CVE-2016-7780: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: SQL injection vulnerability in cron/find_help.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the version parameter.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2017-03-07T16:59Z
Repository: https://github.com/exponentcms/exponent-cms
Language: PHP
Files changed: cron/find_help.php, framework/modules/ecommerce/controllers/cartController.php, framework/modules/ecommerce/controllers/purchaseOrderController.php, framework/modules/ecommerce/controllers/storeController.php, framework/modules/file/controllers/fileController.php, framework/modules/users/controllers/usersController.php
Commit date: 2016-09-29 23:30:24 -0400
Commit message: second effort to greatly enhance system security (xss, sql inject, file exploit, rce, etc...), thanks to felixk3y

Diff: diff --git a/cron/find_help.php b/cron/find_help.php
index 1a326de789..56a089ab6b 100644
--- a/cron/find_help.php
+++ b/cron/find_help.php
@@ -37,11 +37,11 @@
         if (!empty($_GET['verbose'])) {
             $verbose = true;
         }
         if (!empty($_GET['version'])) {
             $version_title = $_GET['version'];
-            $version = $db->selectValue('help_version', 'id', 'version="' . expString::sanitize($_GET['version']) . '"');
+            $version = $db->selectValue('help_version', 'id', 'version="' . expString::escape($_GET['version']) . '"');
         }
     }
     /**
      * find_help.php - attempts to auto-check all ExponentCMS help links
      * by collecting them and checking them against the doc.exponentcms.org db tables
diff --git a/framework/modules/ecommerce/controllers/cartController.php b/framework/modules/ecommerce/controllers/cartController.php
index 63b8dfb3a2..2291802a75 100755
--- a/framework/modules/ecommerce/controllers/cartController.php
+++ b/framework/modules/ecommerce/controllers/cartController.php
@@ -72,16 +72,16 @@ class cartController extends expController {
 
             foreach ($this->params['prod-quantity'] as $qkey=> &$quantity) {
                 if (in_array($qkey, $this->params['prod-check'])) {
                     //this might not be working...FJD
                     $child = new $product_type($qkey);
-                    /*if ($quantity < $child->minimum_order_quantity)                       
+                    /*if ($quantity < $child->minimum_order_quantity)
                     {
-                        flash('message', $child->title . " - " . $child->model . " has a minimum order quantity of " . $child->minimum_order_quantity . 
+                        flash('message', $child->title . " - " . $child->model . " has a minimum order quantity of " . $child->minimum_order_quantity .
                         '. Your quantity has been adjusted accordingly.');
                         $quantity = $child->minimum_order_quantity;
-                        
+
                     }*/
                     $this->params['children'][$qkey] = $quantity;
                 }
                 if (isset($child)) $this->params['product_id'] = $child->parent_id;
             }
@@ -169,11 +169,11 @@ class cartController extends expController {
             //FIXME though currently unused we don't account for minimym nor multiple quantity settings
             $id      = str_replace('quantity-', '', $this->params['id']);
             $item    = new orderitem($id);
             $updates = new stdClass();
             if (!empty($item->id)) {
-                //$newqty = $item->product->updateQuantity($this->params['value']);                  
+                //$newqty = $item->product->updateQuantity($this->params['value']);
                 $newqty = $item->product->updateQuantity($this->params['value']);
                 if ($newqty > $item->product->quantity) {
                     if ($item->product->availability_type == 1) {
                         $diff             = ($item->product->quantity <= 0) ? $newqty : $newqty - $item->product->quantity;
                         $updates->message = 'Only ' . $item->product->quantity . ' ' . $item->products_name . ' are currently in stock. Shipping may be delayed on the other ' . $diff;
@@ -215,14 +215,14 @@ class cartController extends expController {
                 //{
                 foreach ($order->orderitem as $orderItem) {
                     if ($orderItem->product_id == $item->product_id) $qCheck += $orderItem->quantity;
                 }
                 //eDebug("Done",true);
-                //}                           
-                /*eDebug($item->quantity);   
-                eDebug($item->product->quantity); 
-                eDebug($qCheck);                  
+                //}
+                /*eDebug($item->quantity);
+                eDebug($item->product->quantity);
+                eDebug($qCheck);
                 eDebug($newqty,true);  */
                 //check minimum quantity
                 $qtyMessage = '';
                 if ($newqty < $item->product->minimum_order_quantity) {
                     $qtyMessage = $item->product->title . ' has a minimum order quantity of ' . $item->product->minimum_order_quantity . '. The quantity has been adjusted and added to your cart.<br/><br/>';
@@ -241,11 +241,11 @@ class cartController extends expController {
                         $diff        = ($item->product->quantity <= 0) ? $newqty : $newqty - $item->product->quantity;
                         $itemMessage = gt('Only') . ' ' . $item->product->quantity . ' ' . $item->products_name . ' ' . gt('are currently in stock. Shipping may be delayed on the other') . ' ' . $diff . "<br/><br/>";
                         //$updates->message = 'Only '.$item->product->quantity.' '.$item->products_name.' are currently in stock. Shipping may be delayed on the other '.$diff;
                     } elseif ($item->product->availability_type == 2) {
                         flash('error', $item->products_name . ' ' . gt('only has') . ' ' . $item->product->quantity . ' ' . gt('on hand. You can not add any more than that to your cart.'));
-                        /*$updates->message = $item->products_name.' only has '.$item->product->quantity.' on hand. You can not add any more to your cart.';                        
+                        /*$updates->message = $item->products_name.' only has '.$item->product->quantity.' on hand. You can not add any more to your cart.';
                         $updates->cart_total = '$'.number_format($order->getCartTotal(), 2);
                         $updates->item_total = '$'.number_format($item->quantity*$item->products_price, 2);
                         $updates->item_id = $id;
                         $updates->quantity = $item->product->quantity;
                         echo json_encode($updates);  */
@@ -300,19 +300,19 @@ class cartController extends expController {
 //            $shipping->getRates();
             $order->calculateGrandTotal();
 
