jovialcore

<?php

//Using php, Native approaches involve like htmlspecialchars() to escape special characters in the user input.
$Userdata;

$sanitized = htmlspecialchars($Userdata);
// output 
echo " <p> Your data is:" . $sanitized . " </p>";

jovialcore

<?php
http: //testphp.vulnweb.com/search.php?test=query

$pdo = new PDO('msql:host=vulnweb.com;dbname=vulnweb', 'dbuser', 'dbpassword');
$query = "SELECT * FROM searchabletable WHERE topic LIKE :keyword";
$stmt = $pdo->prepare($query);
$stmt->bindValue(':keyword', '%' . $variable . '%');
$stmt->execute();

// fetch results 

jovialcore

<?php

/**
* I'm nnot the author but for good reference
 * Class RD_Text_Extraction
 *
 * Example usage:
 *
 * $response = RD_Text_Extraction::convert_to_text($path_to_valid_file);
 *