cvs: php-master-web /manage user-notes.php
| From: | Philip Olson | Date: | Mon, 26 May 2008 23:50:04 +0000 |
| Subject: | cvs: php-master-web /manage user-notes.php | ||
| Groups: | php.webmaster | ||
| Request: | Send a blank email to php-webmaster+get-1819@lists.php.net to get a copy of this message | ||
philip Mon May 26 23:50:04 2008 UTC
Modified files:
/php-master-web/manage user-notes.php
Log:
a numeric keyword search is always an id
http://cvs.php.net/viewvc.cgi/php-master-web/manage/user-notes.php?r1=1.66&r2=1.67&diff_format=u
Index: php-master-web/manage/user-notes.php
diff -u php-master-web/manage/user-notes.php:1.66 php-master-web/manage/user-notes.php:1.67
--- php-master-web/manage/user-notes.php:1.66 Fri Apr 18 16:45:18 2008
+++ php-master-web/manage/user-notes.php Mon May 26 23:50:04 2008
@@ -1,5 +1,5 @@
<?php
-// $Id: user-notes.php,v 1.66 2008/04/18 16:45:18 felipe Exp $
+// $Id: user-notes.php,v 1.67 2008/05/26 23:50:04 philip Exp $
// Force login before action can be taken
include_once 'login.inc';
@@ -64,11 +64,12 @@
if (isset($_REQUEST['keyword']) || isset($_REQUEST["view"])) {
if(isset($_REQUEST['keyword'])) {
- $sql = 'SELECT *,UNIX_TIMESTAMP(ts) AS ts FROM note WHERE note LIKE "%' .
escape($_REQUEST['keyword']) . '%"';
+ $sql = 'SELECT *,UNIX_TIMESTAMP(ts) AS ts FROM note WHERE ';
if (is_numeric($_REQUEST['keyword'])) {
- $sql .= ' OR id = ' . $_REQUEST['keyword'];
+ $sql .= 'id = ' . (int) $_REQUEST['keyword'];
+ } else {
+ $sql .= 'note LIKE "%' . escape($_REQUEST['keyword']) .
'%" LiMIT 20';
}
- $sql .= ' LIMIT 20';
} else {
$page = (int)$_REQUEST["page"];
$type = isset($_REQUEST["type"]) ? intval($_REQUEST["type"]) : 0;