tridentli / pitchfork

Golang framework for secure communication platforms.
Apache License 2.0
5 stars 3 forks source link

Filter out SQL regexp chars from searches #136

Open massar opened 7 years ago

massar commented 7 years ago

DB.Row.Scan(SELECT COUNT() FROM member_trustgroup mt INNER JOIN trustgroup grp ON (mt.trustgroup = grp.ident) INNER JOIN member m ON (m.ident = mt.member) INNER JOIN member_email me ON (me.member = m.ident) WHERE grp.ident = $1 AND me.email = mt.email AND (m.ident ~ $2 OR m.descr ~ $2 OR m.affiliation ~ $2) )[[ ]] error: pq: invalid regular expression: parentheses () not balanced

Search here was: "(nameofuser"

and apparently that searches for a regexp....