aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--engine/lib/input.php13
1 files changed, 9 insertions, 4 deletions
diff --git a/engine/lib/input.php b/engine/lib/input.php
index fd33cb3d7..49eb63f13 100644
--- a/engine/lib/input.php
+++ b/engine/lib/input.php
@@ -177,6 +177,11 @@
if (!$q = get_input('q')) {
exit;
}
+
+ $q = mysql_real_escape_string($q);
+
+ // replace mysql vars with escaped strings
+ $q = str_replace(array('_', '%'), array('\_', '\%'), $q);
$match_on = get_input('match_on', 'all');
if ($match_on == 'all' || $match_on[0] == 'all') {
@@ -214,7 +219,7 @@
WHERE e.guid = ue.guid
AND e.enabled = 'yes'
AND ue.banned = 'no'
- AND (ue.name LIKE '%$q%' OR ue.username LIKE '$q%')
+ AND (ue.name LIKE '$q%' OR ue.username LIKE '$q%')
LIMIT $limit
";
@@ -241,7 +246,7 @@
WHERE e.guid = ge.guid
AND e.enabled = 'yes'
$owner_where
- AND (ge.name LIKE '%$q%' OR ge.description LIKE '%$q%')
+ AND (ge.name LIKE '$q%' OR ge.description LIKE '%$q%')
LIMIT $limit
";
if ($entities = get_data($query)) {
@@ -268,7 +273,7 @@
AND e.guid = ue.guid
AND e.enabled = 'yes'
AND ue.banned = 'no'
- AND (ue.name LIKE '%$q%' OR ue.username LIKE '$q%')
+ AND (ue.name LIKE '$q%' OR ue.username LIKE '$q%')
LIMIT $limit
";
@@ -368,4 +373,4 @@
register_elgg_event_handler('init','system','input_init');
-?> \ No newline at end of file
+?>