Revision 40
Added by stefan about 19 years ago
| search.php | ||
|---|---|---|
| 40 | 40 |
$string=str_replace(',', '', $_REQUEST['string']);
|
| 41 | 41 |
} |
| 42 | 42 |
// reverse potential magic_quotes action |
| 43 |
$original_string=$this->stripslashes($string); |
|
| 43 |
$original_string=$this->strip_slashes($string);
|
|
| 44 | 44 |
// Double backslashes (mySQL needs doubly escaped backslashes in LIKE comparisons) |
| 45 | 45 |
$string = addslashes($this->escape_backslashes($original_string)); |
| 46 | 46 |
// then escape for mySQL query |
| ... | ... | |
| 103 | 103 |
// Replace vars in search settings with values |
| 104 | 104 |
$vars = array('[SEARCH_STRING]', '[WB_URL]', '[PAGE_EXTENSION]', '[TEXT_RESULTS_FOR]');
|
| 105 | 105 |
$values = array($search_string, WB_URL, PAGE_EXTENSION, $TEXT['RESULTS_FOR']); |
| 106 |
$search_footer = str_replace($vars, $values, $this->stripslashes($fetch_footer['value'])); |
|
| 107 |
$search_results_header = str_replace($vars, $values, $this->stripslashes($fetch_results_header['value'])); |
|
| 108 |
$search_results_footer = str_replace($vars, $values, $this->stripslashes($fetch_results_footer['value'])); |
|
| 106 |
$search_footer = str_replace($vars, $values, $this->strip_slashes($fetch_footer['value']));
|
|
| 107 |
$search_results_header = str_replace($vars, $values, $this->strip_slashes($fetch_results_header['value']));
|
|
| 108 |
$search_results_footer = str_replace($vars, $values, $this->strip_slashes($fetch_results_footer['value']));
|
|
| 109 | 109 |
// Do extra vars/values replacement |
| 110 | 110 |
$vars = array('[SEARCH_STRING]', '[WB_URL]', '[PAGE_EXTENSION]', '[TEXT_SEARCH]', '[TEXT_ALL_WORDS]', '[TEXT_ANY_WORDS]', '[TEXT_EXACT_MATCH]', '[TEXT_MATCH]', '[TEXT_MATCHING]', '[ALL_CHECKED]', '[ANY_CHECKED]', '[EXACT_CHECKED]');
|
| 111 | 111 |
$values = array($search_string, WB_URL, PAGE_EXTENSION, $TEXT['SEARCH'], $TEXT['ALL_WORDS'], $TEXT['ANY_WORDS'], $TEXT['EXACT_MATCH'], $TEXT['MATCH'], $TEXT['MATCHING'], $all_checked, $any_checked, $exact_checked); |
| 112 |
$search_header = str_replace($vars, $values, $this->stripslashes($fetch_header['value'])); |
|
| 112 |
$search_header = str_replace($vars, $values, $this->strip_slashes($fetch_header['value']));
|
|
| 113 | 113 |
|
| 114 | 114 |
// Insert js code |
| 115 | 115 |
?> |
| ... | ... | |
| 158 | 158 |
$date = $TEXT['UNKNOWN'].' '.$TEXT['DATE']; |
| 159 | 159 |
$time = $TEXT['UNKNOWN'].' '.$TEXT['TIME']; |
| 160 | 160 |
} |
| 161 |
$values = array($link, $this->stripslashes($page['page_title']),$this->stripslashes($page['description']), $users[$page['modified_by']]['username'], $users[$page['modified_by']]['display_name'], $date, $time, $TEXT['LAST_UPDATED_BY'], strtolower($TEXT['ON']));
|
|
| 161 |
$values = array($link, $this->strip_slashes($page['page_title']),$this->strip_slashes($page['description']), $users[$page['modified_by']]['username'], $users[$page['modified_by']]['display_name'], $date, $time, $TEXT['LAST_UPDATED_BY'], strtolower($TEXT['ON']));
|
|
| 162 | 162 |
// Show loop code with vars replaced by values |
| 163 | 163 |
if($values != array()) {
|
| 164 |
echo str_replace($vars, $values, $this->stripslashes($fetch_results_loop['value'])); |
|
| 164 |
echo str_replace($vars, $values, $this->strip_slashes($fetch_results_loop['value']));
|
