Search bug
Asked Modified Viewed 3,762 times
Hi,
I've noticed a search bug in PHP-fusion. I run a gaming forum where people can ask questions about modding games. When people try to search the forum for common errors in the game, it doesn't work. For example try to search for:
It doesn't work, it just shows a blank page. Is this a security issue?
I hope this can be fixed, because people really must be able to search for modding errors.
Thanks!
I've noticed a search bug in PHP-fusion. I run a gaming forum where people can ask questions about modding games. When people try to search the forum for common errors in the game, it doesn't work. For example try to search for:
Quote
GetLastError()
It doesn't work, it just shows a blank page. Is this a security issue?
I hope this can be fixed, because people really must be able to search for modding errors.
Thanks!
Basti
Basti 10
[PHP-Fusion Crew Member & Admin from June 2008 - December 2010]
http://basti2web.de - Support Site for my infusions
http://basti2web.de - Support Site for my infusions
- Veteran Member, joined since
- Contributed 1,099 posts on the community forums.
- Started 32 threads in the forums
Yes, it is for security reasons I think, but better ask someone from the dev-team if this is really necessary.
SiteMaster
SiteMaster 10
If i have touched it, it's W3C Valid
- Senior Member, joined since
- Contributed 305 posts on the community forums.
- Started 15 threads in the forums
search for GetLastError without the () and you will find what you are looking for :)
Quote
SiteMaster wrote:
search for GetLastError without the () and you will find what you are looking for :)
Yes I know, but the users who are searching for it don't know that.
They just think the script is "broken".
Edited by noob on 16-04-2009 16:49,
Must be a bug i guess since a simple symbol as ( and ) shouldnt cause this error, im sure dev team will figure out a way to allow certain characters in the search function.
— 5 months later —
bite
bite 10
- Member, joined since
- Contributed 163 posts on the community forums.
- Started 5 threads in the forums
Don't remember what ( and ) are dangerous...
They can't cause sql injection. The only strings can cause sql injection are " and ' , others like ( ) - can't do anything until " or ' is injected. In mysql queries LIKE, GRANT, REVOKE % and _ can be abused, but they can't do much, and can be escaped.
They can't cause sql injection. The only strings can cause sql injection are " and ' , others like ( ) - can't do anything until " or ' is injected. In mysql queries LIKE, GRANT, REVOKE % and _ can be abused, but they can't do much, and can be escaped.
fanggaming
fanggaming 10
- Junior Member, joined since
- Contributed 43 posts on the community forums.
- Started 3 threads in the forums
Well the problem is in the maincore.php
line 42.
This check matches the regex and therefore stops the page running.
line 42.
This check matches the regex and therefore stops the page running.
(eregi("\([^>]*\"?[^)]*\)", $check_url)Category Forum
Suspected Bugs and Errors - 8Labels
None yet
Statistics
- Views 0 views
- Posts 6 posts
- Votes 0 votes
- Topic users 6 members
6 participants
noob 10
- Member, joined since
- Contributed 110 posts on the community forums.
- Started 31 threads in the forums
- Started this discussions
Basti 10
[PHP-Fusion Crew Member & Admin from June 2008 - December 2010]
http://basti2web.de - Support Site for my infusions
http://basti2web.de - Support Site for my infusions
- Veteran Member, joined since
- Contributed 1,099 posts on the community forums.
- Started 32 threads in the forums
hame 10
- Senior Member, joined since
- Contributed 423 posts on the community forums.
- Started 44 threads in the forums
fanggaming 10
- Junior Member, joined since
- Contributed 43 posts on the community forums.
- Started 3 threads in the forums
SiteMaster 10
If i have touched it, it's W3C Valid
- Senior Member, joined since
- Contributed 305 posts on the community forums.
- Started 15 threads in the forums
Notifications
Track thread
You are not receiving notifications from this thread.
Related Questions