parent
93bccf8fe2
commit
7d9b94c79e
2 changed files with 11 additions and 2 deletions
|
@ -1164,6 +1164,15 @@ Zotero.Utilities.Internal = {
|
|||
},
|
||||
|
||||
|
||||
/**
|
||||
* Escape '_', '%', and '\' in an SQL LIKE expression so that it can be used with ESCAPE '\' to
|
||||
* prevent the wildcards from having special meaning
|
||||
*/
|
||||
escapeSQLExpression: function (expr) {
|
||||
return expr.replace(/([_%\\])/g, '\\$1');
|
||||
},
|
||||
|
||||
|
||||
buildLibraryMenu: function (menulist, libraries, selectedLibraryID) {
|
||||
var menupopup = menulist.firstChild;
|
||||
while (menupopup.hasChildNodes()) {
|
||||
|
|
|
@ -71,8 +71,8 @@ ZoteroAutoComplete.prototype.startSearch = Zotero.Promise.coroutine(function* (s
|
|||
break;
|
||||
|
||||
case 'tag':
|
||||
var sql = "SELECT DISTINCT name AS val, NULL AS comment FROM tags WHERE name LIKE ?";
|
||||
var sqlParams = [searchString + '%'];
|
||||
var sql = "SELECT DISTINCT name AS val, NULL AS comment FROM tags WHERE name LIKE ? ESCAPE '\\'";
|
||||
var sqlParams = [Zotero.Utilities.Internal.escapeSQLExpression(searchString) + '%'];
|
||||
if (searchParams.libraryID !== undefined) {
|
||||
sql += " AND tagID IN (SELECT tagID FROM itemTags JOIN items USING (itemID) "
|
||||
+ "WHERE libraryID=?)";
|
||||
|
|
Loading…
Reference in a new issue