|
| 165 | 165 |
} |
| 166 | 166 |
// Say that we have already listed this page id |
| 167 | 167 |
$pages_listed[$page['page_id']] = true; |
| ... | ... | |
| 184 | 184 |
// Fetch query start |
| 185 | 185 |
$fetch_query_start = $get_query_start->fetchRow(); |
| 186 | 186 |
// Prepare query start for execution by replacing {TP} with the TABLE_PREFIX
|
| 187 |
$query_start = str_replace('[TP]', TABLE_PREFIX, $this->stripslashes($fetch_query_start['value']));
|
|
| 187 |
$query_start = str_replace('[TP]', TABLE_PREFIX, $this->strip_slashes($fetch_query_start['value']));
|
|
| 188 | 188 |
// Get query end |
| 189 | 189 |
$get_query_end = $database->query("SELECT value FROM ".TABLE_PREFIX."search WHERE name = 'query_end' AND extra = '$module_name' LIMIT 1");
|
| 190 | 190 |
if($get_query_end->numRows() > 0) {
|
| 191 | 191 |
// Fetch query start |
| 192 | 192 |
$fetch_query_end = $get_query_end->fetchRow(); |
| 193 | 193 |
// Set query end |
| 194 |
$query_end = $this->stripslashes($fetch_query_end['value']); |
|
| 194 |
$query_end = $this->strip_slashes($fetch_query_end['value']);
|
|
| 195 | 195 |
// Get query body |
| 196 | 196 |
$get_query_body = $database->query("SELECT value FROM ".TABLE_PREFIX."search WHERE name = 'query_body' AND extra = '$module_name' LIMIT 1");
|
| 197 | 197 |
if($get_query_body->numRows() > 0) {
|
| 198 | 198 |
// Fetch query start |
| 199 | 199 |
$fetch_query_body = $get_query_body->fetchRow(); |
| 200 | 200 |
// Prepare query body for execution by replacing {STRING} with the correct one
|
| 201 |
$query_body = str_replace(array('[TP]','[O]','[W]'), array(TABLE_PREFIX,'LIKE','%'), $this->stripslashes($fetch_query_body['value']));
|
|
| 201 |
$query_body = str_replace(array('[TP]','[O]','[W]'), array(TABLE_PREFIX,'LIKE','%'), $this->strip_slashes($fetch_query_body['value']));
|
|
| 202 | 202 |
// Loop through query body for each string, then combine with start and end |
| 203 | 203 |
$prepared_query = $query_start; |
| 204 | 204 |
$count = 0; |
| ... | ... | |
| 226 | 226 |
$date = $TEXT['UNKNOWN'].' '.$TEXT['DATE']; |
| 227 | 227 |
$time = $TEXT['UNKNOWN'].' '.$TEXT['TIME']; |
| 228 | 228 |
} |
| 229 |
$values = array($link, $this->stripslashes($page[$fields['title']]), $this->stripslashes($page[$fields['description']]), $users[$page[$fields['modified_by']]]['username'], $users[$page[$fields['modified_by']]]['display_name'], $date, $time, $TEXT['LAST_UPDATED_BY'], strtolower($TEXT['ON']));
|
|
| 229 |
$values = array($link, $this->strip_slashes($page[$fields['title']]), $this->strip_slashes($page[$fields['description']]), $users[$page[$fields['modified_by']]]['username'], $users[$page[$fields['modified_by']]]['display_name'], $date, $time, $TEXT['LAST_UPDATED_BY'], strtolower($TEXT['ON']));
|
|
| 230 | 230 |
// Show loop code with vars replaced by values |
| 231 |
echo str_replace($vars, $values, $this->stripslashes($fetch_results_loop['value'])); |
|
| 231 |
echo str_replace($vars, $values, $this->strip_slashes($fetch_results_loop['value']));
|
|
| 232 | 232 |
// Say that this page or item has been listed if we can |
| 233 | 233 |
if(isset($fields['page_id'])) {
|
| 234 | 234 |
$pages_listed[$page[$fields['page_id']]] = true; |
Also available in: Unified diff
Change addslashes,stripslashes to (wb class) method calls add_slashes,strip_slashes