TP-Docs
HTML5 Icon HTML5 Icon HTML5 Icon
TP on Social Media

Recent

Welcome to TinyPortal. Please login or sign up.

April 15, 2024, 09:46:14 AM

Login with username, password and session length
Members
  • Total Members: 3,885
  • Latest: Growner
Stats
  • Total Posts: 195,156
  • Total Topics: 21,219
  • Online today: 65
  • Online ever: 3,540 (September 03, 2022, 01:38:54 AM)
Users Online
  • Users: 0
  • Guests: 56
  • Total: 56

Possible escape issue in searches

Started by MrMike, October 10, 2023, 09:06:21 PM

Previous topic - Next topic

0 Members and 1 Guest are viewing this topic.

MrMike

When searching for a term with a single quote ('), TinyPortal returns this error:

Database Error
You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near 's and') AS score
FROM smf_tp_articles AS a
LEFT JOIN smf_me...' at line 1
File: /var/www/XXXXX/XXXXXX/web16/web/forum/Sources/TPSearch.php
Line: 201

tino

$what needs to be escaped, I think we can do it with db_quote, I'll look at it when I get the chance.

@rjen

That would be nice, was not sure how to tackle this
Running Latest TP on SMF2.1 at: www.fjr-club.nl

tino

$what = $smcFunc['db_quote'](
'{string:what}',
array(
'what' => $what
)
);


Should do it... can't test it as that's from my phone but I think it's right, might need the global also

@rjen

We now have this, this this needs to be replaced?

        // clean the search
        $what = TPUtil::filter('tpsearch_what', 'post', 'string');
Running Latest TP on SMF2.1 at: www.fjr-club.nl

tino

Quote from: @rjen on October 22, 2023, 09:47:19 PMWe now have this, this this needs to be replaced?

        // clean the search
        $what = TPUtil::filter('tpsearch_what', 'post', 'string');

Just after that line, as we need to sanitise it first then escape it.

@rjen

Nope..

You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near '\'fjr\''%' OR a.body LIKE '%'\'fjr\''%'
AND ((a.pub_start = 0 AND a....' at line 4
Bestand: /home/deb77453/domains/fjr-club.nl/public_html/test/Sources/TPSearch.php
Regel: 205


Quoteelse {
        checkSession('post');
        // clean the search
        $what = TPUtil::filter('tpsearch_what', 'post', 'string');
      $what = $smcFunc['db_quote'](
      '{string:what}',
      array('what' => $what)
      );
        if(!empty($_POST['tpsearch_title'])) {
            $usetitle = true;
        }
        if(!empty($_POST['tpsearch_body'])) {
            $usebody = true;
        }
    }
Running Latest TP on SMF2.1 at: www.fjr-club.nl


@rjen

same issue

You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near 'fjr'%' OR a.body LIKE '%'fjr'%'
AND ((a.pub_start = 0 AND a.pub_end ...' at line 4
Bestand: /home/deb77453/domains/fjr-club.nl/public_html/test/Sources/TPSearch.php
Regel: 205
Running Latest TP on SMF2.1 at: www.fjr-club.nl

tino


tino

Let's just use built in PHP functions... that'll hopefully point where the issue lies.

$mysqli = mysqli_init();
$what = mysqli_real_escape_string($mysqli, $what);

@rjen

Put it in the second spot: still no change


$what = implode(' ',$words);
$mysqli = mysqli_init();
$what = mysqli_real_escape_string($mysqli, $what);
}

Put it in the first spot: HTTP ERROR 500
Running Latest TP on SMF2.1 at: www.fjr-club.nl

tino


@rjen

Just did  aquick test, and it works: searching does no longer results in errors, and the ' symbols are included in the search string.

putting 'test' in an article text and 'test' in another

Search for the string test results in hits on the string test without quotes only
Search for the string 'test' results in hits on the string 'test' with quotes only

I assume this is how we want this to work?

Asking this because it reacts slightly differently when putting it in the article TITLE...

putting 'test' in an article title

Search for the string test results in hits on both the strings: test without quotes and the 'test' with quotes
Search for the string 'test' results in hits on the string 'test' with quotes only
Running Latest TP on SMF2.1 at: www.fjr-club.nl

tino

It should be a wildcard search so test or 'test' will be returned.

That does depend on your character encoding and database. Not much we can do to change those