possible sql injection in search

diff --git a/include/api.php b/include/api.php
index 5697fbdbcb881c35365cdacbb525a43fa120ec76..5c17b35f56e7ae25b64631b653e966f3523dae75 100644 (file)
--- a/include/api.php
+++ b/include/api.php
@@ -995,8 +995,8 @@
                 else
                         $sql_extra .= sprintf(" AND `item`.`parent` IN (SELECT distinct(`parent`) from item where ( `author-link` like '%s' or `tag` like '%s' or tag like '%s' )) ",
                                 dbesc(protect_sprintf('%' . $myurl)),
-                                dbesc(protect_sprintf('%' . $myurl . '\\]%')),
-                                dbesc(protect_sprintf('%' . $diasp_url . '\\]%'))
+                                dbesc(protect_sprintf('%' . $myurl . ']%')),
+                                dbesc(protect_sprintf('%' . $diasp_url . ']%'))
                         );
 
                if ($max_id > 0)

diff --git a/mod/search.php b/mod/search.php
index 20007ada7776025e25006575bfdcc2f48afc9f40..466ffc4c34cad18c6fdf62c3deaa495a81836321 100644 (file)
--- a/mod/search.php
+++ b/mod/search.php
@@ -110,7 +110,7 @@ function search_content(&$a) {
 
        if (get_config('system','use_fulltext_engine')) {
                if($tag)
-                       $sql_extra = sprintf(" AND MATCH (`item`.`tag`) AGAINST ('".'"%s"'."' in boolean mode) ", '#'.protect_sprintf($search));
+                       $sql_extra = sprintf(" AND MATCH (`item`.`tag`) AGAINST ('".'"%s"'."' in boolean mode) ", '#'.dbesc(protect_sprintf($search)));
                else
                        $sql_extra = sprintf(" AND MATCH (`item`.`body`) AGAINST ('".'"%s"'."' in boolean mode) ", dbesc(protect_sprintf($search)));
        } else {