sec 5

if (isset($_GET['search'])) {

$result = $sql->query("SELECT name, site, message, `when` FROM messages WHERE message LIKE '%" . mysqli_real_escape_string($sql, $_GET['search']) . "%'");

while($res = mysqli_fetch_assoc($result)) {

?>

<div class="descr"><?=$res['when']?> door <?

if (substr_compare($res['site'], "http://", 0, 7, true) != 0 &&

substr_compare($res['site'], "https://", 0, 8, true) != 0) {

$res['site'] = " ";

}

?><a href="<?= htmlspecialchars($res['site'], ENT_QUOTES)?>"><?=htmlspecialchars($res['name'], ENT_QUOTES)?></a></div>

<blockquote>

<p><?=htmlspecialchars($res['message'], ENT_QUOTES)?></p>

</blockquote>