diff --git a/db_search.php b/db_search.php index 458a45b881..07de04675d 100644 --- a/db_search.php +++ b/db_search.php @@ -59,25 +59,16 @@ if (empty($_REQUEST['criteriaSearchType']) unset($_REQUEST['submit_search']); } else { $criteriaSearchType = (int) $_REQUEST['criteriaSearchType']; - $option_str = $searchTypes[$_REQUEST['criteriaSearchType']]; + $searchTypeDescription = $searchTypes[$_REQUEST['criteriaSearchType']]; } if (empty($_REQUEST['criteriaSearchString']) || ! is_string($_REQUEST['criteriaSearchString']) ) { + $criteriaSearchString = ''; unset($_REQUEST['submit_search']); - $searched = ''; } else { - $searched = htmlspecialchars($_REQUEST['criteriaSearchString']); - // For "as regular expression" (search option 4), we should not treat - // this as an expression that contains a LIKE (second parameter of - // sqlAddSlashes()). - // - // Usage example: If user is seaching for a literal $ in a regexp search, - // he should enter \$ as the value. - $criteriaSearchString = $common_functions->sqlAddSlashes( - $_REQUEST['criteriaSearchString'], ($criteriaSearchType == 4 ? false : true) - ); + $criteriaSearchString = $_REQUEST['criteriaSearchString']; } $criteriaTables = array(); @@ -121,8 +112,8 @@ if ( $GLOBALS['is_ajax_request'] != true) { if (isset($_REQUEST['submit_search'])) { $response->addHTML( PMA_dbSearchGetSearchResults( - $criteriaTables, $searched, $option_str, - $criteriaSearchString, $criteriaSearchType, + $criteriaTables, $searchTypeDescription, + $criteriaSearchString, $criteriaSearchType, (! empty($criteriaColumnName) ? $criteriaColumnName : '') ) ); @@ -140,8 +131,9 @@ if ($GLOBALS['is_ajax_request'] == true) { // Add search form $response->addHTML( PMA_dbSearchGetSelectionForm( - $searched, $criteriaSearchType, $tables_names_only, $criteriaTables, - $url_params, (! empty($criteriaColumnName) ? $criteriaColumnName : '') + $criteriaSearchString, $criteriaSearchType, $tables_names_only, + $criteriaTables, $url_params, + (! empty($criteriaColumnName) ? $criteriaColumnName : '') ) ); ?> diff --git a/libraries/db_search.lib.php b/libraries/db_search.lib.php index 14032db9dd..5720246dc1 100644 --- a/libraries/db_search.lib.php +++ b/libraries/db_search.lib.php @@ -14,7 +14,7 @@ if (! defined('PHPMYADMIN')) { * * @param string $table The table name * @param string $criteriaColumnName Restrict the search to this column - * @param string $criteriaSearchString The string to search + * @param string $criteriaSearchString The search word/phrase/regexp to be searched * @param integer $criteriaSearchType Type of search * (1 -> 1 word at least, 2 -> all words, * 3 -> exact string, 4 -> regexp) @@ -33,24 +33,18 @@ if (! defined('PHPMYADMIN')) { function PMA_getSearchSqls($table, $criteriaColumnName, $criteriaSearchString, $criteriaSearchType ) { + $common_functions = PMA_CommonFunctions::getInstance(); // Statement types $sqlstr_select = 'SELECT'; $sqlstr_delete = 'DELETE'; // Table to use $sqlstr_from = ' FROM ' - . PMA_backquote($GLOBALS['db']) . '.' . PMA_backquote($table); - // Search words or pattern - $search_words = (($criteriaSearchType > 2) - ? array($criteriaSearchString) : explode(' ', $criteriaSearchString)); - - $like_or_regex = (($criteriaSearchType == 4) ? 'REGEXP' : 'LIKE'); - $automatic_wildcard = (($criteriaSearchType < 3) ? '%' : ''); - + . $common_functions->backquote($GLOBALS['db']) . '.' + . $common_functions->backquote($table); + // Gets where clause for the query $where_clause = PMA_dbSearchGetWhereClause( - $table, $search_words, $criteriaSearchType, $criteriaColumnName, - $like_or_regex, $automatic_wildcard + $table, $criteriaSearchString, $criteriaSearchType, $criteriaColumnName ); - // Builds complete queries $sql['select_columns'] = $sqlstr_select . ' * ' . $sqlstr_from . $where_clause; // here, I think we need to still use the COUNT clause, even for @@ -65,24 +59,35 @@ function PMA_getSearchSqls($table, $criteriaColumnName, $criteriaSearchString, /** * Provides where clause for bulding SQL query * - * @param string $table the table name - * @param integer $search_words Search words or pattern - * @param integer $criteriaSearchType Type of search - * (1 -> 1 word at least, 2 -> all words, - * 3 -> exact string, 4 -> regexp) - * @param string $criteriaColumnName Restrict the search to this column - * @param string $like_or_regex Whether to use 'LIKE' or 'REGEXP' - * @param string $automatic_wildcard Use automatic wildcard + * @param string $table The table name + * @param integer $criteriaSearchString The search word/phrase/regexp to be searched + * @param integer $criteriaSearchType Type of search + * (1 -> 1 word at least, 2 -> all words, + * 3 -> exact string, 4 -> regexp) + * @param string $criteriaColumnName Restrict the search to this column * * @return string The generated where clause */ -function PMA_dbSearchGetWhereClause($table, $search_words, $criteriaSearchType, - $criteriaColumnName, $like_or_regex, $automatic_wildcard +function PMA_dbSearchGetWhereClause($table, $criteriaSearchString, + $criteriaSearchType, $criteriaColumnName ) { + $common_functions = PMA_CommonFunctions::getInstance(); $where_clause = ''; // Columns to select $allColumns = PMA_DBI_get_columns($GLOBALS['db'], $table); $likeClauses = array(); + // Based on search type, decide like/regex & '%'/'' + $like_or_regex = (($criteriaSearchType == 4) ? 'REGEXP' : 'LIKE'); + $automatic_wildcard = (($criteriaSearchType < 3) ? '%' : ''); + // For "as regular expression" (search option 4), LIKE won't be used + // Usage example: If user is seaching for a literal $ in a regexp search, + // he should enter \$ as the value. + $criteriaSearchString = $common_functions->sqlAddSlashes( + $criteriaSearchString, ($criteriaSearchType == 4 ? false : true) + ); + // Extract search words or pattern + $search_words = (($criteriaSearchType > 2) + ? array($criteriaSearchString) : explode(' ', $criteriaSearchString)); foreach ($search_words as $search_word) { // Eliminates empty values @@ -98,8 +103,9 @@ function PMA_dbSearchGetWhereClause($table, $search_words, $criteriaSearchType, ) { // Drizzle has no CONVERT and all text columns are UTF-8 $column = ((PMA_DRIZZLE) - ? PMA_backquote($column['Field']) - : 'CONVERT(' . PMA_backquote($column['Field']) . ' USING utf8)'); + ? $common_functions->backquote($column['Field']) + : 'CONVERT(' . $common_functions->backquote($column['Field']) + . ' USING utf8)'); $likeClausesPerColumn[] = $column . ' ' . $like_or_regex . ' ' . "'" . $automatic_wildcard . $search_word . $automatic_wildcard @@ -110,14 +116,16 @@ function PMA_dbSearchGetWhereClause($table, $search_words, $criteriaSearchType, $likeClauses[] = implode(' OR ', $likeClausesPerColumn); } } // end for - + // Use 'OR' if 'at least one word' is to be searched, else use 'AND' $implode_str = ($criteriaSearchType == 1 ? ' OR ' : ' AND '); if ( empty($likeClauses)) { // this could happen when the "inside column" does not exist // in any selected tables $where_clause = ' WHERE FALSE'; } else { - $where_clause = ' WHERE (' . implode(') ' . $implode_str . ' (', $likeClauses) . ')'; + $where_clause = ' WHERE (' + . implode(') ' . $implode_str . ' (', $likeClauses) + . ')'; } return $where_clause; } @@ -125,18 +133,17 @@ function PMA_dbSearchGetWhereClause($table, $search_words, $criteriaSearchType, /** * Displays database search results * - * @param array $criteriaTables Tables on which search is to be performed - * @param string $searched The search word/phrase/regexp - * @param string $option_str Type of search - * @param string $criteriaSearchString The string to search - * @param integer $criteriaSearchType Type of search - * (1 -> 1 word at least, 2 -> all words, - * 3 -> exact string, 4 -> regexp) - * @param string $criteriaColumnName Restrict the search to this column + * @param array $criteriaTables Tables on which search is to be performed + * @param string $searchTypeDescription Description for search type + * @param string $criteriaSearchString The search word/phrase/regexp to be searched + * @param integer $criteriaSearchType Type of search + * (1 -> 1 word at least, 2 -> all words, + * 3 -> exact string, 4 -> regexp) + * @param string $criteriaColumnName Restrict the search to this column * * @return string HTML for search results */ -function PMA_dbSearchGetSearchResults($criteriaTables, $searched, $option_str, +function PMA_dbSearchGetSearchResults($criteriaTables, $searchTypeDescription, $criteriaSearchString, $criteriaSearchType, $criteriaColumnName = null ) { $html_output = ''; @@ -146,7 +153,7 @@ function PMA_dbSearchGetSearchResults($criteriaTables, $searched, $option_str, . '
'; $html_output .= sprintf( @@ -205,6 +213,7 @@ function PMA_dbSearchGetResultsRow($each_table, $newsearchsqls, $odd_row) $res_cnt = PMA_DBI_fetch_value($newsearchsqls['select_count']); // Start forming search results row $html_output = '