Ttykuu

I have a live search project and I don't know if it's secure enough or not. I don't access it directly, but I get data by JSON so I shouldn't worry about slashes or quotes, right?

The PHP code:

<?php
if (isset($it_server)) 
 class search
 public function gettingvalues($search_value)
 require_once('db_conx.php');
 $dir = "usersimage/";
 $search_value = htmlspecialchars($search_value,ENT_QUOTES,'UTF-8');
 $sql = "SELECT name,img,username FROM users WHERE username like '$search_value%' 
 
else
 header('location: 404');
 die();

?>

I call the function from index.php:

<?php
 $its_server = 'yes';
 if (isset($_POST['data'])) 
 require('search.php');
 $search = new search;
 $search->gettingvalues($_POST['data']);
 header('Content-Type: application/json; charset=utf-8');
 die();
 
?>
<script src="https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js"></script>
<script type="text/javascript">
 $(document).ready(function()
 $('input').keyup(function()
 var value= $('input').val();
 $.ajax(
 type: "POST",
 url: "",
 data: data: value,
 datatype: "json",
 success: function(json_data) 
 var img = [];
 var username = [];
 var name = [];
 var html = '';
 $.each(json_data, function(index, e) 
 if (e.error) 
 html += `$e.error`;
 else
 html += `$e.name $e.username $e.img<br>`;
 
 )
 $("#feedback").html(html);
 
 )
 );
 );
</script>
<input type="text" name="search" placeholder="looking for?">
<div id="feedback"></div>

I don't know if I'm doing well with security or not and it's a big deal to me. So what you see from 1-10, how secure is my page?

One quite big security issue I see here is your vulnerability to SQL-Injection attacks. Even when you use htmlspecialchars(), there are still some ways to circumvent it, as shown in Is htmlspecialchars enough to prevent an SQL injection on a variable enclosed in single quotes?.

Basically, you are allowing the user to directly manipulate the SQL-Query, which has to be prevented. For this case, there are Prepared Statements, which - if used correctly - will prevent the user from doing anything nasty with your database. There is an answer to How can I prevent SQL injection in PHP? regarding this topic, so I suggest you read and understand that.

Also, you might have a look at the manual to learn more about prepared statements using either mysqli or PDO.