<commit_before><?php 
namespace Concrete\Package\VividStore\Src\VividStore\Utilities;

use Controller;
use User;
use Database;
use URL;

class ProductFinder extends Controller
{
    public function getProductMatch()
    {
        $u = new User();
        if (!$u->isLoggedIn()) {
            echo "Access Denied";
            exit;
        }
        if (!$_POST['query']) {
            echo "Access Denied";
            exit;
        } else {
            $query = $_POST['query'];
            $db = Database::get();
            $results = $db->query('SELECT * FROM VividStoreProducts WHERE pName LIKE "%'.$query.'%"');
            
            if ($results) {
                foreach ($results as $result) {
                    ?>
        
                <li data-product-id="<?=$result['pID']?>"><?=$result['pName']?></li>
        
            <?php 
                } //for each
            } else { //if no results ?>
                <li><?=t("I can't find a product by that name")?></li>
            <?php 
            }
        }
    }
    public function renderProductSearchForm($formName=null, $savedValue=null)
    {
        $randomValue = rand(1, 1000);
        if (!$formName) {
            $formName = 'pID';
        }
        return '
            <div class="product-search-form" id="product-search-form-'.$randomValue.'" data-ajax-url="'.URL::to('/productfinder').'">
                <label class="form-label" for="productSearch-'.$randomValue.'">'.t("Search for a product").'</label>
                <input class="form-control product-search-input" onkeyup="searchForProduct('.$randomValue.')" id="productSearch-'.$randomValue.'" type="text">
                <input type="hidden" class="product-id-field" name="'.$formName.'">
                <div class="product-search-results">
                    <ul class="results-list">
    
                    </ul>
                </div>
                <div class="alert alert-info">
                    <strong>'.t("Selected Product:").'</strong>
                    <span class="selected-product"></span>
                </div>
            </div>
        ';
    }
}<commit_msg>Fixes vulernability.<commit_after><?php 
namespace Concrete\Package\VividStore\Src\VividStore\Utilities;

use Controller;
use User;
use Database;
use URL;

class ProductFinder extends Controller
{
    public function getProductMatch()
    {
        $u = new User();
        if (!$u->isLoggedIn()) {
            echo "Access Denied";
            exit;
        }
        if (!$_POST['query']) {
            echo "Access Denied";
            exit;
        } else {
            $query = $_POST['query'];

            $qb = Database::get()->getEntityManager()->createQueryBuilder();
            $qb->select('p')
                ->from('Concrete\Package\VividStore\Src\VividStore\Product\Product', 'p')
                ->where($qb->expr()->like('p.pName', ':query'))
                ->setParameter('query','%'.$query.'%');
            $results = $qb->getQuery()->getResult();

            if ($results) {
                foreach ($results as $result) {
                    echo '<li data-product-id="'.$result->getID().'">'.$result->getProductName().'</li>';
                }
            } else {
                echo '<li>'.t("I can't find a product by that name").'</li>';
            }
        }
    }
    public function renderProductSearchForm($formName=null, $savedValue=null)
    {
        $randomValue = rand(1, 1000);
        if (!$formName) {
            $formName = 'pID';
        }
        return '
            <div class="product-search-form" id="product-search-form-'.$randomValue.'" data-ajax-url="'.URL::to('/productfinder').'">
                <label class="form-label" for="productSearch-'.$randomValue.'">'.t("Search for a product").'</label>
                <input class="form-control product-search-input" onkeyup="searchForProduct('.$randomValue.')" id="productSearch-'.$randomValue.'" type="text">
                <input type="hidden" class="product-id-field" name="'.$formName.'">
                <div class="product-search-results">
                    <ul class="results-list">
    
                    </ul>
                </div>
                <div class="alert alert-info">
                    <strong>'.t("Selected Product:").'</strong>
                    <span class="selected-product"></span>
                </div>
            </div>
        ';
    }
}
{'fraction_non_alphanumeric': 0.17081447963800905, 'fraction_numerical': 0.0022624434389140274, 'mean_word_length': 1.699023199023199, 'pattern_counts': {'":': 0, '<': 50, '<?xml version=': 0, '>': 63, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '2878459', 'n_tokens_mistral': 1247, 'n_tokens_neox': 1211, 'n_words': 230}