[mplode]

Thanks for the quick response! I have some remarks, however.

Why are you applying htmlspecialchars_uni() to the usernames before using them in the query? That should be unnecessary and in fact will probably cause problems with users who have <>& or similar signs in their usernames. $db->escape_string() should be enough there.

    print_input_row($vbphrase['username'], 'username', $user_name, false);
    print_input_row($vbphrase['keywords'], 'keywords', $search_keywords, false);

in these lines, you have not yet sanitized the HTML on the other hand;

    print_input_row($vbphrase['username'], 'username', htmlspecialchars_uni($user_name), false);
    print_input_row($vbphrase['keywords'], 'keywords', htmlspecialchars_uni($search_keywords), false);

And I think you need to sanitize the username in the search results etc. as well. In case someone has a username like "<script>alert(1)</script>" or "<!--" or something.