@@ -36,6 +36,15 @@ func need_escape(keyword string) bool {
36
36
return false
37
37
}
38
38
39
+ func escape_name (name string ) string {
40
+ dbadapter , _ := web .AppConfig .String ("db_adapter" )
41
+ ch := "`"
42
+ if strings .EqualFold (dbadapter , "postgres" ) {
43
+ ch = `"`
44
+ }
45
+ return fmt .Sprintf ("%s%s%s" , ch , name , ch )
46
+ }
47
+
39
48
func NewDocumentSearchResult () * DocumentSearchResult {
40
49
return & DocumentSearchResult {}
41
50
}
@@ -294,7 +303,7 @@ WHERE (book.privately_owned = 0 OR rel1.relationship_id > 0 or team.team_member_
294
303
func (m * DocumentSearchResult ) SearchDocument (keyword string , bookId int ) (docs []* DocumentSearchResult , err error ) {
295
304
o := orm .NewOrm ()
296
305
297
- sql := ` SELECT * FROM md_documents WHERE book_id = ? AND (document_name LIKE ? OR "release" LIKE ?) `
306
+ sql := fmt . Sprintf ( " SELECT * FROM md_documents WHERE book_id = ? AND (document_name LIKE ? OR %s LIKE ?) " , escape_name ( "release" ))
298
307
keyword = "%" + keyword + "%"
299
308
300
309
_need_escape := need_escape (keyword )
@@ -313,7 +322,7 @@ func (m *DocumentSearchResult) SearchDocument(keyword string, bookId int) (docs
313
322
func (m * DocumentSearchResult ) SearchAllDocument (keyword string ) (docs []* DocumentSearchResult , err error ) {
314
323
o := orm .NewOrm ()
315
324
316
- sql := ` SELECT * FROM md_documents WHERE (document_name LIKE ? OR "release" LIKE ?) `
325
+ sql := fmt . Sprintf ( " SELECT * FROM md_documents WHERE (document_name LIKE ? OR %s LIKE ?) " , escape_name ( "release" ))
317
326
keyword = "%" + keyword + "%"
318
327
319
328
_need_escape := need_escape (keyword )
0 commit comments