fix automatic tag completion

[photo-tags.git] / getjson.php

diff --git a/getjson.php b/getjson.php
index cc93c7c352b95f0b6c42466c7e3cadf02a929155..14af09b3003bf7feb5f81a728e52b56f72228d79 100644 (file)
--- a/getjson.php
+++ b/getjson.php
@@ -19,22 +19,22 @@ else
 if (isset($_REQUEST["S"]))
   {
     /* single tag or part of tag */
-    $tag = $_REQUEST["S"];
-    /* individual tags are separated by '+' */
-    $result = $DB->query("SELECT name FROM tags where name like \"%$tag%\"");
+    $tag = sqlite_escape_string($_REQUEST["S"]);
+
+    $result = $DB->query("SELECT name FROM tags");
     $count = $DB->query("SELECT 1");
   }
 else
   {
     if (isset($_REQUEST["P"]))
-      $OFFSET = "".($_REQUEST["P"]*$N-$N);
+      $OFFSET = "".(intval($_REQUEST["P"])*$N-$N);
     else
       $OFFSET = "0";
 
     if (isset($_REQUEST["T"]))
       {
        /* single tag or part of tag */
-       $tags = $_REQUEST["T"];
+       $tags = sqlite_escape_string($_REQUEST["T"]);
        $tags = explode("+",$tags);
        $tags = "'".implode("','",$tags)."'";