PCI Scans - patch to handle low-priority warnings on search screen causing scan fail

There are some reports of sites failing PCI scans due to an error message that can appear on the search screen if someone attempts to do a SQL injection attack. While the attack fails, an error message appears which, to the purists, discloses the name of the database table and thus gets flagged as a problem. While it's a minor issue and poses no actual direct vulnerability, the PCI scan will fail.

To fix this in Zen Cart v1.3.0 through v1.3.8a, simply do the following:

Create a NEW file, call it: /includes/extra_configures/pci_patch_v13x_search.php
And insert only the following code into that file before saving and uploading to your server:

<?php
if (isset($_GET['keyword']) && $_GET['keyword'] != '')
{
  $count =  substr_count($_GET['keyword'], '"');
  if ($count == 1)
  {
    if(substr(stripslashes(trim($_GET['keyword'])), 0, 1) == '"')
    {
      $_GET['keyword'] .= '"';
    }
  }
  $_GET['keyword'] = stripslashes($_GET['keyword']);
}

if (isset($_GET['sort']) && strlen($_GET['sort']) > 3) {
  $_GET['sort'] = substr($_GET['sort'], 0, 3);
}

Zen Cart versions 1.2.x and older are reminded that they need to upgrade. This patch will not work for them.

And for those of you who wonder, the closing** ?>** tag is INTENTIONALLY left off of the above code snippet. See here for why: https://www.zen-cart.com/tutorials/index.php?article=313

Another PCI flag could be raised if long strings are used for sort parameters.
Again, while the so-called "attack" attempt will fail, an error message will appear, causing a PCI scan to raise a red flag.

Fixing this matter involves simply using the revised code posted above, as edited today.