From 0cf2e051bbe98166e99025bc1f32a6e8e08a26f2 Mon Sep 17 00:00:00 2001 From: friendica Date: Sat, 31 Mar 2012 14:48:35 -0700 Subject: escape % in file_tag_query as it is ultimately embedded in a sprintf --- include/text.php | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'include/text.php') diff --git a/include/text.php b/include/text.php index f758c37ee..64f6f72a8 100644 --- a/include/text.php +++ b/include/text.php @@ -1306,6 +1306,10 @@ function file_tag_decode($s) { } function file_tag_file_query($table,$s,$type = 'file') { + + // this is ultimately going into a vsprintf + $s = str_replace('%','%%',$s); + if($type == 'file') $str = preg_quote( '[' . file_tag_encode($s) . ']' ); else -- cgit v1.2.3