Fix search issue with special characters, and escape them in SQL. s9y…

…#844
GuillaumeValadas · Jul 16, 2024 · c0f7f16 · c0f7f16
1 parent f81f672
commit c0f7f16
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/include/functions_entries.inc.php b/include/functions_entries.inc.php
@@ -883,7 +883,8 @@ function &serendipity_searchEntries($term, $limit = '', $searchresults = '') {
         $term             = str_replace('&quot;', '"', $term);
         $relevance_enabled = true;
         if (preg_match('@["\+\-\*~<>\(\)]+@', $term)) {
-            $cond['find_part'] = "MATCH(title,body,extended) AGAINST('$term' IN BOOLEAN MODE)";
+            $term = mysqli_real_escape_string($serendipity['dbConn'], $term);
+	    $cond['find_part'] = "MATCH(title,body,extended) AGAINST('\"$term\"' IN BOOLEAN MODE)";
         } else {
             $cond['find_part'] = "MATCH(title,body,extended) AGAINST('$term')";
         }