diff --git a/client_locations.php b/client_locations.php index 88e77774..734a6d1c 100644 --- a/client_locations.php +++ b/client_locations.php @@ -6,6 +6,19 @@ $order = "ASC"; require_once "inc_all_client.php"; +// Tags Filter +if (isset($_GET['tags']) && is_array($_GET['tags']) && !empty($_GET['tags'])) { + // Sanitize each element of the status array + $sanitizedTags = array(); + foreach ($_GET['tags'] as $tag) { + // Escape each status to prevent SQL injection + $sanitizedTags[] = "'" . intval($tag) . "'"; + } + + // Convert the sanitized tags into a comma-separated string + $sanitizedTagsString = implode(",", $sanitizedTags); + $tag_query = "AND tags.tag_id IN ($sanitizedTagsString)"; +} //Rebuild URL $url_query_strings_sort = http_build_query($get_copy); @@ -16,6 +29,7 @@ $sql = mysqli_query( LEFT JOIN location_tags ON location_tags.location_id = locations.location_id LEFT JOIN tags ON tags.tag_id = location_tags.tag_id WHERE location_client_id = $client_id + $tag_query AND location_$archive_query AND (location_name LIKE '%$q%' OR location_description LIKE '%$q%' OR location_address LIKE '%$q%' OR location_phone LIKE '%$phone_query%' OR tag_name LIKE '%$q%') GROUP BY location_id @@ -62,7 +76,23 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()")); -