external/aurweb
0
0
Fork 0
mirror of https://gitlab.archlinux.org/archlinux/aurweb.git synced 2025-02-03 10:43:03 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Escape wildcards in "LIKE" patterns

Browse source 
Percent signs ("%") and underscores ("_") are not escaped by
mysql_real_escape_string() and are interpreted as wildcards if combined
with "LIKE". Write a wrapper function db_escape_like() and use it where
appropriate.

Note that we already fixed this for the RPC interface in commit
da2ebb667b but missed the other places.
This patch should fix all remaining flaws reported in FS#26527.

Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
Signed-off-by: Dan McGee <dan@archlinux.org>
This commit is contained in:
Lukas Fleischer 2011-10-20 08:43:44 +02:00
parent 323d418f02
commit 47c5167acb
4 changed files with 15 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

3
web/lib/aurjson.class.php
View file

@ -195,8 +195,7 @@ class AurJSON {
return $this->json_error('Query arg too small');
}
$keyword_string = db_escape_string($keyword_string, $this->dbh);
$keyword_string = addcslashes($keyword_string, '%_');
$keyword_string = db_escape_like($keyword_string, $this->dbh);
$where_condition = "( Name LIKE '%{$keyword_string}%' OR " .
"Description LIKE '%{$keyword_string}%' )";