title: Website security, sql injection and file permissions
body: <p>I am building a very small website (with PHP) and I have 2 big issues
  The first one is about my search form
  I have build a really simple search form in order to retrieve my content, then I used an online security tool and show me that my search form was vulnerable to SQLi
  I had no idea abut that so I started testing some attacks I found on some sites
  As far as now only <code>'OR 'x'='x</code> worked (it returns the entire content of my website, is this bad? How can an attacker hurt me? 
  The second issue is about my photos, I am using a folder called mywebsite.com/uploads/ to access my photos
  Although /upload is protected the subfolders uploads/temp and uploads/thumbs are visible through the browser
  May this be hurtful too?
  Any advice?</p>