aboutsummaryrefslogtreecommitdiffstats
path: root/search.php
diff options
context:
space:
mode:
Diffstat (limited to 'search.php')
-rw-r--r--search.php5
1 files changed, 4 insertions, 1 deletions
diff --git a/search.php b/search.php
index 43451cb7c..6feee2780 100644
--- a/search.php
+++ b/search.php
@@ -47,6 +47,8 @@ if (isset($_POST['submit']))
if (isset($_POST['search_allwords'])
and !preg_match('/^\s*$/', $_POST['search_allwords']))
{
+ check_input_parameter('mode', $_POST, false, '/^(OR|AND)$/');
+
$drop_char_match = array(
'-','^','$',';','#','&','(',')','<','>','`','\'','"','|',',','@','_',
'?','%','~','.','[',']','{','}',':','\\','/','=','\'','!','*');
@@ -73,6 +75,7 @@ if (isset($_POST['submit']))
if (isset($_POST['tags']))
{
check_input_parameter('tags', $_POST, true, PATTERN_ID);
+ check_input_parameter('tag_mode', $_POST, false, '/^(OR|AND)$/');
$search['fields']['tags'] = array(
'words' => $_POST['tags'],
@@ -85,7 +88,7 @@ if (isset($_POST['submit']))
$search['fields']['author'] = array(
'words' => preg_split(
'/\s+/',
- $_POST['search_author']
+ strip_tags($_POST['search_author'])
),
'mode' => 'OR',
);