tobias/friendica
1
0
Fork 0
Code Pull requests Activity

possible sql injection in search

Browse source
This commit is contained in:
friendica 2012-05-29 17:14:35 -07:00
commit 514c994e6a
2 changed files with 3 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

2
mod/search.php
View file

@ -110,7 +110,7 @@ function search_content(&$a) {
if (get_config('system','use_fulltext_engine')) {
if($tag)
$sql_extra = sprintf(" AND MATCH (`item`.`tag`) AGAINST ('".'"%s"'."' in boolean mode) ", '#'.protect_sprintf($search));
$sql_extra = sprintf(" AND MATCH (`item`.`tag`) AGAINST ('".'"%s"'."' in boolean mode) ", '#'.dbesc(protect_sprintf($search)));
else
$sql_extra = sprintf(" AND MATCH (`item`.`body`) AGAINST ('".'"%s"'."' in boolean mode) ", dbesc(protect_sprintf($search)));
} else {