             //eDebug($order,true);
             //check to see if we have calculate shipping yet - if shipping_total_before_discounts is set
-            //to something other than 0, then we have, but we'll set the estimtae to shipping_total to 
+            //to something other than 0, then we have, but we'll set the estimtae to shipping_total to
             //accomodate any applied discounts
             //if (!empty($order->shipping_total_before_discounts))
             //{
             //    $estimated_shipping = $order->shipping_total;
             //}
             //otherwise we'll grab an estimate
             //else
-            //{    
+            //{
             //$estimated_shipping = shipping::estimateShipping($order);
             /* $shipping = new shipping();
           $shipping->getRates();
           //eDebug($shipping,true);
           $estimated_shipping = $shipping->pricelist['01']['cost'];*/
@@ -330,11 +330,11 @@ class cartController extends expController {
                 assign_to_template(array(
                     'noactivediscounts'=> '1'
                 ));
                 $discounts = null;
             } else {
-                // get all current discount codes that are valid and applied                
+                // get all current discount codes that are valid and applied
                 $discounts = $order->validateDiscounts();
             }
         } else {
             $order              = new stdClass();
             $order->orderitem   = new stdClass();
@@ -701,11 +701,11 @@ class cartController extends expController {
 //        }
 
         if (empty($result->errorCode)) {
             // if ($result->errorCode === "0" || $result->errorCode === 0)
             // {
-            // save out the cart total to the database		
+            // save out the cart total to the database
             $billing->billingmethod->update(array('billing_cost'=> $order->grand_total));
 
             // set the invoice number and purchase date in the order table..this finializes the order
             //$invoice_num = $db->max('orders', 'invoice_id') + 1;
             //if ($invoice_num < ecomconfig::getConfig('starting_invoice_number')) $invoice_num += ecomconfig::getConfig('starting_invoice_number');
@@ -1067,15 +1067,15 @@ class cartController extends expController {
         global $order;
         //lookup discount to see if it's real and valid, and not already in our cart
         //this will change once we allow more than one coupon code
 
         $discount = new discounts();
-        $discount = $discount->getCouponByName($this->params['coupon_code']);
+        $discount = $discount->getCouponByName(expString::escape($this->params['coupon_code']));
 
         if (empty($discount)) {
             flash('error', gt("This discount code you entered does not exist."));
-            //redirect_to(array('controller'=>'cart', 'action'=>'checkout'));       
+            //redirect_to(array('controller'=>'cart', 'action'=>'checkout'));
             expHistory::back();
         }
 
