CVE-2016-9025: Improper Input Validation (CWE-20)
value: Exponent CMS before 2.6.0 has improper input validation in purchaseOrderController.php.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 9.8
Published: 2020-12-31T03:15Z
Repository: https://github.com/exponentcms/exponent-cms
Language: PHP
Files changed: cron/find_help.php, framework/modules/ecommerce/controllers/cartController.php, framework/modules/ecommerce/controllers/purchaseOrderController.php, framework/modules/ecommerce/controllers/storeController.php, framework/modules/file/controllers/fileController.php, framework/modules/users/controllers/usersController.php
Commit date: 2016-09-29 23:30:24 -0400
Commit message: second effort to greatly enhance system security (xss, sql inject, file exploit, rce, etc...), thanks to felixk3y

Diff: diff --git a/cron/find_help.php b/cron/find_help.php
index 1a326de789..56a089ab6b 100644
--- a/cron/find_help.php
+++ b/cron/find_help.php
@@ -37,11 +37,11 @@
         if (!empty($_GET['verbose'])) {
             $verbose = true;
         }
         if (!empty($_GET['version'])) {
             $version_title = $_GET['version'];
-            $version = $db->selectValue('help_version', 'id', 'version="' . expString::sanitize($_GET['version']) . '"');
+            $version = $db->selectValue('help_version', 'id', 'version="' . expString::escape($_GET['version']) . '"');
         }
     }
     /**
      * find_help.php - attempts to auto-check all ExponentCMS help links
      * by collecting them and checking them against the doc.exponentcms.org db tables
diff --git a/framework/modules/ecommerce/controllers/cartController.php b/framework/modules/ecommerce/controllers/cartController.php
index 63b8dfb3a2..2291802a75 100755
--- a/framework/modules/ecommerce/controllers/cartController.php
+++ b/framework/modules/ecommerce/controllers/cartController.php
@@ -72,16 +72,16 @@ class cartController extends expController {
 
             foreach ($this->params['prod-quantity'] as $qkey=> &$quantity) {
                 if (in_array($qkey, $this->params['prod-check'])) {
                     //this might not be working...FJD
                     $child = new $product_type($qkey);
-                    /*if ($quantity < $child->minimum_order_quantity)                       
+                    /*if ($quantity < $child->minimum_order_quantity)
                     {
-                        flash('message', $child->title . " - " . $child->model . " has a minimum order quantity of " . $child->minimum_order_quantity . 
+                        flash('message', $child->title . " - " . $child->model . " has a minimum order quantity of " . $child->minimum_order_quantity .
                         '. Your quantity has been adjusted accordingly.');
                         $quantity = $child->minimum_order_quantity;
-                        
+
                     }*/
                     $this->params['children'][$qkey] = $quantity;
                 }
                 if (isset($child)) $this->params['product_id'] = $child->parent_id;
             }
@@ -169,11 +169,11 @@ class cartController extends expController {
             //FIXME though currently unused we don't account for minimym nor multiple quantity settings
             $id      = str_replace('quantity-', '', $this->params['id']);
             $item    = new orderitem($id);
             $updates = new stdClass();
             if (!empty($item->id)) {
-                //$newqty = $item->product->updateQuantity($this->params['value']);                  
+                //$newqty = $item->product->updateQuantity($this->params['value']);
                 $newqty = $item->product->updateQuantity($this->params['value']);
                 if ($newqty > $item->product->quantity) {
                     if ($item->product->availability_type == 1) {
                         $diff             = ($item->product->quantity <= 0) ? $newqty : $newqty - $item->product->quantity;
                         $updates->message = 'Only ' . $item->product->quantity . ' ' . $item->products_name . ' are currently in stock. Shipping may be delayed on the other ' . $diff;
@@ -215,14 +215,14 @@ class cartController extends expController {
                 //{
                 foreach ($order->orderitem as $orderItem) {
                     if ($orderItem->product_id == $item->product_id) $qCheck += $orderItem->quantity;
                 }
                 //eDebug("Done",true);
-                //}                           
-                /*eDebug($item->quantity);   
-                eDebug($item->product->quantity); 
-                eDebug($qCheck);                  
+                //}
+                /*eDebug($item->quantity);
+                eDebug($item->product->quantity);
+                eDebug($qCheck);
                 eDebug($newqty,true);  */
                 //check minimum quantity
                 $qtyMessage = '';
                 if ($newqty < $item->product->minimum_order_quantity) {
                     $qtyMessage = $item->product->title . ' has a minimum order quantity of ' . $item->product->minimum_order_quantity . '. The quantity has been adjusted and added to your cart.<br/><br/>';
@@ -241,11 +241,11 @@ class cartController extends expController {
                         $diff        = ($item->product->quantity <= 0) ? $newqty : $newqty - $item->product->quantity;
                         $itemMessage = gt('Only') . ' ' . $item->product->quantity . ' ' . $item->products_name . ' ' . gt('are currently in stock. Shipping may be delayed on the other') . ' ' . $diff . "<br/><br/>";
                         //$updates->message = 'Only '.$item->product->quantity.' '.$item->products_name.' are currently in stock. Shipping may be delayed on the other '.$diff;
                     } elseif ($item->product->availability_type == 2) {
                         flash('error', $item->products_name . ' ' . gt('only has') . ' ' . $item->product->quantity . ' ' . gt('on hand. You can not add any more than that to your cart.'));
-                        /*$updates->message = $item->products_name.' only has '.$item->product->quantity.' on hand. You can not add any more to your cart.';                        
+                        /*$updates->message = $item->products_name.' only has '.$item->product->quantity.' on hand. You can not add any more to your cart.';
                         $updates->cart_total = '$'.number_format($order->getCartTotal(), 2);
                         $updates->item_total = '$'.number_format($item->quantity*$item->products_price, 2);
                         $updates->item_id = $id;
                         $updates->quantity = $item->product->quantity;
                         echo json_encode($updates);  */
@@ -300,19 +300,19 @@ class cartController extends expController {
 //            $shipping->getRates();
             $order->calculateGrandTotal();
 
