Changeset 3925:7ce8aa72db97

Timestamp:

11/12/18 11:38:15 (7 years ago)

Author:

franck <carnet.franck.paul@…>

Branch:

default

Message:

Better this way (in order to be coherent)

File:

• inc/public/lib.urlhandlers.php (modified) (1 diff)

inc/public/lib.urlhandlers.php

@@ -239 +239 @@
             $core->url->type = 'search';
 
-            $GLOBALS['_search'] = !empty($_GET['q']) ? rawurldecode($_GET['q']) : '';
+            $GLOBALS['_search'] = !empty($_GET['q']) ? html::escapeHTML(rawurldecode($_GET['q'])) : '';
             if ($GLOBALS['_search']) {
-                // Sanitize search string
-                $GLOBALS['_search'] = filter_var($GLOBALS['_search'], FILTER_SANITIZE_SPECIAL_CHARS);
                 $params = new ArrayObject(['search' => $GLOBALS['_search']]);
                 $core->callBehavior('publicBeforeSearchCount', $params);