         //check to see if it's in our cart already
         if ($this->isDiscountInCart($discount->id)) {
@@ -1098,11 +1098,11 @@ class cartController extends expController {
             // set this to just the discount applied via this coupon?? if so, when though? $od->discount_total = ??;
             flash('message', gt("The discount code has been applied to your cart."));
         } else {
             flash('error', $validateDiscountMessage);
         }
-        //redirect_to(array('controller'=>'cart', 'action'=>'checkout'));                           
+        //redirect_to(array('controller'=>'cart', 'action'=>'checkout'));
         expHistory::back();
     }
 
     function removeDiscountFromCart($id = null, $redirect = true) {
         //eDebug($params);
@@ -1139,15 +1139,15 @@ class cartController extends expController {
 //    }
 
     //this is ran after we alter the quantity of the cart, including
     //delete items or runing the updatequantity action
     private function rebuildCart() {
-        //group items by type and id               
+        //group items by type and id
         //since we can have the same product in different items (options and quantity discount)
         //remove items and readd?
         global $order;
-        //eDebug($order,true); 
+        //eDebug($order,true);
         $items = $order->orderitem;
         foreach ($order->orderitem as $item) {
             $item->delete();
         }
         $order->orderitem = array();
@@ -1183,24 +1183,24 @@ class cartController extends expController {
                 $order->refresh();
             }
         }
         $order->save();
         /*eDebug($items);
-        
-        
-        $options = array();  
+
+
+        $options = array();
         foreach ($this->optiongroup as $og) {
             if ($og->required && empty($params['options'][$og->id][0])) {
-                
+
                 flash('error', $this->title.' '.gt('requires some options to be selected before you can add it to your cart.'));
                 redirect_to(array('controller'=>store, 'action'=>'show', 'id'=>$this->id));
             }
             if (!empty($params['options'][$og->id])) {
                 foreach ($params['options'][$og->id] as $opt_id) {
                     $selected_option = new option($opt_id);
                     $cost = $selected_option->modtype == '$' ? $selected_option->amount :  $this->getBasePrice() * ($selected_option->amount * .01);
-                    $cost = $selected_option->updown == '+' ? $cost : $cost * -1;                      
+                    $cost = $selected_option->updown == '+' ? $cost : $cost * -1;
                     $price += $cost;
                     $options[] = array($selected_option->id,$selected_option->title,$selected_option->modtype,$selected_option->updown,$selected_option->amount);
                 }
             }
         }
@@ -1210,11 +1210,11 @@ class cartController extends expController {
         $params['products_price'] = $price;
         $item = new orderitem($params);
         //eDebug($item, true);
         $item->products_price = $price;
         $item->options = serialize($options);
-        
+
         $sm = $order->getCurrentShippingMethod();
         $item->shippingmethods_id = $sm->id;
         $item->save();                            */
         return true;
 
diff --git a/framework/modules/ecommerce/controllers/purchaseOrderController.php b/framework/modules/ecommerce/controllers/purchaseOrderController.php
index e87f1e8ff1..75eba637d5 100644
--- a/framework/modules/ecommerce/controllers/purchaseOrderController.php
+++ b/framework/modules/ecommerce/controllers/purchaseOrderController.php
@@ -117,11 +117,11 @@ class purchaseOrderController extends expController {
     }
 
 	public function getPurchaseOrderByJSON() {
 
 		if(!empty($this->params['vendor'])) {
-			$purchase_orders = $this->purchase_order->find('all', 'vendor_id=' . $this->params['vendor']);
+			$purchase_orders = $this->purchase_order->find('all', 'vendor_id=' . expString::escape($this->params['vendor']));
 		} else {
 			$purchase_orders = $this->purchase_order->find('all');
 		}
 
 		echo json_encode($purchase_orders);
diff --git a/framework/modules/ecommerce/controllers/storeController.php b/framework/modules/ecommerce/controllers/storeController.php
index bafe73433c..7d9dfd2413 100755
--- a/framework/modules/ecommerce/controllers/storeController.php
+++ b/framework/modules/ecommerce/controllers/storeController.php
@@ -852,11 +852,11 @@ class storeController extends expController {
 
         expHistory::set('viewable', $this->params);
 //        $classname = $db->selectValue('product', 'product_type', 'id=' . $this->params['id']);
 //        $product   = new $classname($this->params['id'], true, true);
 
