$sql = "SELECT badge_id, badge_name_h, badge_name_v 
   FROM badges 
   WHERE (`badge_name_h` LIKE '%?%') OR (`badge_name_v` LIKE '%?%')";
  $search=$_GET['name'];
  $stmt = $mysqli->prepare($sql);
  $stmt->bind_param('ss', $search, $search);