Forum GestSup

Code : Tout sélectionner

//escape special char and secure string before database insert
		$db_ticket=strip_tags($db->quote($_POST['ticket']));
		$db_title=strip_tags($db->quote($_POST['title']));
		$db_title=str_replace("'","",$db_title);
		
		//build SQL query
		$select= "DISTINCT tincidents.*";
		$from="tincidents";
		$join='LEFT JOIN tstates ON tincidents.state=tstates.id ';
		$where="
		tincidents.user LIKE '$_POST[user]'
		AND	tincidents.disable='0'
		AND	tincidents.u_group LIKE '$_GET[u_group]'
		AND	tincidents.technician LIKE '$_POST[technician]'
		AND	tincidents.t_group LIKE '$_GET[t_group]'
		AND	tincidents.techread LIKE '$_GET[techread]'
		AND	tincidents.category LIKE '$_POST[category]'
		AND	tincidents.subcat LIKE '$_POST[subcat]'
		AND	tincidents.id LIKE $db_ticket
		AND	tincidents.user LIKE '$_POST[userid]'
		AND tincidents.date_hope LIKE '$_POST[date_hope]%'
		AND	tincidents.priority LIKE '$_POST[priority]'
		AND	tincidents.criticality LIKE '$_POST[criticality]'
		AND	tincidents.type LIKE '$_POST[type]'
		AND	tincidents.title LIKE '%$db_title%'
		$state
		";

Code : Tout sélectionner

AND	tincidents.title LIKE '%$db_title%'

Code : Tout sélectionner

//escape special char and secure string before database insert
		$db_title=strip_tags($db->quote($_POST['title']));
		$db_title=str_replace("'","",$db_title);
			//build SQL query
			$select= "DISTINCT tincidents.*";
			$from="tincidents";
			$join='LEFT JOIN tstates ON tincidents.state=tstates.id ';
			$where="
			tincidents.user LIKE '$_POST[user]'
			AND	tincidents.disable='0'
			AND	tincidents.u_group LIKE '$_GET[u_group]'
			AND	tincidents.technician LIKE '$_POST[technician]'
			AND	tincidents.t_group LIKE '$_GET[t_group]'
			AND	tincidents.techread LIKE '$_GET[techread]'
			AND	tincidents.category LIKE '$_POST[category]'
			AND	tincidents.subcat LIKE '$_POST[subcat]'
			AND	tincidents.id LIKE $db_ticket
			AND	tincidents.user LIKE '$_POST[userid]'
			AND tincidents.date_hope LIKE '$_POST[date_hope]%'
			AND	tincidents.priority LIKE '$_POST[priority]'
			AND	tincidents.criticality LIKE '$_POST[criticality]'
			AND	tincidents.type LIKE '$_POST[type]'
			AND tincidents.title LIKE '%$db_title%'
			$state
			";