-        $id = isset($this->params['title']) ? $this->params['title'] : $this->params['id'];
+        $id = isset($this->params['title']) ? expString::escape($this->params['title']) : $this->params['id'];
         $product = new product($id);
         $product_type = new $product->product_type($product->id);
         $product_type->title = expString::parseAndTrim($product_type->title, true);
         $product_type->image_alt_tag = expString::parseAndTrim($product_type->image_alt_tag, true);
 
@@ -906,11 +906,11 @@ class storeController extends expController {
     function showByTitle() {
         global $order, $template, $user;
         //need to add a check here for child product and redirect to parent if hit directly by ID
         expHistory::set('viewable', $this->params);
 
-        $product = new product(addslashes($this->params['title']));
+        $product = new product(expString::escape($this->params['title']));
         $product_type = new $product->product_type($product->id);
         $product_type->title = expString::parseAndTrim($product_type->title, true);
         $product_type->image_alt_tag = expString::parseAndTrim($product_type->image_alt_tag, true);
 
         //if we're trying to view a child product directly, then we redirect to it's parent show view
@@ -950,11 +950,11 @@ class storeController extends expController {
     function showByModel() {
         global $order, $template, $db;
 
         expHistory::set('viewable', $this->params);
         $product = new product();
-        $model = $product->find("first", 'model="' . $this->params['model'] . '"');
+        $model = $product->find("first", 'model="' . expString::escape($this->params['model']) . '"');
         //eDebug($model);
         $product_type = new $model->product_type($model->id);
         //eDebug($product_type);
         $tpl = $product_type->getForm('show');
         if (!empty($tpl)) $template = new controllertemplate($this, $tpl);
@@ -971,11 +971,11 @@ class storeController extends expController {
 //        global $db;
 
         expHistory::set('viewable', $this->params);
 //        $parent = isset($this->params['cat']) ? $this->params['cat'] : expSession::get('catid');
         $catid = expSession::get('catid');
-        $parent = !empty($catid) ? $catid : (!empty($this->params['cat']) ? $this->params['cat'] : 0);
+        $parent = !empty($catid) ? $catid : (!empty($this->params['cat']) ? intval($this->params['cat']) : 0);
         $category = new storeCategory($parent);
         $categories = $category->getEcomSubcategories();
         $ancestors = $category->pathToNode();
         assign_to_template(array(
             'categories' => $categories,
@@ -1648,11 +1648,11 @@ class storeController extends expController {
         }
     }
 
     function searchByModelForm() {
         // get the search terms
-        $terms = $this->params['search_string'];
+        $terms = expString::escape($this->params['search_string']);
 
         $sql = "model like '%" . $terms . "%'";
 
         $limit = !empty($this->config['limit']) ? $this->config['limit'] : 10;
         $page = new expPaginator(array(
@@ -1686,10 +1686,11 @@ class storeController extends expController {
 
         $sql = "select DISTINCT(p.id) as id, p.title, model from " . $db->prefix . "product as p WHERE ";
         if (!($user->isAdmin())) $sql .= '(p.active_type=0 OR p.active_type=1) AND ';
 
         //if first character of search is a -, then we do a wild card, else from beginning
+        $this->params['query'] = expString::escape($this->params['query']);
         if ($this->params['query'][0] == '-') {
             $sql .= " p.model LIKE '%" . $this->params['query'];
         } else {
             $sql .= " p.model LIKE '" . $this->params['query'];
         }
@@ -1707,10 +1708,11 @@ class storeController extends expController {
      *
      */
     public function search() {
         global $db, $user;
 
+        $this->params['query'] = expString::escape($this->params['query']);
         if (SAVE_SEARCH_QUERIES && INCLUDE_AJAX_SEARCH == 1) {  // only to add search query record
             $qry = trim($this->params['query']);
             if (!empty($qry)) {
                 if (INCLUDE_ANONYMOUS_SEARCH == 1 || $user->id <> 0) {
                     $queryObj = new stdClass();
@@ -1806,10 +1808,12 @@ class storeController extends expController {
      * AJAX search for products by title, description, or model/sku
      *
      */
     public function searchNew() {
         global $db, $user;
+
+        $this->params['query'] = expString::escape($this->params['query']);
         //$this->params['query'] = str_ireplace('-','\-',$this->params['query']);
         $sql = "select DISTINCT(p.id) as id, p.title, model, sef_url, f.id as fileid, ";
         $sql .= "match (p.title,p.model,p.body) against ('" . $this->params['query'] . "*' IN BOOLEAN MODE) as relevance, ";
         $sql .= "CASE when p.model like '" . $this->params['query'] . "%' then 1 else 0 END as modelmatch, ";
         $sql .= "CASE when p.title like '%" . $this->params['query'] . "%' then 1 else 0 END as titlematch ";
diff --git a/framework/modules/file/controllers/fileController.php b/framework/modules/file/controllers/fileController.php
index 27dc1f1c4a..5af374a4a9 100755
--- a/framework/modules/file/controllers/fileController.php
+++ b/framework/modules/file/controllers/fileController.php
@@ -250,24 +250,24 @@ class fileController extends expController {
 //        $dir = 'asc'; // default sort dir is asc
 //        $sort_dir = SORT_ASC;
 