             //eDebug($order,true);
             //check to see if we have calculate shipping yet - if shipping_total_before_discounts is set
-            //to something other than 0, then we have, but we'll set the estimtae to shipping_total to 
+            //to something other than 0, then we have, but we'll set the estimtae to shipping_total to
             //accomodate any applied discounts
             //if (!empty($order->shipping_total_before_discounts))
             //{
             //    $estimated_shipping = $order->shipping_total;
             //}
             //otherwise we'll grab an estimate
             //else
-            //{    
+            //{
             //$estimated_shipping = shipping::estimateShipping($order);
             /* $shipping = new shipping();
           $shipping->getRates();
           //eDebug($shipping,true);
           $estimated_shipping = $shipping->pricelist['01']['cost'];*/
@@ -330,11 +330,11 @@ class cartController extends expController {
                 assign_to_template(array(
                     'noactivediscounts'=> '1'
                 ));
                 $discounts = null;
             } else {
-                // get all current discount codes that are valid and applied                
+                // get all current discount codes that are valid and applied
                 $discounts = $order->validateDiscounts();
             }
         } else {
             $order              = new stdClass();
             $order->orderitem   = new stdClass();
@@ -701,11 +701,11 @@ class cartController extends expController {
 //        }
 
         if (empty($result->errorCode)) {
             // if ($result->errorCode === "0" || $result->errorCode === 0)
             // {
-            // save out the cart total to the database		
+            // save out the cart total to the database
             $billing->billingmethod->update(array('billing_cost'=> $order->grand_total));
 
             // set the invoice number and purchase date in the order table..this finializes the order
             //$invoice_num = $db->max('orders', 'invoice_id') + 1;
             //if ($invoice_num < ecomconfig::getConfig('starting_invoice_number')) $invoice_num += ecomconfig::getConfig('starting_invoice_number');
@@ -1067,15 +1067,15 @@ class cartController extends expController {
         global $order;
         //lookup discount to see if it's real and valid, and not already in our cart
         //this will change once we allow more than one coupon code
 
         $discount = new discounts();
-        $discount = $discount->getCouponByName($this->params['coupon_code']);
+        $discount = $discount->getCouponByName(expString::escape($this->params['coupon_code']));
 
         if (empty($discount)) {
             flash('error', gt("This discount code you entered does not exist."));
-            //redirect_to(array('controller'=>'cart', 'action'=>'checkout'));       
+            //redirect_to(array('controller'=>'cart', 'action'=>'checkout'));
             expHistory::back();
         }
 
