From 708f27f483d70660446ea2132b02cb7b39225f98 Mon Sep 17 00:00:00 2001
From: Bharat Mediratta <bharat@menalto.com>
Date: Sun, 31 May 2009 00:11:48 -0700
Subject: Run p::clean() on any variables that contain data entered by users.

---
 modules/search/views/search.html.php | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

(limited to 'modules/search')

diff --git a/modules/search/views/search.html.php b/modules/search/views/search.html.php
index fb1fd8a9..de4343ae 100644
--- a/modules/search/views/search.html.php
+++ b/modules/search/views/search.html.php
@@ -8,7 +8,7 @@
     <ul>
       <li>
         <label for="q"><?= t("Search the gallery") ?></label>
-        <input name="q" id="q" type="text" value="<?= $q ?>"/>
+        <input name="q" id="q" type="text" value="<?= p::clean($q) ?>"/>
       </li>
       <li>
         <input type="submit" value="<?= t("Search") ?>" />
@@ -31,10 +31,10 @@
       <a href="<?= url::site("items/$item->id") ?>">
         <?= $item->thumb_tag() ?>
         <p>
-          <?= $item->title ?>
+          <?= p::clean($item->title) ?>
         </p>
         <div>
-          <?= $item->description ?>
+          <?= p::clean($item->description) ?>
         </div>
       </a>
     </li>
@@ -43,7 +43,9 @@
   <?= $theme->pager() ?>
 
   <? else: ?>
-  <p><?= t("No results found for '") . $q . "'" ?></p>
+  <p>
+    <?= t("No results found for <b>%term</b>", array("term" => p::clean($q))) ?>
+  </p>
 
   <? endif; ?>
 </div>
-- 
cgit v1.2.3