         // How many records to get?
         if(strlen($this->params['results']) > 0) {
-            $results = $this->params['results'];
+            $results = intval($this->params['results']);
         }
 
         // Start at which record?
         if(strlen($this->params['startIndex']) > 0) {
-            $startIndex = $this->params['startIndex'];
+            $startIndex = intval($this->params['startIndex']);
         }
 
         // Sorted?
         if(strlen($this->params['sort']) > 0) {
             if ($this->params['sort'] == 'cat') {
                 $sort = 'id';
             } else {
-                $sort = $this->params['sort'];
+                $sort = expString::escape($this->params['sort']);
             }
 //            if ($sort = 'id') $sort = 'filename';
         }
 
         // Sort dir?
@@ -279,10 +279,11 @@ class fileController extends expController {
             $sort_dir = SORT_ASC;
         }
         $totalrecords = 0;
 
         if (!empty($this->params['query'])) {
+            $this->params['query'] = expString::escape($this->params['query']);
             $filter = '';
             if (!$user->isAdmin()) {
                 $filter = "(poster=".$user->id." OR shared=1) AND ";
             };
 //            if ($this->params['update']=='ck' || $this->params['update']=='tiny') {
diff --git a/framework/modules/users/controllers/usersController.php b/framework/modules/users/controllers/usersController.php
index 207c24959d..55cedbd5a5 100755
--- a/framework/modules/users/controllers/usersController.php
+++ b/framework/modules/users/controllers/usersController.php
@@ -840,21 +840,21 @@ class usersController extends expController {
         $dir = 'asc'; // default sort dir is asc
         $sort_dir = SORT_ASC;
 
         // How many records to get?
         if (strlen($this->params['results']) > 0) {
-            $results = $this->params['results'];
+            $results = intval($this->params['results']);
         }
 
         // Start at which record?
         if (strlen($this->params['startIndex']) > 0) {
-            $startIndex = $this->params['startIndex'];
+            $startIndex = intval($this->params['startIndex']);
         }
 
         // Sorted?
         if (strlen($this->params['sort']) > 0) {
-            $sort = $this->params['sort'];
+            $sort = expString::escape($this->params['sort']);
             if ($sort = 'id') $sort = 'username';
         }
 
         if (!empty($this->params['filter'])) {
             switch ($this->params['filter']) {
@@ -891,15 +891,14 @@ class usersController extends expController {
             $sort_dir = SORT_ASC;
         }
 
         if (!empty($this->params['query'])) {
 
-//            $this->params['query'] = $this->params['query'];
+            $this->params['query'] = expString::escape($this->params['query']);
             $totalrecords = $this->$modelname->find('count', (empty($filter) ? '' : $filter . " AND ") . "(username LIKE '%" . $this->params['query'] . "%' OR firstname LIKE '%" . $this->params['query'] . "%' OR lastname LIKE '%" . $this->params['query'] . "%' OR email LIKE '%" . $this->params['query'] . "%')");
 
             $users = $this->$modelname->find('all', (empty($filter) ? '' : $filter . " AND ") . "(username LIKE '%" . $this->params['query'] . "%' OR firstname LIKE '%" . $this->params['query'] . "%' OR lastname LIKE '%" . $this->params['query'] . "%' OR email LIKE '%" . $this->params['query'] . "%')", $sort . ' ' . $dir, $results, $startIndex);
-
             for ($i = 0, $iMax = count($users); $i < $iMax; $i++) {
                 if (ECOM == 1) {
                     $users[$i]->usernamelabel = "<a href='viewuser/{$users[$i]->id}'  class='fileinfo'>{$users[$i]->username}</a>";
                 } else {
                     $users[$i]->usernamelabel = $users[$i]->username;

Vulnerable code:             $version = $db->selectValue('help_version', 'id', 'version="' . expString::sanitize($_GET['version']) . '"');
                    /*if ($quantity < $child->minimum_order_quantity)                       
                        flash('message', $child->title . " - " . $child->model . " has a minimum order quantity of " . $child->minimum_order_quantity . 
                        
