summaryrefslogtreecommitdiff
path: root/lib/search_engines.php
diff options
context:
space:
mode:
Diffstat (limited to 'lib/search_engines.php')
-rw-r--r--lib/search_engines.php18
1 files changed, 9 insertions, 9 deletions
diff --git a/lib/search_engines.php b/lib/search_engines.php
index 332db3f89..19703e03f 100644
--- a/lib/search_engines.php
+++ b/lib/search_engines.php
@@ -52,10 +52,10 @@ class MySQLSearch extends SearchEngine
{
if ('profile' === $this->table) {
$this->target->whereAdd('MATCH(nickname, fullname, location, bio, homepage) ' .
- 'AGAINST (\''.addslashes($q).'\' IN BOOLEAN MODE)');
+ 'AGAINST (\''.$this->target->escape($q).'\' IN BOOLEAN MODE)');
if (strtolower($q) != $q) {
$this->target->whereAdd('MATCH(nickname, fullname, location, bio, homepage) ' .
- 'AGAINST (\''.addslashes(strtolower($q)).'\' IN BOOLEAN MODE)', 'OR');
+ 'AGAINST (\''.$this->target->escape(strtolower($q)).'\' IN BOOLEAN MODE)', 'OR');
}
return true;
} else if ('notice' === $this->table) {
@@ -64,13 +64,13 @@ class MySQLSearch extends SearchEngine
$this->target->whereAdd('notice.is_local != ' . Notice::GATEWAY);
if (strtolower($q) != $q) {
- $this->target->whereAdd("( MATCH(content) AGAINST ('" . addslashes($q) .
+ $this->target->whereAdd("( MATCH(content) AGAINST ('" . $this->target->escape($q) .
"' IN BOOLEAN MODE)) OR ( MATCH(content) " .
- "AGAINST ('" . addslashes(strtolower($q)) .
+ "AGAINST ('" . $this->target->escape(strtolower($q)) .
"' IN BOOLEAN MODE))");
} else {
$this->target->whereAdd('MATCH(content) ' .
- 'AGAINST (\''.addslashes($q).'\' IN BOOLEAN MODE)');
+ 'AGAINST (\''.$this->target->escape($q).'\' IN BOOLEAN MODE)');
}
return true;
@@ -89,9 +89,9 @@ class MySQLLikeSearch extends SearchEngine
' fullname LIKE "%%%1$s%%" OR '.
' location LIKE "%%%1$s%%" OR '.
' bio LIKE "%%%1$s%%" OR '.
- ' homepage LIKE "%%%1$s%%")', addslashes($q));
+ ' homepage LIKE "%%%1$s%%")', $this->target->escape($q, true));
} else if ('notice' === $this->table) {
- $qry = sprintf('content LIKE "%%%1$s%%"', addslashes($q));
+ $qry = sprintf('content LIKE "%%%1$s%%"', $this->target->escape($q, true));
} else {
throw new ServerException('Unknown table: ' . $this->table);
}
@@ -107,12 +107,12 @@ class PGSearch extends SearchEngine
function query($q)
{
if ('profile' === $this->table) {
- return $this->target->whereAdd('textsearch @@ plainto_tsquery(\''.addslashes($q).'\')');
+ return $this->target->whereAdd('textsearch @@ plainto_tsquery(\''.$this->target->escape($q).'\')');
} else if ('notice' === $this->table) {
// XXX: We need to filter out gateway notices (notice.is_local = -2) --Zach
- return $this->target->whereAdd('to_tsvector(\'english\', content) @@ plainto_tsquery(\''.addslashes($q).'\')');
+ return $this->target->whereAdd('to_tsvector(\'english\', content) @@ plainto_tsquery(\''.$this->target->escape($q).'\')');
} else {
throw new ServerException('Unknown table: ' . $this->table);
}