diff --git a/components/filters/fuserfield/plugin.class.php b/components/filters/fuserfield/plugin.class.php index 4dd1d876..1bb44730 100755 --- a/components/filters/fuserfield/plugin.class.php +++ b/components/filters/fuserfield/plugin.class.php @@ -178,7 +178,8 @@ private function sql_replace($filtersearchtext, $filterstrmatch, $finalelements) print_error('nosuchoperator'); } if ($operator == '~') { - $replace = " AND " . $field . " LIKE '%" . $filtersearchtext . "%'"; + $searchitem = trim(str_replace("'", "''", $filtersearchtext)); + $replace = " AND " . $field . " LIKE '%" . $searchitem . "%'"; } else if ($operator == 'in') { $processeditems = array(); // Accept comma-separated values, allowing for '\,' as a literal comma. diff --git a/components/filters/searchtext/plugin.class.php b/components/filters/searchtext/plugin.class.php index b0a92af7..e4168444 100644 --- a/components/filters/searchtext/plugin.class.php +++ b/components/filters/searchtext/plugin.class.php @@ -87,7 +87,8 @@ private function sql_replace($filtersearchtext, $filterstrmatch, $finalelements) print_error('nosuchoperator'); } if ($operator == '~') { - $replace = " AND " . $field . " LIKE '%" . $filtersearchtext . "%'"; + $searchitem = trim(str_replace("'", "''", $filtersearchtext)); + $replace = " AND " . $field . " LIKE '%" . $searchitem . "%'"; } else if ($operator == 'in') { $processeditems = array(); // Accept comma-separated values, allowing for '\,' as a literal comma.