maketank/Froxlor
2
0
Fork 0
Code Pull Requests Releases Activity

use prepared statements for global-search

Browse Source 
Signed-off-by: Michael Kaufmann <d00p@froxlor.org>
This commit is contained in:
Michael Kaufmann
2022-03-09 14:10:44 +01:00
parent 1a40c9ba17
commit f236896764
2 changed files with 14 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
lib/Froxlor/Ajax/Ajax.php
View File

@@ -417,10 +417,13 @@ class Ajax
private function searchStringSql(array $searchfields, $searchtext) private function searchStringSql(array $searchfields, $searchtext)
{ {
$result = "("; $result = ['sql' => [], 'values' => []];
$result['sql'] = "(";
foreach ($searchfields as $sf) { foreach ($searchfields as $sf) {
$result .= $sf . " LIKE " . \Froxlor\Database\Database::quote('%' . $searchtext . '%') . " OR "; $result['sql'] .= $sf . " LIKE :searchtext OR ";
} }
return substr($result, 0, -3) . ")"; $result['sql'] = substr($result['sql'], 0, -3) . ")";
$result['values'] = ['searchtext' => '%' . $searchtext . '%'];
return $result;
} }
} }

9
lib/Froxlor/Api/ApiCommand.php
View File

@@ -2,6 +2,8 @@
namespace Froxlor\Api; namespace Froxlor\Api;
use Exception;
/** /**
* This file is part of the Froxlor project. * This file is part of the Froxlor project.
* Copyright (c) 2010 the Froxlor Team (see authors). * Copyright (c) 2010 the Froxlor Team (see authors).
@@ -287,7 +289,12 @@ abstract class ApiCommand extends ApiParameter
$first = true; $first = true;
foreach ($search as $field => $valoper) { foreach ($search as $field => $valoper) {
if ($field == '_plainsql') { if ($field == '_plainsql') {
$condition .= $valoper; if (isset($valoper['sql']) && isset($valoper['values']) && is_array($valoper['values'])) {
$condition .= $valoper['sql'];
foreach ($valoper['values'] as $var => $value) {
$query_fields[':' . $var] = $value;
}
}
} else { } else {
$cleanfield = str_replace(".", "", $field); $cleanfield = str_replace(".", "", $field);
$sortfield = explode('.', $field); $sortfield = explode('.', $field);