From ac17ef11628ee07c0fd14d9efb2775feb913ef8e Mon Sep 17 00:00:00 2001
From: gustav_delius <gustav_delius>
Date: Sat, 19 Nov 2005 13:19:34 +0000
Subject: [PATCH] Replaced PARAM_TEXT (which does not exist) by PARAM_CLEAN.
 Someone who knows more about the search capability on this page might want to
 tightent that up. $wheresearch was not initialised, leading to php notice.

---
 user/index.php | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/user/index.php b/user/index.php
index 40c147174ec..1f71c526f51 100644
--- a/user/index.php
+++ b/user/index.php
@@ -16,7 +16,7 @@
     $mode         = optional_param('mode', NULL);                             // '0' for less details, '1' for more
     $showteachers = optional_param('teachers', 1, PARAM_INT);                 // do we want to see the teacher list?
     $accesssince  = optional_param('accesssince',0,PARAM_INT);               // filter by last access. -1 = never
-    $search       = optional_param('search','',PARAM_TEXT);
+    $search       = optional_param('search','',PARAM_CLEAN);
 
     $showteachers = $showteachers && empty($search); // if we're searching, we just want students.
 
@@ -394,6 +394,7 @@ function checkchecked(form) {
     }
 
     $where .= get_lastaccess_sql($accesssince);
+    $wheresearch = '';
 
     if (!empty($search)) {
         $LIKE = sql_ilike();