From 2b270e9072804bf3c69be5a26718c0a1c9186ac6 Mon Sep 17 00:00:00 2001
From: Michael R Sweet <michaelrsweet@users.noreply.github.com>
Date: Wed, 5 Mar 2008 03:49:17 +0000
Subject: [PATCH] Quote search strings.

---
 www/articles.php | 4 +++-
 www/str.php      | 7 +++++--
 2 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/www/articles.php b/www/articles.php
index d7ff55c..0cac248 100644
--- a/www/articles.php
+++ b/www/articles.php
@@ -327,9 +327,11 @@ switch ($op)
 	html_link("Submit Article", "$PHP_SELF?N$options");
 	html_end_links();
 
+	$htmlsearch = htmlspecialchars($search, ENT_QUOTES);
+
         print("<form method='POST' action='$PHP_SELF'><p align='center'>"
 	     ."Search&nbsp;Words: &nbsp;<input type='text' size='60' "
-	     ."name='SEARCH' value='$search'>"
+	     ."name='SEARCH' value='$htmlsearch'>"
 	     ."<input type='submit' value='Search Articles'></p></form>\n");
 
         $query = "";
diff --git a/www/str.php b/www/str.php
index 5bb8402..386e040 100644
--- a/www/str.php
+++ b/www/str.php
@@ -575,8 +575,11 @@ switch ($op)
 	html_link("Submit Bug or Feature Request", "$PHP_SELF?N$options'");
 	html_end_links();
 
+	$htmlsearch = htmlspecialchars($search, ENT_QUOTES);
+
         print("<form method='POST' action='$PHP_SELF'><p align='center'>"
-	     ."Search&nbsp;Words: &nbsp;<input type='text' size='60' name='SEARCH' value='$search'>"
+	     ."Search&nbsp;Words: &nbsp;<input type='text' size='60' "
+	     ."name='SEARCH' value='$htmlsearch'>"
 	     ."<input type='submit' value='Search STRs'></p>\n");
 
 	print("<p align='center'>Priority:&nbsp;<select name='FPRIORITY'>");
@@ -764,7 +767,7 @@ switch ($op)
 
 	  if (($priority || $status || $scope) && $search != "")
 	    print("<p><a href='$PHP_SELF?L+S0+Q" . urlencode($search)
-	         ."'>Search for \"<i>$search</i>\" in all STRs</a></p>\n");
+	         ."'>Search for \"<i>$htmlsearch</i>\" in all STRs</a></p>\n");
 
 	  html_footer();
 	  exit();