         //check to see if it's in our cart already
         if ($this->isDiscountInCart($discount->id)) {
@@ -1098,11 +1098,11 @@ class cartController extends expController {
             // set this to just the discount applied via this coupon?? if so, when though? $od->discount_total = ??;
             flash('message', gt("The discount code has been applied to your cart."));
         } else {
             flash('error', $validateDiscountMessage);
         }
-        //redirect_to(array('controller'=>'cart', 'action'=>'checkout'));                           
+        //redirect_to(array('controller'=>'cart', 'action'=>'checkout'));
         expHistory::back();
     }
 
     function removeDiscountFromCart($id = null, $redirect = true) {
         //eDebug($params);
@@ -1139,15 +1139,15 @@ class cartController extends expController {
 //    }
 
     //this is ran after we alter the quantity of the cart, including
     //delete items or runing the updatequantity action
     private function rebuildCart() {
-        //group items by type and id               
+        //group items by type and id
         //since we can have the same product in different items (options and quantity discount)
         //remove items and readd?
         global $order;
-        //eDebug($order,true); 
+        //eDebug($order,true);
         $items = $order->orderitem;
         foreach ($order->orderitem as $item) {
             $item->delete();
         }
         $order->orderitem = array();
@@ -1183,24 +1183,24 @@ class cartController extends expController {
                 $order->refresh();
             }
         }
         $order->save();
         /*eDebug($items);
-        
-        
-        $options = array();  
+
+
+        $options = array();
         foreach ($this->optiongroup as $og) {
             if ($og->required && empty($params['options'][$og->id][0])) {
-                
+
                 flash('error', $this->title.' '.gt('requires some options to be selected before you can add it to your cart.'));
                 redirect_to(array('controller'=>store, 'action'=>'show', 'id'=>$this->id));
             }
             if (!empty($params['options'][$og->id])) {
                 foreach ($params['options'][$og->id] as $opt_id) {
                     $selected_option = new option($opt_id);
                     $cost = $selected_option->modtype == '$' ? $selected_option->amount :  $this->getBasePrice() * ($selected_option->amount * .01);
-                    $cost = $selected_option->updown == '+' ? $cost : $cost * -1;                      
+                    $cost = $selected_option->updown == '+' ? $cost : $cost * -1;
                     $price += $cost;
                     $options[] = array($selected_option->id,$selected_option->title,$selected_option->modtype,$selected_option->updown,$selected_option->amount);
                 }
             }
         }
@@ -1210,11 +1210,11 @@ class cartController extends expController {
         $params['products_price'] = $price;
         $item = new orderitem($params);
         //eDebug($item, true);
         $item->products_price = $price;
         $item->options = serialize($options);
-        
+
         $sm = $order->getCurrentShippingMethod();
         $item->shippingmethods_id = $sm->id;
         $item->save();                            */
         return true;
 
diff --git a/framework/modules/ecommerce/controllers/purchaseOrderController.php b/framework/modules/ecommerce/controllers/purchaseOrderController.php
index e87f1e8ff1..75eba637d5 100644
--- a/framework/modules/ecommerce/controllers/purchaseOrderController.php
+++ b/framework/modules/ecommerce/controllers/purchaseOrderController.php
@@ -117,11 +117,11 @@ class purchaseOrderController extends expController {
     }
 
 	public function getPurchaseOrderByJSON() {
 
 		if(!empty($this->params['vendor'])) {
-			$purchase_orders = $this->purchase_order->find('all', 'vendor_id=' . $this->params['vendor']);
+			$purchase_orders = $this->purchase_order->find('all', 'vendor_id=' . expString::escape($this->params['vendor']));
 		} else {
 			$purchase_orders = $this->purchase_order->find('all');
 		}
 
 		echo json_encode($purchase_orders);
diff --git a/framework/modules/ecommerce/controllers/storeController.php b/framework/modules/ecommerce/controllers/storeController.php
index bafe73433c..7d9dfd2413 100755
--- a/framework/modules/ecommerce/controllers/storeController.php
+++ b/framework/modules/ecommerce/controllers/storeController.php
@@ -852,11 +852,11 @@ class storeController extends expController {
 
         expHistory::set('viewable', $this->params);
 //        $classname = $db->selectValue('product', 'product_type', 'id=' . $this->params['id']);
 //        $product   = new $classname($this->params['id'], true, true);
 
