diff --git a/components/com_banners/src/Model/BannersModel.php b/components/com_banners/src/Model/BannersModel.php index 88c3c29d8bf83..12eb2b2b58b6a 100644 --- a/components/com_banners/src/Model/BannersModel.php +++ b/components/com_banners/src/Model/BannersModel.php @@ -205,33 +205,43 @@ protected function getListQuery() foreach ($keywords as $key => $keyword) { + $regexp = '[[:<:]]' . $keyword . '[[:>:]]'; + $valuesToBind = [$keyword, $keyword, $regexp]; + + if ($cid) + { + $valuesToBind[] = $regexp; + } + + if ($categoryId) + { + $valuesToBind[] = $regexp; + } + + // Because values to $query->bind() are passed by reference, using $query->bindArray() here instead to prevent overwriting. + $bounded = $query->bindArray($valuesToBind, ParameterType::STRING); + $condition1 = $db->quoteName('a.own_prefix') . ' = 1' . ' AND ' . $db->quoteName('a.metakey_prefix') - . ' = SUBSTRING(:aprefix' . $key . ',1,LENGTH(' . $db->quoteName('a.metakey_prefix') . '))' + . ' = SUBSTRING(' . $bounded[0] . ',1,LENGTH(' . $db->quoteName('a.metakey_prefix') . '))' . ' OR ' . $db->quoteName('a.own_prefix') . ' = 0' . ' AND ' . $db->quoteName('cl.own_prefix') . ' = 1' . ' AND ' . $db->quoteName('cl.metakey_prefix') - . ' = SUBSTRING(:clprefix' . $key . ',1,LENGTH(' . $db->quoteName('cl.metakey_prefix') . '))' + . ' = SUBSTRING(' . $bounded[1] . ',1,LENGTH(' . $db->quoteName('cl.metakey_prefix') . '))' . ' OR ' . $db->quoteName('a.own_prefix') . ' = 0' . ' AND ' . $db->quoteName('cl.own_prefix') . ' = 0' . ' AND ' . ($prefix == substr($keyword, 0, strlen($prefix)) ? '0 = 0' : '0 != 0'); - $query->bind([':aprefix' . $key, ':clprefix' . $key], $keyword); - - $regexp = '[[:<:]]' . $keyword . '[[:>:]]'; - $condition2 = $db->quoteName('a.metakey') . ' ' . $query->regexp(':aregexp' . $key) . ' '; - $query->bind(':aregexp' . $key, $regexp); + $condition2 = $db->quoteName('a.metakey') . ' ' . $query->regexp($bounded[2]); if ($cid) { - $condition2 .= ' OR ' . $db->quoteName('cl.metakey') . ' ' . $query->regexp(':clregexp' . $key) . ' '; - $query->bind(':clregexp' . $key, $regexp); + $condition2 .= ' OR ' . $db->quoteName('cl.metakey') . ' ' . $query->regexp($bounded[3]) . ' '; } if ($categoryId) { - $condition2 .= ' OR ' . $db->quoteName('cat.metakey') . ' ' . $query->regexp(':catregexp' . $key) . ' '; - $query->bind(':catregexp' . $key, $regexp); + $condition2 .= ' OR ' . $db->quoteName('cat.metakey') . ' ' . $query->regexp($bounded[4]) . ' '; } $temp[] = "($condition1) AND ($condition2)";