Merge branch 'master' of https://github.com/friendica/friendica

[friendica.git] / mod / search.php

diff --git a/mod/search.php b/mod/search.php
index d4cd9d96763c7d0838fa2fc72b3e0e00b345df6a..320ffddcef2fbc0df671e6c58e5c26937372711a 100644 (file)
--- a/mod/search.php
+++ b/mod/search.php
@@ -110,18 +110,19 @@ function search_content(&$a) {
 
        if (get_config('system','use_fulltext_engine')) {
                if($tag)
-                       $sql_extra = sprintf(" AND MATCH (`item`.`tag`) AGAINST ('".'"%s"'."' in boolean mode) ", '#'.preg_quote($search));
+                       $sql_extra = sprintf(" AND MATCH (`item`.`tag`) AGAINST ('".'"%s"'."' in boolean mode) ", '#'.dbesc(protect_sprintf($search)));
                else
-                       $sql_extra = sprintf(" AND MATCH (`item`.`body`) AGAINST ('".'"%s"'."' in boolean mode) ", dbesc(preg_quote($search)));
+                       $sql_extra = sprintf(" AND MATCH (`item`.`body`) AGAINST ('".'"%s"'."' in boolean mode) ", dbesc(protect_sprintf($search)));
        } else {
                if($tag)
-                       $sql_extra = sprintf(" AND `item`.`tag` REGEXP '%s' ",  dbesc('\\]' . preg_quote($search) . '\\['));
+                       $sql_extra = sprintf(" AND `item`.`tag` REGEXP '%s' ",  dbesc('\\]' . protect_sprintf(preg_quote($search)) . '\\['));
                else
-                       $sql_extra = sprintf(" AND `item`.`body` REGEXP '%s' ", dbesc(preg_quote($search)));
+                       $sql_extra = sprintf(" AND `item`.`body` REGEXP '%s' ", dbesc(protect_sprintf(preg_quote($search))));
        }
 
 
 
+
        // Here is the way permissions work in the search module...
        // Only public posts can be shown
        // OR your own posts if you are a logged in member
@@ -145,7 +146,7 @@ function search_content(&$a) {
        }
 
        $r = q("SELECT distinct(`item`.`uri`), `item`.*, `item`.`id` AS `item_id`, 
-               `contact`.`name`, `contact`.`photo`, `contact`.`url`, `contact`.`rel`,
+               `contact`.`name`, `contact`.`photo`, `contact`.`url`, `contact`.`alias`, `contact`.`rel`,
                `contact`.`network`, `contact`.`thumb`, `contact`.`self`, `contact`.`writable`, 
                `contact`.`id` AS `cid`, `contact`.`uid` AS `contact-uid`,
                `user`.`nickname`