sanitize update

OmniLayer · Sep 14, 2018 · 21135b6 · 21135b6
1 parent 150b58d
commit 21135b6
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 2 deletions.
diff --git a/api/offers.py b/api/offers.py
@@ -128,7 +128,8 @@ def getsell(txdbserialnum):
     return ROWS[0]
 
 def genQs(prefix, tbl_abbr, field, array):
-    qs = '(' + tbl_abbr + '.' + field + '=\'' + array[0] + '\' ' # table abbrev "." fieldname = address 
+    addr = re.sub(r'\W+', '', array[0]) #check alphanumeric
+    qs = '(' + tbl_abbr + '.' + field + '=\'' + addr + '\' ' # table abbrev "." fieldname = address 
     for entry in array[1:]:
       entry = re.sub(r'\W+', '', entry) #check alphanumeric
       qs += prefix + ' ' + tbl_abbr + '.' + field + '=\'' + entry +'\' '     # "and/or" table abbrev "." fieldname = next address

diff --git a/api/search_service.py b/api/search_service.py
@@ -28,7 +28,7 @@ def search():
   if len(query) < 3:
     return jsonify({ 'status': 400, 'data': 'Search query to short.' })
 
-  ROWS=dbSelect("select * from transactions t, txjson txj where t.txhash ~* \'" + str(query) + "\' and t.txdbserialnum=txj.txdbserialnum")
+  ROWS=dbSelect("select * from transactions t, txjson txj where t.txhash ~* %s and t.txdbserialnum=txj.txdbserialnum",[str(query)])
 
   response = []
   if len(ROWS) > 0: