* [task#129030,done,1.5h] convert special characters to HTML entities.

module/search/model.php

@@ -304,7 +304,6 @@ class searchModel extends model
 
         /* Decode html encode. */
         $query->form = htmlspecialchars_decode($query->form, ENT_QUOTES);
-        $query->sql  = htmlspecialchars_decode($query->sql, ENT_QUOTES);
 
         /* 如果搜索表单中值有变量，把表单值放到post 表单，重新生成 query。*/
         /* If form has variable, regenerate query. */

module/search/tao.php

@@ -185,6 +185,9 @@ class searchTao extends searchModel
      */
     protected function setCondition(string $field, string $operator, string|int $value, string $control = ''): string
     {
+        /* 替换特殊字符。 */
+        if(is_string($value)) $value = htmlspecialchars($value, ENT_QUOTES);
+
         $condition = '';
         if($operator == 'include')
         {