<?php 
/**
* @version		$Id: content.suggest.php 2643 2025-07-15 19:01:41Z IOS $
* @package		Elxis
* @subpackage	Search component
* @copyright	Copyright (c) 2006-2025 Elxis CMS (https://www.elxis.org). All rights reserved.
* @license		Elxis Public License ( https://www.elxis.org/elxis-public-license.html )
* @author		Elxis Team ( https://www.elxis.org )
* @description 	Elxis CMS is free software. Read the license for copyright notices and details
*/

define('_ELXIS_', 1);


function suggentSend($cfg, $q, $suggestions) {
	header("Content-type: application/x-suggestions+json; charset=utf-8");
	header("Cache-Control: no-cache, must-revalidate");
	header("Expires: Sat, 26 Jul 1997 05:00:00 GMT");
	header("Pragma: no-cache");
	header("X-Frame-Options: DENY");
	header("X-XSS-Protection: 1; mode=block");
	header("X-Content-Type-Options: nosniff");
	header('Content-Security-Policy: default-src \'self\';');
	if (stripos($cfg->get('URL'), 'https') === 0) {
		header('Strict-Transport-Security: max-age=31536000; includeSubDomains;');
	}
	if ($q != '') {
		if ($suggestions) {
			echo '["'.$q.'",['.implode(',',$suggestions).'],[],[]]';
		} else {
			echo '["'.$q.'",[],[],[]]';
		}
	}
	exit;
}


$elxis_root = str_replace( '/components/com_search/engines/content', '', str_replace(DIRECTORY_SEPARATOR, '/', dirname(__FILE__)));
if (!file_exists($elxis_root.'/configuration.php')) { die(); }
if (!defined('ELXIS_PATH')) { define('ELXIS_PATH', $elxis_root); }
include(ELXIS_PATH.'/configuration.php');
$cfg = new elxisConfig();

if (!isset($_GET['q'])) { suggentSend($cfg, '', array()); }

$pat = "#([\']|[\;]|[\.]|[\"]|[\$]|[\/]|[\#]|[\<]|[\>]|[\*]|[\~]|[\`]|[\^]|[\|]|[\\\])#u";

$q = '';
$v = urldecode(filter_input(INPUT_GET,'q', FILTER_UNSAFE_RAW, FILTER_FLAG_STRIP_LOW));
if ($v != '') {
	$str = preg_replace('/\x00|<[^>]*>?/', '', $v);
	$q = str_replace(["'", '"'], ['&#39;', '&#34;'], $str);
	$q = preg_replace($pat, '', $q);
}

if (trim($q) == '') { suggentSend($cfg, '', array()); }

if (strlen($q) < 3) {
	suggentSend($cfg, $q, array());
}

if ($cfg->get('ONLINE') != 1) { suggentSend($cfg, $q, array()); }
if ($cfg->get('DB_TYPE') != 'mysql') { suggentSend($cfg, $q, array()); }
$dsn = $cfg->get('DB_DSN');
if ($dsn == '') {
	$dsn = 'mysql:host='.$cfg->get('DB_HOST');
	if ($cfg->get('DB_PORT') > 0) { $dsn .= ';port='.$cfg->get('DB_PORT'); }
	$dsn .= ';dbname='.$cfg->get('DB_NAME').';charset=utf8';
}

$driveroptions = array();
$driveroptions[PDO::MYSQL_ATTR_INIT_COMMAND] = 'SET NAMES utf8';
//IMPORTANT: 500ms timeout (or bug?) in firefox, unfortunately makes it impossible to query db on time...
try {
	$pdo = new PDO($dsn, $cfg->get('DB_USER'), $cfg->get('DB_PASS'), $driveroptions);
	$pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
} catch (PDOException $e) {
	suggentSend($cfg, $q, array());
}

//query must be simple and fast!!!
$qstr = '%'.$q.'%';
$sql = "SELECT `title` FROM `".$cfg->get('DB_PREFIX')."content`"
."\n WHERE `title` LIKE :qstr AND `published`=1 AND `alevel`=0 ORDER BY `title` ASC LIMIT 0,5";
$stmt = $pdo->prepare($sql);
$stmt->bindParam(':qstr', $qstr, PDO::PARAM_STR);
$stmt->execute();
$results = $stmt->fetchAll(PDO::FETCH_COLUMN);
$pdo = null;

if (!$results) {
	suggentSend($cfg, $q, array());
}

$suggestions = array();
foreach ($results as $result) {
	$suggestions[] = '"'.addslashes($result).'"';
}

suggentSend($cfg, $q, $suggestions);

?>