Possible escape issue in searches

[MrMike]

When searching for a term with a single quote ('), TinyPortal returns this error:

Code Select Expand

Database Error
You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near 's and') AS score
FROM smf_tp_articles AS a
LEFT JOIN smf_me...' at line 1
File: /var/www/XXXXX/XXXXXX/web16/web/forum/Sources/TPSearch.php
Line: 201


[tino]

$what needs to be escaped, I think we can do it with db_quote, I'll look at it when I get the chance.

[@rjen]

That would be nice, was not sure how to tackle this

[tino]

Code Select Expand

$what = $smcFunc['db_quote'](
'{string:what}',
array(
'what' => $what
)
);


Should do it... can't test it as that's from my phone but I think it's right, might need the global also

[@rjen]

We now have this, this this needs to be replaced?

Code Select Expand

        // clean the search
        $what = TPUtil::filter('tpsearch_what', 'post', 'string');

[tino]

We now have this, this this needs to be replaced?

Code Select Expand

        // clean the search
        $what = TPUtil::filter('tpsearch_what', 'post', 'string');

Just after that line, as we need to sanitise it first then escape it.

[@rjen]

Nope..

You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near '\'fjr\''%' OR a.body LIKE '%'\'fjr\''%'
AND ((a.pub_start = 0 AND a....' at line 4
Bestand: /home/deb77453/domains/fjr-club.nl/public_html/test/Sources/TPSearch.php
Regel: 205

else {
        checkSession('post');
        // clean the search
        $what = TPUtil::filter('tpsearch_what', 'post', 'string');
      $what = $smcFunc['db_quote'](
      '{string:what}',
      array('what' => $what)
      );
        if(!empty($_POST['tpsearch_title'])) {
            $usetitle = true;
        }
        if(!empty($_POST['tpsearch_body'])) {
            $usebody = true;
        }
    }

[tino]

Try it after this line

https://github.com/Tinyportal/TinyPortal/blob/448a8fc09001727dcd3c4644d04f662b8756971d/Sources/TPSearch.php#L159

[@rjen]

same issue

You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near 'fjr'%' OR a.body LIKE '%'fjr'%'
AND ((a.pub_start = 0 AND a.pub_end ...' at line 4
Bestand: /home/deb77453/domains/fjr-club.nl/public_html/test/Sources/TPSearch.php
Regel: 205

[tino]

Then it's not being escaped...