);

Using the filter_input_array can also allow you to specify what items you expect in the $_POST as items and apply a filter on them. This basically means if someone sends junk to you in the $_POST it will also be filtered out.