sanitized this motherfuckin search string

1 files changed, 15 insertions, 2 deletions

diff --git a/app/controllers/search_controller.rb b/app/controllers/search_controller.rb
index ea545b7..806e320 100644
--- a/app/controllers/search_controller.rb
+++ b/app/controllers/search_controller.rb
@@ -1,9 +1,22 @@
 class SearchController < ApplicationController
+  #def index
+  #  @page = Page.new
+  #  search_term = params[:search_term]
+  #  if search_term and not search_term.empty?
+  #    @results = Node.search(params[:search_term], :include => :head)
+  #  end
+  #end
+
   def index
     @page = Page.new
-    search_term = params[:search_term]
-    if search_term and not search_term.empty?
+    search_term           = params.delete(:search_term)
+    safe_search_term      = search_term.match(/[\w\s]+/)[0] rescue ""
+    params[:search_term]  = safe_search_term
+
+    unless safe_search_term.empty?
       @results = Node.search(params[:search_term], :include => :head)
+    else
+      @results = []
     end
   end