Sys-admins informed me that image archive search form on the Siberian site might be vulnerable to SQL injection attack. So I replaced the former PHP handling communication between page and backend with PDO-based setup. Seems to be working on dev instance I set up, so migrated it to production instance. Seems to be working there too.

I had to move some of the code from the index and search pages to the include files and vice-versa due to scoping constraints on the variables, so overall the code isn't quite as elegant as it was. The only compromise I've had to make is in the former site a multiple word search string was treated as a list of OR delimited single words. On my PDO instance, I treat a multiple word search as a phrase. Did that because I couldn't figure out an elegant way of mapping the multiple variables required to treat the search string as OR'd words to the placeholders specified by PDO.