summaryrefslogtreecommitdiff
path: root/web/lib/pkgfuncs.inc.php
diff options
context:
space:
mode:
Diffstat (limited to 'web/lib/pkgfuncs.inc.php')
-rw-r--r--web/lib/pkgfuncs.inc.php12
1 files changed, 5 insertions, 7 deletions
diff --git a/web/lib/pkgfuncs.inc.php b/web/lib/pkgfuncs.inc.php
index 8d2799c..558cf3f 100644
--- a/web/lib/pkgfuncs.inc.php
+++ b/web/lib/pkgfuncs.inc.php
@@ -457,11 +457,9 @@ function pkg_search_page($SID="", $dbh=NULL) {
}
if (isset($_GET['K'])) {
- $_GET['K'] = db_escape_string(trim($_GET['K']));
-
# Search by maintainer
if (isset($_GET["SeB"]) && $_GET["SeB"] == "m") {
- $q_where .= "AND Users.Username = '".$_GET['K']."' ";
+ $q_where .= "AND Users.Username = '".db_escape_string($_GET['K'])."' ";
}
# Search by submitter
elseif (isset($_GET["SeB"]) && $_GET["SeB"] == "s") {
@@ -469,16 +467,16 @@ function pkg_search_page($SID="", $dbh=NULL) {
}
# Search by name
elseif (isset($_GET["SeB"]) && $_GET["SeB"] == "n") {
- $q_where .= "AND (Name LIKE '%".$_GET['K']."%') ";
+ $q_where .= "AND (Name LIKE '%".db_escape_like($_GET['K'])."%') ";
}
# Search by name (exact match)
elseif (isset($_GET["SeB"]) && $_GET["SeB"] == "x") {
- $q_where .= "AND (Name = '".$_GET['K']."') ";
+ $q_where .= "AND (Name = '".db_escape_string($_GET['K'])."') ";
}
# Search by name and description (Default)
else {
- $q_where .= "AND (Name LIKE '%".$_GET['K']."%' OR ";
- $q_where .= "Description LIKE '%".$_GET['K']."%') ";
+ $q_where .= "AND (Name LIKE '%".db_escape_like($_GET['K'])."%' OR ";
+ $q_where .= "Description LIKE '%".db_escape_like($_GET['K'])."%') ";
}
}