Post by furrywombat » Fri May 01, 2015 5:44 am

Is there any reason why the admin customer model indicates a filter query indicated in the subject, rather than a full LIKE '%EMAIL%' query? If someone had thousands of customers and unsure of the exact email address, how would one go about locating that customer with a substring query? Shouldn't it be:

Code: Select all

$implode[] = "LCASE(c.email) LIKE '%" . $this->db->escape(utf8_strtolower($data['filter_email'])) . "%'";
Just wondering if this was a security concern, or if somebody just forgot to add the other %.

User avatar
New member

Posts

Joined
Sat Oct 19, 2013 9:15 pm
Location - Chair

Post by rph » Sat May 02, 2015 2:04 am

If I remember correctly, it was a choice. You can cheat using an % yourself but the system would be much better with traditional * and ? wildcards in the frontend.

-Ryan


rph
Expert Member

Posts

Joined
Fri Jan 08, 2010 5:05 am
Location - Lincoln, Nebraska

Post by furrywombat » Sat May 02, 2015 2:39 am

Thanks for clearing it up, Ryan!

User avatar
New member

Posts

Joined
Sat Oct 19, 2013 9:15 pm
Location - Chair
Who is online

Users browsing this forum: Google [Bot] and 19 guests