Skip to content

Commit 7b7e4cc

Browse files
committed
Escape search input in SQLite FTS queries
The search term is now properly escaped when used in SQLite full-text search queries to prevent syntax errors with quotes. This ensures searches containing quotes work correctly.
1 parent 3312556 commit 7b7e4cc

File tree

1 file changed

+4
-2
lines changed

1 file changed

+4
-2
lines changed

examples/official-site/search.sql

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,12 +24,14 @@ SELECT 'text' as type,
2424
'Search for components, parameters, functions...' as placeholder,
2525
$search as value;
2626

27+
set escaped_search = '"' || replace($search, '"', '""') || '"';
28+
2729
SELECT 'text' as component,
2830
CASE
2931
WHEN $search IS NULL THEN 'Enter a search term above to find documentation about components, parameters, functions, and blog posts.'
3032
WHEN NOT EXISTS (
3133
SELECT 1 FROM documentation_fts
32-
WHERE documentation_fts = $search
34+
WHERE documentation_fts = $escaped_search
3335
) THEN 'No results found for "' || $search || '".'
3436
ELSE NULL
3537
END as contents;
@@ -96,7 +98,7 @@ WITH search_results AS (
9698
rank
9799
FROM documentation_fts
98100
WHERE $search IS NOT NULL
99-
AND documentation_fts = $search
101+
AND documentation_fts = $escaped_search
100102
)
101103
SELECT
102104
max(title) as title,

0 commit comments

Comments
 (0)