From b9a161222f34e6972206804fa553fe0ef0744985 Mon Sep 17 00:00:00 2001 From: Tastyfish Date: Mon, 11 Apr 2016 03:27:06 -0400 Subject: [PATCH] Sanitize search query --- code/modules/library/computers/base.dm | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/code/modules/library/computers/base.dm b/code/modules/library/computers/base.dm index fa0a4186191..b24c7e7dbbf 100644 --- a/code/modules/library/computers/base.dm +++ b/code/modules/library/computers/base.dm @@ -33,13 +33,13 @@ var/where = 0 if(query) if(query.title && query.title != "") - searchquery += " WHERE title LIKE '%[query.title]%'" + searchquery += " WHERE title LIKE '%[sanitizeSQL(query.title)]%'" where = 1 if(query.author && query.author != "") - searchquery += " [!where ? "WHERE" : "AND"] author LIKE '%[query.author]%'" + searchquery += " [!where ? "WHERE" : "AND"] author LIKE '%[sanitizeSQL(query.author)]%'" where = 1 if(query.category && query.category != "") - searchquery += " [!where ? "WHERE" : "AND"] category LIKE '%[query.category]%'" + searchquery += " [!where ? "WHERE" : "AND"] category LIKE '%[sanitizeSQL(query.category)]%'" if(query.category == "Fiction") searchquery += " AND category NOT LIKE '%Non-Fiction%'" where = 1