diff --git a/include/db/mysqli.inc.php b/include/db/mysqli.inc.php index 28157c49f..882487040 100644 --- a/include/db/mysqli.inc.php +++ b/include/db/mysqli.inc.php @@ -189,7 +189,7 @@ function serendipity_db_matched_rows() { */ function serendipity_db_escape_string($string) { global $serendipity; - return mysqli_escape_string($serendipity['dbConn'], $string); + return mysqli_real_escape_string($serendipity['dbConn'], $string); } /** diff --git a/include/functions_entries.inc.php b/include/functions_entries.inc.php index c870244f3..523281e72 100644 --- a/include/functions_entries.inc.php +++ b/include/functions_entries.inc.php @@ -882,7 +882,7 @@ function &serendipity_searchEntries($term, $limit = '', $searchresults = '') { $cond['distinct'] = ''; $term = str_replace('"', '"', $term); $relevance_enabled = true; - if (preg_match('@["\+\-\*~<>\(\)]+@', $term)) { + if (preg_match('@[\+\-\*~<>\(\)"].[\S]*@', $term) && preg_match('@\s*[\+\-\*~<>\(\)]\s*$@', $term) === 0 ) { $cond['find_part'] = "MATCH(title,body,extended) AGAINST('$term' IN BOOLEAN MODE)"; } else { $cond['find_part'] = "MATCH(title,body,extended) AGAINST('$term')";