From d7d98d85d9d3ae76280e1269c39232ebc0f7a69d Mon Sep 17 00:00:00 2001
From: tianshujie <tianshujie@easycorp.ltd>
Date: Tue, 24 Sep 2024 14:31:33 +0800
Subject: [PATCH] * [task#129030,done,1.5h] convert special characters to HTML
 entities.

---
 module/search/model.php | 1 -
 module/search/tao.php   | 3 +++
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/module/search/model.php b/module/search/model.php
index 3e7b5022ab..5f646eda86 100644
--- a/module/search/model.php
+++ b/module/search/model.php
@@ -304,7 +304,6 @@ class searchModel extends model
 
         /* Decode html encode. */
         $query->form = htmlspecialchars_decode($query->form, ENT_QUOTES);
-        $query->sql  = htmlspecialchars_decode($query->sql, ENT_QUOTES);
 
         /* 如果搜索表单中值有变量，把表单值放到post 表单，重新生成 query。*/
         /* If form has variable, regenerate query. */
diff --git a/module/search/tao.php b/module/search/tao.php
index b4aece8da4..9ef89fab7e 100644
--- a/module/search/tao.php
+++ b/module/search/tao.php
@@ -185,6 +185,9 @@ class searchTao extends searchModel
      */
     protected function setCondition(string $field, string $operator, string|int $value, string $control = ''): string
     {
+        /* 替换特殊字符。 */
+        if(is_string($value)) $value = htmlspecialchars($value, ENT_QUOTES);
+
         $condition = '';
         if($operator == 'include')
         {