Properly escape search queries for links, lists and tags (#163)

app/Helper/functions.php

@@ -213,3 +213,18 @@ function getVersionFromPackage(): ?string
 
     return isset($package->version) ? 'v' . $package->version : null;
 }
+
+/**
+ * Properly escape symbols used in search queries.
+ *
+ * @param string $query
+ * @return string
+ */
+function escapeSearchQuery(string $query): string
+{
+    return str_replace(
+        ['\\', '%', '_', '*'],
+        ['\\\\', '\\%', '\\_', '\\*'],
+        $query
+    );
+}

app/Http/Controllers/FetchController.php

@@ -28,7 +28,7 @@ class FetchController extends Controller
         }
 
         $tags = Tag::byUser(auth()->user()->id)
-            ->where('name', 'like', '%' . $query . '%')
+            ->where('name', 'like', '%' . escapeSearchQuery($query) . '%')
             ->orderBy('name', 'asc')
             ->get();
 
@@ -60,7 +60,7 @@ class FetchController extends Controller
         }
 
         $tags = LinkList::byUser(auth()->user()->id)
-            ->where('name', 'like', '%' . $query . '%')
+            ->where('name', 'like', '%' . escapeSearchQuery($query) . '%')
             ->orderBy('name', 'asc')
             ->get();
 

app/Http/Controllers/Traits/SearchesLinks.php

@@ -41,7 +41,7 @@ trait SearchesLinks
 
         // Search for the URL
         if ($this->searchQuery = $request->input('query', false)) {
-            $query = '%' . $this->searchQuery . '%';
+            $query = '%' . escapeSearchQuery($this->searchQuery) . '%';
             $search->where('url', 'like', $query);
 
             // Also search for the title if applicable