Literal SQL search hardening - 2026-08-27
- Search text is now literal (#1073): Request-driven search fields hardened across Storage, public IRC logs, DNSBL proxy browsing, certificate and Trust administration, Web Search Alerts, support chat, SocialGPT audit views, Guestbook administration/API, SpamAssassin user lookup, vBulletin account searches, XBot interaction search, and the legacy MCU search now treat
%, _, and the chosen escape character as normal search text instead of hidden SQL LIKE wildcards. Existing authorization and intentional application-owned patterns such as MIME-type matching are unchanged.
- RSS purge safety: The RSS import block rule "purge now" path now uses the same literal pattern handling before deleting matching feed content, preventing
% or _ in an administrator-entered rule from silently broadening the delete set.