-        $id = isset($this->params['title']) ? $this->params['title'] : $this->params['id'];
+        $id = isset($this->params['title']) ? expString::escape($this->params['title']) : $this->params['id'];
         $product = new product($id);
         $product_type = new $product->product_type($product->id);
         $product_type->title = expString::parseAndTrim($product_type->title, true);
         $product_type->image_alt_tag = expString::parseAndTrim($product_type->image_alt_tag, true);
 
@@ -906,11 +906,11 @@ class storeController extends expController {
     function showByTitle() {
         global $order, $template, $user;
         //need to add a check here for child product and redirect to parent if hit directly by ID
         expHistory::set('viewable', $this->params);
 
-        $product = new product(addslashes($this->params['title']));
+        $product = new product(expString::escape($this->params['title']));
         $product_type = new $product->product_type($product->id);
         $product_type->title = expString::parseAndTrim($product_type->title, true);
         $product_type->image_alt_tag = expString::parseAndTrim($product_type->image_alt_tag, true);
 
         //if we're trying to view a child product directly, then we redirect to it's parent show view
@@ -950,11 +950,11 @@ class storeController extends expController {
     function showByModel() {
         global $order, $template, $db;
 
         expHistory::set('viewable', $this->params);
         $product = new product();
-        $model = $product->find("first", 'model="' . $this->params['model'] . '"');
+        $model = $product->find("first", 'model="' . expString::escape($this->params['model']) . '"');
         //eDebug($model);
         $product_type = new $model->product_type($model->id);
         //eDebug($product_type);
         $tpl = $product_type->getForm('show');
         if (!empty($tpl)) $template = new controllertemplate($this, $tpl);
@@ -971,11 +971,11 @@ class storeController extends expController {
 //        global $db;
 
         expHistory::set('viewable', $this->params);
 //        $parent = isset($this->params['cat']) ? $this->params['cat'] : expSession::get('catid');
         $catid = expSession::get('catid');
-        $parent = !empty($catid) ? $catid : (!empty($this->params['cat']) ? $this->params['cat'] : 0);
+        $parent = !empty($catid) ? $catid : (!empty($this->params['cat']) ? intval($this->params['cat']) : 0);
         $category = new storeCategory($parent);
         $categories = $category->getEcomSubcategories();
         $ancestors = $category->pathToNode();
         assign_to_template(array(
             'categories' => $categories,
@@ -1648,11 +1648,11 @@ class storeController extends expController {
         }
     }
 
     function searchByModelForm() {
         // get the search terms
-        $terms = $this->params['search_string'];
+        $terms = expString::escape($this->params['search_string']);
 
         $sql = "model like '%" . $terms . "%'";
 
         $limit = !empty($this->config['limit']) ? $this->config['limit'] : 10;
         $page = new expPaginator(array(
@@ -1686,10 +1686,11 @@ class storeController extends expController {
 
         $sql = "select DISTINCT(p.id) as id, p.title, model from " . $db->prefix . "product as p WHERE ";
         if (!($user->isAdmin())) $sql .= '(p.active_type=0 OR p.active_type=1) AND ';
 
         //if first character of search is a -, then we do a wild card, else from beginning
+        $this->params['query'] = expString::escape($this->params['query']);
         if ($this->params['query'][0] == '-') {
             $sql .= " p.model LIKE '%" . $this->params['query'];
         } else {
             $sql .= " p.model LIKE '" . $this->params['query'];
         }
@@ -1707,10 +1708,11 @@ class storeController extends expController {
      *
      */
     public function search() {
         global $db, $user;
 
+        $this->params['query'] = expString::escape($this->params['query']);
         if (SAVE_SEARCH_QUERIES && INCLUDE_AJAX_SEARCH == 1) {  // only to add search query record
             $qry = trim($this->params['query']);
             if (!empty($qry)) {
                 if (INCLUDE_ANONYMOUS_SEARCH == 1 || $user->id <> 0) {
                     $queryObj = new stdClass();
@@ -1806,10 +1808,12 @@ class storeController extends expController {
      * AJAX search for products by title, description, or model/sku
      *
      */
     public function searchNew() {
         global $db, $user;
+
+        $this->params['query'] = expString::escape($this->params['query']);
         //$this->params['query'] = str_ireplace('-','\-',$this->params['query']);
         $sql = "select DISTINCT(p.id) as id, p.title, model, sef_url, f.id as fileid, ";
         $sql .= "match (p.title,p.model,p.body) against ('" . $this->params['query'] . "*' IN BOOLEAN MODE) as relevance, ";
         $sql .= "CASE when p.model like '" . $this->params['query'] . "%' then 1 else 0 END as modelmatch, ";
         $sql .= "CASE when p.title like '%" . $this->params['query'] . "%' then 1 else 0 END as titlematch ";
diff --git a/framework/modules/file/controllers/fileController.php b/framework/modules/file/controllers/fileController.php
index 27dc1f1c4a..5af374a4a9 100755
--- a/framework/modules/file/controllers/fileController.php
+++ b/framework/modules/file/controllers/fileController.php
@@ -250,24 +250,24 @@ class fileController extends expController {
 //        $dir = 'asc'; // default sort dir is asc
 //        $sort_dir = SORT_ASC;
 
