Changeset 3592:940d0c9a5dac

Timestamp:

09/14/17 13:49:02 (8 years ago)

Author:

franck <carnet.franck.paul@…>

Branch:

2.12

Message:

Escapes REGEXP reserved characters (or SQLite equivalent) before searching existing URLs. Should fixes #2254

File:

• inc/core/class.dc.blog.php (modified) (1 diff)

inc/core/class.dc.blog.php

@@ -1940 +1940 @@
           {
                if ($this->con->driver() == 'mysql' || $this->con->driver() == 'mysqli') {
-                    $clause = "REGEXP '^".$this->con->escape($url)."[0-9]+$'";
+                    $clause = "REGEXP '^".$this->con->escape(preg_quote($url))."[0-9]+$'";
                } elseif ($this->con->driver() == 'pgsql') {
-                    $clause = "~ '^".$this->con->escape($url)."[0-9]+$'";
+                    $clause = "~ '^".$this->con->escape(preg_quote($url))."[0-9]+$'";
                } else {
-                    $clause = "LIKE '".$this->con->escape($url)."%'";
+                    $clause = "LIKE '".
+                              $this->con->escape(preg_replace(array('%','_','!'),array('!%','!_','!!'),$url)).
+                              "%' ESCAPE '!'";
                }
                $strReq = 'SELECT post_url FROM '.$this->prefix.'post '.