BUGFIX Consistently using Convert::raw2sql() instead of DB::getConn()…

…->addslashes() or PHP's deprecated addslashes() for database escaping
silverstripe · Sep 15, 2011 · ad88e28 · ad88e28
1 parent aefda19
commit ad88e28
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/code/search/AdvancedSearchForm.php b/code/search/AdvancedSearchForm.php
@@ -82,7 +82,7 @@ public function getResults($numPerPage = 10) {
 	 		foreach($_REQUEST['OnlyShow'] as $section => $checked) {
 	 			$items = explode(",", $section);
 	 			foreach($items as $item) {
-	 				$page = DataObject::get_one('SiteTree', "\"URLSegment\" = '" . DB::getConn()->addslashes($item) . "'");
+	 				$page = DataObject::get_one('SiteTree', "\"URLSegment\" = '" . Convert::raw2sql($item) . "'");
 	 				$pageList[] = $page->ID;
 	 				if(!$page) user_error("Can't find a page called '$item'", E_USER_WARNING);
 	 				$page->loadDescendantIDListInto($pageList);