@@ -, +, @@ - 'Cordoba %' - 'Buenos Aires _' - 'London \' --- koha-tmpl/intranet-tmpl/prog/js/datatables.js | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) --- a/koha-tmpl/intranet-tmpl/prog/js/datatables.js +++ a/koha-tmpl/intranet-tmpl/prog/js/datatables.js @@ -579,7 +579,9 @@ jQuery.fn.dataTable.ext.errMode = function(settings, note, message) { function build_query(col, value){ // escape SQL special characters - value = value.replace(/(\%|\_|\\)/g, "\\$1" ); + value_escaped = value.replace(/\\/g, "\\$1" ); + // escape SQL LIKE special characters + value_like_escaped = value.replace(/(\%|\_|\\)/g, "\\$1"); var parts = []; var attributes = col.data.split(':'); @@ -587,13 +589,13 @@ jQuery.fn.dataTable.ext.errMode = function(settings, note, message) { var part = {}; var attr = attributes[i]; let criteria = options.criteria; - if ( value.match(/^\^(.*)\$$/) ) { - value = value.replace(/^\^/, '').replace(/\$$/, ''); + if ( value_escaped.match(/^\^(.*)\$$/) ) { + value_escaped = value_escaped.replace(/^\^/, '').replace(/\$$/, ''); criteria = "exact"; } part[!attr.includes('.')?'me.'+attr:attr] = criteria === 'exact' - ? value - : {like: (['contains', 'ends_with'].indexOf(criteria) !== -1?'%':'') + value + (['contains', 'starts_with'].indexOf(criteria) !== -1?'%':'')}; + ? value_escaped + : {like: (['contains', 'ends_with'].indexOf(criteria) !== -1?'%':'') + value_like_escaped + (['contains', 'starts_with'].indexOf(criteria) !== -1?'%':'')}; parts.push(part); } return parts; --