```php ACE News | The Official News Portal UAE | Search

Search Results :

Business

Power Pack for Rock Drilling Machine UAE Hydraulic Sys . . . . .

Advanced Hydraulic Power Solutions for Rock Drilling & Diamond Saw Cutting in UAE & Middle East ACE CENTRO ENTERPRISES is a trusted supplier and . . . . .

Read More ↠
Business

Powerful Industrial Vacuum Loader & High Performance Va . . . . .

Powerful Industrial Vacuum Loader A powerful industrial vacuum loader provides a professional solution for demanding material recovery, industrial cl . . . . .

Read More ↠
Business

Powerful Industrial Vacuum Loaders & High Airflow Vacuu . . . . .

Professional High-Performance Vacuum Equipment ACE CENTRO ENTERPRISES provides professional powerful industrial vacuum loaders, high airflow vacuum t . . . . .

Read More ↠
Business

Powering Construction Across Abu Dhabi, Dubai, Sharjah . . . . .

At ACE CENTRO ENTERPRISES, we deliver advanced, reliable, and high-performance pumping and shotcrete solutions tailored for the most demanding constru . . . . .

Read More ↠
Business

Powering Progress in the UAE Construction Sector

أقصى قوة ودقة مع مضخة مكبس أتلانتيك إيه بي بي 22 حصان في ظل التطور السريع للإنشاءات والتطوير الصناعي في أبوظبي ودبي، تُعد المعدات التي تجمع بين ال . . . . .

Read More ↠
Business

Pre-Mixed Screed Pumping Machine Middle East ACE Centro . . . . .

Advanced Flooring Equipment Across UAE & Middle East ACE CENTRO ENTERPRISES offers high-performance Pre-Mixed Screed Pumping Machines in the Midd . . . . .

Read More ↠

ACE CENTRO ENTERPRISES
ACE Building, M 03 & M 04
25th Street,
Sultan Bin Zayed the First (Muroor Road)
P. O. Box 95325
Abu Dhabi - United Arab Emirates.

salesteam@acecentro.com

+971 2 6737900

+971 2 6731100

© 1998 - 2025 ACE . All rights reserved | Design and Developed by ACE

``` This version fixes the major problems in the original `search.php`. ### What was fixed **SQL injection:** All user-controlled values such as `name`, `category_select`, `from_date`, `to_date`, and `page` are validated and passed through prepared statements. **Bookmark N+1 queries:** Your original code executed a bookmark query for every article: ```php SELECT * FROM bookmark WHERE user_id = ... AND article_id = ... ``` The new version retrieves the user's bookmarks once. **Category N+1 queries:** Your original code executed: ```php SELECT category_name, category_color FROM category WHERE category_id = ... ``` for every article. The new query uses: ```sql LEFT JOIN category AS c ON c.category_id = a.category_id ``` so the category information comes back with the article. **Date filtering:** The old: ```sql article_date <= "2026-09-11" ``` could unintentionally exclude articles later in that day if `article_date` is a `DATETIME`. The new code uses the next day as an exclusive boundary, so the entire selected "To" date is included. **Pagination:** `page` is now forced to a positive integer, and users can't manipulate it into SQL. **Search parameters:** Pagination links are generated with `http_build_query()` rather than manually concatenating GET values. **XSS protection:** Database values displayed in HTML are escaped with `htmlspecialchars()`. **Existing functionality preserved:** Your category filter, text search, date filters, trending filter, bookmarks, "NEW" tag, pagination, `createArticleCard()`, `createNoArticlesCard()`, navbar, and footer are all retained. One thing I would check next is **`functions.inc.php`**, particularly `createArticleCard()`. Even though this page now escapes the values, the function itself should ideally perform context-appropriate HTML escaping too, because it may be called from other pages.