chamilo
/
chamilo-lms
mirror of https://github.com/chamilo/chamilo-lms/tree/1.11.x
2
0
Fork 0
Code Issues Projects Releases Wiki Activity

Escape sql wildcards % and _ in admin > user_list > advanced search - ref #6735

Browse Source
1.9.x
Hubert Borderiou 12 years ago
parent 8c771a564d
commit f678906347
2 changed files with 16 additions and 5 deletions
Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL
Show Stats Download Patch File Download Diff File
  1. 10
      main/admin/user_list.php
  2. 11
      main/inc/lib/database.lib.php

10
main/admin/user_list.php
Unescape View File

@ -400,11 +400,11 @@ function get_user_data($from, $number_of_items, $column, $direction) {
$keyword = Database::escape_string(trim($_GET['keyword'])); $keyword = Database::escape_string(trim($_GET['keyword']));
$sql .= " WHERE (u.firstname LIKE '%".$keyword."%' OR u.lastname LIKE '%".$keyword."%' OR concat(u.firstname,' ',u.lastname) LIKE '%".$keyword."%' OR concat(u.lastname,' ',u.firstname) LIKE '%".$keyword."%' OR u.username LIKE '%".$keyword."%' OR u.official_code LIKE '%".$keyword."%' OR u.email LIKE '%".$keyword."%' )"; $sql .= " WHERE (u.firstname LIKE '%".$keyword."%' OR u.lastname LIKE '%".$keyword."%' OR concat(u.firstname,' ',u.lastname) LIKE '%".$keyword."%' OR concat(u.lastname,' ',u.firstname) LIKE '%".$keyword."%' OR u.username LIKE '%".$keyword."%' OR u.official_code LIKE '%".$keyword."%' OR u.email LIKE '%".$keyword."%' )";
} elseif (isset ($_GET['keyword_firstname'])) { } elseif (isset ($_GET['keyword_firstname'])) {
$keyword_firstname = Database::escape_string($_GET['keyword_firstname']); $keyword_firstname = Database::escape_sql_wildcards(Database::escape_string($_GET['keyword_firstname']));
$keyword_lastname = Database::escape_string($_GET['keyword_lastname']); $keyword_lastname = Database::escape_sql_wildcards(Database::escape_string($_GET['keyword_lastname']));
$keyword_email = Database::escape_string($_GET['keyword_email']); $keyword_email = Database::escape_sql_wildcards(Database::escape_string($_GET['keyword_email']));
$keyword_officialcode = Database::escape_string($_GET['keyword_officialcode']); $keyword_officialcode = Database::escape_sql_wildcards(Database::escape_string($_GET['keyword_officialcode']));
$keyword_username = Database::escape_string($_GET['keyword_username']); $keyword_username = Database::escape_sql_wildcards(Database::escape_string($_GET['keyword_username']));
$keyword_status = Database::escape_string($_GET['keyword_status']); $keyword_status = Database::escape_string($_GET['keyword_status']);
$query_admin_table = ''; $query_admin_table = '';

11
main/inc/lib/database.lib.php
Unescape View File

@ -432,6 +432,17 @@ class Database {
return self::use_default_connection($connection) ? mysql_error() : mysql_error($connection); return self::use_default_connection($connection) ? mysql_error() : mysql_error($connection);
} }
/**
* Escape MySQL wildchars _ and % in LIKE search
* @param string The string to escape
* @return string The escaped string
*/
public static function escape_sql_wildcards($in_txt) {
$out_txt = api_preg_replace("/_/", "\_", $in_txt);
$out_txt = api_preg_replace("/%/", "\%", $out_txt);
return $out_txt;
}
/** /**
* Escapes a string to insert into the database as text * Escapes a string to insert into the database as text
* @param string The string to escape * @param string The string to escape

Write Preview
Loading…
Cancel
Save