Hello,
The warrning is that the posted data must be checked deeper to prevent SQL injection. By exmple if you expect a integer data (when it is posted) it is a good idea to do: (integer)$fldata. More about SQL injection you can find on the web.
Yes the search is only by one field only. You can use session variable to to make it multiple.
Regards
Tony