         // How many records to get?
         if(strlen($this->params['results']) > 0) {
-            $results = $this->params['results'];
+            $results = intval($this->params['results']);
         }
 
         // Start at which record?
         if(strlen($this->params['startIndex']) > 0) {
-            $startIndex = $this->params['startIndex'];
+            $startIndex = intval($this->params['startIndex']);
         }
 
         // Sorted?
         if(strlen($this->params['sort']) > 0) {
             if ($this->params['sort'] == 'cat') {
                 $sort = 'id';
             } else {
-                $sort = $this->params['sort'];
+                $sort = expString::escape($this->params['sort']);
             }
 //            if ($sort = 'id') $sort = 'filename';
         }
 
         // Sort dir?
@@ -279,10 +279,11 @@ class fileController extends expController {
             $sort_dir = SORT_ASC;
         }
         $totalrecords = 0;
 
         if (!empty($this->params['query'])) {
+            $this->params['query'] = expString::escape($this->params['query']);
             $filter = '';
             if (!$user->isAdmin()) {
                 $filter = "(poster=".$user->id." OR shared=1) AND ";
             };
 //            if ($this->params['update']=='ck' || $this->params['update']=='tiny') {
diff --git a/framework/modules/users/controllers/usersController.php b/framework/modules/users/controllers/usersController.php
index 207c24959d..55cedbd5a5 100755
--- a/framework/modules/users/controllers/usersController.php
+++ b/framework/modules/users/controllers/usersController.php
@@ -840,21 +840,21 @@ class usersController extends expController {
         $dir = 'asc'; // default sort dir is asc
         $sort_dir = SORT_ASC;
 
         // How many records to get?
         if (strlen($this->params['results']) > 0) {
-            $results = $this->params['results'];
+            $results = intval($this->params['results']);
         }
 
         // Start at which record?
         if (strlen($this->params['startIndex']) > 0) {
-            $startIndex = $this->params['startIndex'];
+            $startIndex = intval($this->params['startIndex']);
         }
 
         // Sorted?
         if (strlen($this->params['sort']) > 0) {
-            $sort = $this->params['sort'];
+            $sort = expString::escape($this->params['sort']);
             if ($sort = 'id') $sort = 'username';
         }
 
         if (!empty($this->params['filter'])) {
             switch ($this->params['filter']) {
@@ -891,15 +891,14 @@ class usersController extends expController {
             $sort_dir = SORT_ASC;
         }
 
         if (!empty($this->params['query'])) {
 
-//            $this->params['query'] = $this->params['query'];
+            $this->params['query'] = expString::escape($this->params['query']);
             $totalrecords = $this->$modelname->find('count', (empty($filter) ? '' : $filter . " AND ") . "(username LIKE '%" . $this->params['query'] . "%' OR firstname LIKE '%" . $this->params['query'] . "%' OR lastname LIKE '%" . $this->params['query'] . "%' OR email LIKE '%" . $this->params['query'] . "%')");
 
             $users = $this->$modelname->find('all', (empty($filter) ? '' : $filter . " AND ") . "(username LIKE '%" . $this->params['query'] . "%' OR firstname LIKE '%" . $this->params['query'] . "%' OR lastname LIKE '%" . $this->params['query'] . "%' OR email LIKE '%" . $this->params['query'] . "%')", $sort . ' ' . $dir, $results, $startIndex);
-
             for ($i = 0, $iMax = count($users); $i < $iMax; $i++) {
                 if (ECOM == 1) {
                     $users[$i]->usernamelabel = "<a href='viewuser/{$users[$i]->id}'  class='fileinfo'>{$users[$i]->username}</a>";
                 } else {
                     $users[$i]->usernamelabel = $users[$i]->username;

Vulnerable code:             $version = $db->selectValue('help_version', 'id', 'version="' . expString::sanitize($_GET['version']) . '"');
                    /*if ($quantity < $child->minimum_order_quantity)                       
                        flash('message', $child->title . " - " . $child->model . " has a minimum order quantity of " . $child->minimum_order_quantity . 
                        
