Another adjustment for the pre-escaped filter values

splitbrain · Jul 18, 2023 · c73abd3 · c73abd3
1 parent 8c5b72f
commit c73abd3
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 5 deletions.
diff --git a/syntax/cloud.php b/syntax/cloud.php
@@ -91,12 +91,13 @@ public function _buildSQL(&$data)
             $cnt = 0;
 
             foreach ($data['filter'] as $filter) {
+                //Note: value is already escaped
                 $col = $filter['key'];
                 $closecompare = ($filter['compare'] == 'IN(' ? ')' : '');
 
                 if (preg_match('/^%(\w+)%$/', $col, $m) && isset($fields[$m[1]])) {
                     $where .= " " . $filter['logic'] . " pages." . $fields[$m[1]] .
-                        " " . $filter['compare'] . " '" . $filter['value'] . "'" . $closecompare;
+                        " " . $filter['compare'] . " " . $filter['value'] . $closecompare;
                     $pagesjoin = ' LEFT JOIN pages ON pages.pid = data.pid';
                 } else {
                     // filter by hidden column?
@@ -107,7 +108,7 @@ public function _buildSQL(&$data)
                     }
 
                     $where .= ' ' . $filter['logic'] . ' ' . $tables[$col] . '.value ' . $filter['compare'] .
-                        " '" . $filter['value'] . "'" . $closecompare; //value is already escaped
+                        " " . $filter['value'] . $closecompare;
                 }
             }
         }

diff --git a/syntax/related.php b/syntax/related.php
@@ -126,13 +126,14 @@ function _buildSQL(&$data, $id = null)
             $where .= ' AND ( 1=1 ';
 
             foreach ($data['filter'] as $filter) {
+                // note: value is already escaped
                 $col = $filter['key'];
                 $closecompare = ($filter['compare'] == 'IN(' ? ')' : '');
 
                 if ($col == '%pageid%') {
-                    $where .= " " . $filter['logic'] . " pages.page " . $filter['compare'] . " '" . $filter['value'] . "'" . $closecompare;
+                    $where .= " " . $filter['logic'] . " pages.page " . $filter['compare'] . " " . $filter['value'] . $closecompare;
                 } elseif ($col == '%title%') {
-                    $where .= " " . $filter['logic'] . " pages.title " . $filter['compare'] . " '" . $filter['value'] . "'" . $closecompare;
+                    $where .= " " . $filter['logic'] . " pages.title " . $filter['compare'] . " " . $filter['value'] . $closecompare;
                 } else {
                     // filter by hidden column?
                     if (!$tables[$col]) {
@@ -142,7 +143,7 @@ function _buildSQL(&$data, $id = null)
                     }
 
                     $where .= ' ' . $filter['logic'] . ' ' . $tables[$col] . '.value ' . $filter['compare'] .
-                        " '" . $filter['value'] . "'" . $closecompare; //value is already escaped
+                        " " . $filter['value'] . $closecompare;
                 }
             }