← Back to docs

Literal SQL search hardening - 2026-08-27

Literal SQL search hardening - 2026-08-27

  • Search text is now literal (#1073): Request-driven search fields hardened across Storage, public IRC logs, DNSBL proxy browsing, certificate and Trust administration, Web Search Alerts, support chat, SocialGPT audit views, Guestbook administration/API, SpamAssassin user lookup, vBulletin account searches, XBot interaction search, and the legacy MCU search now treat %, _, and the chosen escape character as normal search text instead of hidden SQL LIKE wildcards. Existing authorization and intentional application-owned patterns such as MIME-type matching are unchanged.
  • RSS purge safety: The RSS import block rule "purge now" path now uses the same literal pattern handling before deleting matching feed content, preventing % or _ in an administrator-entered rule from silently broadening the delete set.