                //$newqty = $item->product->updateQuantity($this->params['value']);                  
                //}                           
                /*eDebug($item->quantity);   
                eDebug($item->product->quantity); 
                eDebug($qCheck);                  
                        /*$updates->message = $item->products_name.' only has '.$item->product->quantity.' on hand. You can not add any more to your cart.';                        
            //to something other than 0, then we have, but we'll set the estimtae to shipping_total to 
            //{    
                // get all current discount codes that are valid and applied                
            // save out the cart total to the database		
        $discount = $discount->getCouponByName($this->params['coupon_code']);
            //redirect_to(array('controller'=>'cart', 'action'=>'checkout'));       
        //redirect_to(array('controller'=>'cart', 'action'=>'checkout'));                           
        //group items by type and id               
        //eDebug($order,true); 
        
        
        $options = array();  
                
                    $cost = $selected_option->updown == '+' ? $cost : $cost * -1;                      
        
			$purchase_orders = $this->purchase_order->find('all', 'vendor_id=' . $this->params['vendor']);
        $id = isset($this->params['title']) ? $this->params['title'] : $this->params['id'];
        $product = new product(addslashes($this->params['title']));
        $model = $product->find("first", 'model="' . $this->params['model'] . '"');
        $parent = !empty($catid) ? $catid : (!empty($this->params['cat']) ? $this->params['cat'] : 0);
        $terms = $this->params['search_string'];
            $results = $this->params['results'];
            $startIndex = $this->params['startIndex'];
                $sort = $this->params['sort'];
            $results = $this->params['results'];
            $startIndex = $this->params['startIndex'];
            $sort = $this->params['sort'];
//            $this->params['query'] = $this->params['query'];

Fixed code:             $version = $db->selectValue('help_version', 'id', 'version="' . expString::escape($_GET['version']) . '"');
                    /*if ($quantity < $child->minimum_order_quantity)
                        flash('message', $child->title . " - " . $child->model . " has a minimum order quantity of " . $child->minimum_order_quantity .

                //$newqty = $item->product->updateQuantity($this->params['value']);
                //}
                /*eDebug($item->quantity);
                eDebug($item->product->quantity);
                eDebug($qCheck);
                        /*$updates->message = $item->products_name.' only has '.$item->product->quantity.' on hand. You can not add any more to your cart.';
            //to something other than 0, then we have, but we'll set the estimtae to shipping_total to
            //{
                // get all current discount codes that are valid and applied
            // save out the cart total to the database
        $discount = $discount->getCouponByName(expString::escape($this->params['coupon_code']));
            //redirect_to(array('controller'=>'cart', 'action'=>'checkout'));
        //redirect_to(array('controller'=>'cart', 'action'=>'checkout'));
        //group items by type and id
        //eDebug($order,true);


        $options = array();

                    $cost = $selected_option->updown == '+' ? $cost : $cost * -1;

			$purchase_orders = $this->purchase_order->find('all', 'vendor_id=' . expString::escape($this->params['vendor']));
        $id = isset($this->params['title']) ? expString::escape($this->params['title']) : $this->params['id'];
        $product = new product(expString::escape($this->params['title']));
        $model = $product->find("first", 'model="' . expString::escape($this->params['model']) . '"');
        $parent = !empty($catid) ? $catid : (!empty($this->params['cat']) ? intval($this->params['cat']) : 0);
        $terms = expString::escape($this->params['search_string']);
        $this->params['query'] = expString::escape($this->params['query']);
        $this->params['query'] = expString::escape($this->params['query']);

        $this->params['query'] = expString::escape($this->params['query']);
            $results = intval($this->params['results']);
            $startIndex = intval($this->params['startIndex']);
                $sort = expString::escape($this->params['sort']);
            $this->params['query'] = expString::escape($this->params['query']);
            $results = intval($this->params['results']);
            $startIndex = intval($this->params['startIndex']);
            $sort = expString::escape($this->params['sort']);
            $this->params['query'] = expString::escape($this->params['query']);