Merge pull request #28 from nextcloud/enh/properly_bind_keys_to_searchv0.3.0

Properly bind keys to search

1 files changed, 18 insertions, 1 deletions

diff --git a/server/lib/UserManager.php b/server/lib/UserManager.php
index 3e19a8a..ced8dc7 100644
--- a/server/lib/UserManager.php
+++ b/server/lib/UserManager.php
@@ -130,8 +130,19 @@ class UserManager {
 
 		$operator = $exactMatch ? ' = ' : ' LIKE ';
 		$limit = $exactMatch ? ' 1 ' : ' 50 ';
-		$constraint = empty($parameters) ? '' : ' AND k IN (\'' . implode( '\', \'', $parameters ) . '\') ';
 
+		$constraint = '';
+		if (!empty($parameters)) {
+			$constraint = 'AND (';
+			$c = count($parameters);
+			for ($i = 0; $i < $c; $i++) {
+				if ($i !== 0) {
+					$constraint .= ' OR ';
+				}
+				$constraint .= '(k = :key' . $i . ')';
+			}
+			$constraint .= ')';
+		}
 
 		$stmt = $this->db->prepare('SELECT *
 FROM (
@@ -151,6 +162,12 @@ LIMIT ' . $limit);
 		$search = $exactMatch ? $search : $this->db->quote('%' . $this->escapeWildcard($search) . '%');
 		$stmt->bindParam(':search', $search, \PDO::PARAM_STR);
 
+		// bind parameters
+		foreach ($parameters as $parameter) {
+			$i = 0;
+			$stmt->bindParam(':key'.$i, $this->db->quote($parameter));
+		}
+
 		$stmt->execute();
 
 		/*