cvs: phpweb / ws.php
| From: | Rasmus Lerdorf | Date: | Tue, 28 Feb 2006 09:46:37 +0000 |
| Subject: | cvs: phpweb / ws.php | ||
| Groups: | php.mirrors | ||
| Request: | Send a blank email to php-mirrors+get-30717@lists.php.net to get a copy of this message | ||
rasmus Tue Feb 28 09:46:37 2006 UTC
Modified files:
/phpweb ws.php
Log:
Don't mangle the search strings
http://cvs.php.net/viewcvs.cgi/phpweb/ws.php?r1=1.4&r2=1.5&diff_format=u
Index: phpweb/ws.php
diff -u phpweb/ws.php:1.4 phpweb/ws.php:1.5
--- phpweb/ws.php:1.4 Tue Feb 28 09:03:18 2006
+++ phpweb/ws.php Tue Feb 28 09:46:37 2006
@@ -3,7 +3,8 @@
include '/local/Web/ws.conf';
apc_store('ws_config',$conf);
}
-$q = urlencode($_REQUEST['q']);
+$raw = input_get(INPUT_GET, 'q', FILTER_UNSAFE_RAW);
+$q = urlencode($raw);
$r = isset($_REQUEST['results']) ? (int)$_REQUEST['results'] : 10;
$s = isset($_REQUEST['start']) ? (int)$_REQUEST['start'] : 1;
$l = isset($_REQUEST['lang']) ? htmlspecialchars($_REQUEST['lang']) :
'en';
@@ -32,7 +33,7 @@
$dbh->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
try {
$stmt = $dbh->prepare("INSERT INTO log (query,profile) VALUES (:query,:profile)");
- $stmt->execute(array(':query'=>$q,':profile'=>$scope));
+ $stmt->execute(array(':query'=>$raw,':profile'=>$scope));
} catch (PDOException $e) {
}