Please modify Map Search on site

Feb 20, 2008 03:33 Please modify Map Search on site
Can the Search for maps be modified to include partial words? My map name has underscores but is not showing up when I search for it.
Map name: Mikemc_DW1_Alefgard.map but "Alefgard" or "DW" returns zero matches.

- Mike
Feb 20, 2008 04:47
It's a simple fix and hopefully one of the moderators could put a extra % symbol in front of the $keyword variable in the sql query.
Feb 20, 2008 14:03
Well, I think it almost worked properly before. Just now I entered in "ibiz" and it brought up three Ibiza maps. That clearly is partial word. However, when I did try and search by the terms he was using, he was right: no results returned.

What I think is happening is that any map title that is a single word gets searched using wildcards as jhood stated in his earlier post. But for the multi-word map titles, who knows how the search is being conducted.

For proof of this search for "style" in map names. It should return no results. Then, search for "%style%" in map names. It should return a few results.
Feb 20, 2008 14:24
You're right. And now, it has to be fixed because you uncovered a possible SQL injection. :)
Feb 20, 2008 17:49
jhood wrote:
You're right. And now, it has to be fixed because you uncovered a possible SQL injection. :)

I think you're well aware that's not the first vulnerability in this site.
Feb 20, 2008 20:07
jhood wrote:
It's a simple fix and hopefully one of the moderators could put a extra % symbol in front of the $keyword variable in the sql query.


Moderators dont' have that kind of access.

Min
Feb 20, 2008 22:58
It appears that the search is using a "begins with" (only appending a wild card to the end of the search phrase) and you 'expect' it to be a "contains" search. You could just use the standard SQL wild card in your search (%) and get the results you expected (try it by searching %DW%). Ideally, the search should not automatically append the wild card to either side of the search phrase, but instead offer search options in the form of radio buttons or drop downs that allow the user to enter a phrase and select (for example) begins with, contains, or exact match.
Feb 22, 2008 04:58
Siren, how do you know about SQL wildcard characters? That's HOT!
Feb 22, 2008 23:55
Yep, always gotta watch your back for those SQL injections. You never know when and where they might strike.
Feb 23, 2008 00:56
Heaven forbid anyone try to find my map named
' DROP DATABASE GO
Feb 23, 2008 03:03
INSERT INTO STICKS (ASS)
SELECT FOOT
FROM STIMPY
WHERE FOOTWEAR = 'SPIKE-TOED BOOT'
Feb 26, 2008 23:12
stimpy wrote:
INSERT INTO STICKS (ASS)
SELECT FOOT
FROM STIMPY
WHERE FOOTWEAR = 'SPIKE-TOED BOOT'


connection established