                //$newqty = $item->product->updateQuantity($this->params['value']);                  
                //}                           
                /*eDebug($item->quantity);   
                eDebug($item->product->quantity); 
                eDebug($qCheck);                  
                        /*$updates->message = $item->products_name.' only has '.$item->product->quantity.' on hand. You can not add any more to your cart.';                        
            //to something other than 0, then we have, but we'll set the estimtae to shipping_total to 
            //{    
                // get all current discount codes that are valid and applied                
            // save out the cart total to the database		
        $discount = $discount->getCouponByName($this->params['coupon_code']);
            //redirect_to(array('controller'=>'cart', 'action'=>'checkout'));       
        //redirect_to(array('controller'=>'cart', 'action'=>'checkout'));                           
        //group items by type and id               
        //eDebug($order,true); 
        
        
        $options = array();  
                
                    $cost = $selected_option->updown == '+' ? $cost : $cost * -1;                      
        
			$purchase_orders = $this->purchase_order->find('all', 'vendor_id=' . $this->params['vendor']);
        $id = isset($this->params['title']) ? $this->params['title'] : $this->params['id'];
        $product = new product(addslashes($this->params['title']));
        $model = $product->find("first", 'model="' . $this->params['model'] . '"');
        $parent = !empty($catid) ? $catid : (!empty($this->params['cat']) ? $this->params['cat'] : 0);
        $terms = $this->params['search_string'];
            $results = $this->params['results'];
            $startIndex = $this->params['startIndex'];
                $sort = $this->params['sort'];
            $results = $this->params['results'];
            $startIndex = $this->params['startIndex'];
            $sort = $this->params['sort'];
//            $this->params['query'] = $this->params['query'];

Fixed code:             $version = $db->selectValue('help_version', 'id', 'version="' . expString::escape($_GET['version']) . '"');
                    /*if ($quantity < $child->minimum_order_quantity)
                        flash('message', $child->title . " - " . $child->model . " has a minimum order quantity of " . $child->minimum_order_quantity .

                //$newqty = $item->product->updateQuantity($this->params['value']);
                //}
                /*eDebug($item->quantity);
                eDebug($item->product->quantity);
                eDebug($qCheck);
                        /*$updates->message = $item->products_name.' only has '.$item->product->quantity.' on hand. You can not add any more to your cart.';
            //to something other than 0, then we have, but we'll set the estimtae to shipping_total to
            //{
                // get all current discount codes that are valid and applied
            // save out the cart total to the database
        $discount = $discount->getCouponByName(expString::escape($this->params['coupon_code']));
            //redirect_to(array('controller'=>'cart', 'action'=>'checkout'));
        //redirect_to(array('controller'=>'cart', 'action'=>'checkout'));
        //group items by type and id
        //eDebug($order,true);


        $options = array();

                    $cost = $selected_option->updown == '+' ? $cost : $cost * -1;

			$purchase_orders = $this->purchase_order->find('all', 'vendor_id=' . expString::escape($this->params['vendor']));
        $id = isset($this->params['title']) ? expString::escape($this->params['title']) : $this->params['id'];
        $product = new product(expString::escape($this->params['title']));
        $model = $product->find("first", 'model="' . expString::escape($this->params['model']) . '"');
        $parent = !empty($catid) ? $catid : (!empty($this->params['cat']) ? intval($this->params['cat']) : 0);
        $terms = expString::escape($this->params['search_string']);
        $this->params['query'] = expString::escape($this->params['query']);
        $this->params['query'] = expString::escape($this->params['query']);

        $this->params['query'] = expString::escape($this->params['query']);
            $results = intval($this->params['results']);
            $startIndex = intval($this->params['startIndex']);
                $sort = expString::escape($this->params['sort']);
            $this->params['query'] = expString::escape($this->params['query']);
            $results = intval($this->params['results']);
            $startIndex = intval($this->params['startIndex']);
            $sort = expString::escape($this->params['sort']);
            $this->params['query'] = expString::escape($this->params['query']);