diff options
| author | Brion Vibber <brion@status.net> | 2010-11-19 15:06:26 -0800 |
|---|---|---|
| committer | Brion Vibber <brion@status.net> | 2010-11-19 15:06:26 -0800 |
| commit | 826a695077d08b6d370bccfbaa655950e2dcb60a (patch) | |
| tree | 96f21d9144903799355e2d28aae2233d5fbd5151 /lib | |
| parent | e0e7cb7c5376a7adfdcf8e0724aedfae3de471ef (diff) | |
Ticket #2797: replace addslashes() with explicit escape calls on the DB objects
Diffstat (limited to 'lib')
| -rw-r--r-- | lib/search_engines.php | 18 |
1 files changed, 9 insertions, 9 deletions
diff --git a/lib/search_engines.php b/lib/search_engines.php index 332db3f89..19703e03f 100644 --- a/lib/search_engines.php +++ b/lib/search_engines.php @@ -52,10 +52,10 @@ class MySQLSearch extends SearchEngine { if ('profile' === $this->table) { $this->target->whereAdd('MATCH(nickname, fullname, location, bio, homepage) ' . - 'AGAINST (\''.addslashes($q).'\' IN BOOLEAN MODE)'); + 'AGAINST (\''.$this->target->escape($q).'\' IN BOOLEAN MODE)'); if (strtolower($q) != $q) { $this->target->whereAdd('MATCH(nickname, fullname, location, bio, homepage) ' . - 'AGAINST (\''.addslashes(strtolower($q)).'\' IN BOOLEAN MODE)', 'OR'); + 'AGAINST (\''.$this->target->escape(strtolower($q)).'\' IN BOOLEAN MODE)', 'OR'); } return true; } else if ('notice' === $this->table) { @@ -64,13 +64,13 @@ class MySQLSearch extends SearchEngine $this->target->whereAdd('notice.is_local != ' . Notice::GATEWAY); if (strtolower($q) != $q) { - $this->target->whereAdd("( MATCH(content) AGAINST ('" . addslashes($q) . + $this->target->whereAdd("( MATCH(content) AGAINST ('" . $this->target->escape($q) . "' IN BOOLEAN MODE)) OR ( MATCH(content) " . - "AGAINST ('" . addslashes(strtolower($q)) . + "AGAINST ('" . $this->target->escape(strtolower($q)) . "' IN BOOLEAN MODE))"); } else { $this->target->whereAdd('MATCH(content) ' . - 'AGAINST (\''.addslashes($q).'\' IN BOOLEAN MODE)'); + 'AGAINST (\''.$this->target->escape($q).'\' IN BOOLEAN MODE)'); } return true; @@ -89,9 +89,9 @@ class MySQLLikeSearch extends SearchEngine ' fullname LIKE "%%%1$s%%" OR '. ' location LIKE "%%%1$s%%" OR '. ' bio LIKE "%%%1$s%%" OR '. - ' homepage LIKE "%%%1$s%%")', addslashes($q)); + ' homepage LIKE "%%%1$s%%")', $this->target->escape($q, true)); } else if ('notice' === $this->table) { - $qry = sprintf('content LIKE "%%%1$s%%"', addslashes($q)); + $qry = sprintf('content LIKE "%%%1$s%%"', $this->target->escape($q, true)); } else { throw new ServerException('Unknown table: ' . $this->table); } @@ -107,12 +107,12 @@ class PGSearch extends SearchEngine function query($q) { if ('profile' === $this->table) { - return $this->target->whereAdd('textsearch @@ plainto_tsquery(\''.addslashes($q).'\')'); + return $this->target->whereAdd('textsearch @@ plainto_tsquery(\''.$this->target->escape($q).'\')'); } else if ('notice' === $this->table) { // XXX: We need to filter out gateway notices (notice.is_local = -2) --Zach - return $this->target->whereAdd('to_tsvector(\'english\', content) @@ plainto_tsquery(\''.addslashes($q).'\')'); + return $this->target->whereAdd('to_tsvector(\'english\', content) @@ plainto_tsquery(\''.$this->target->escape($q).'\')'); } else { throw new ServerException('Unknown table: ' . $this->table); } |