// If we have a region
if ($actionData['request']['region-search']) {
- $regionSearch = $actionData['request']['region-search']-0;
- if ($regionSearch > 0) {
- $where .= $whereSep." T.region = $regionSearch";
+ $regions = array();
+ // Convert comma separated list to an array
+ $regionsRequested = explode( ',', $actionData['request']['region-search'] );
+
+ // Check for numeric ID's only
+ while ( list( $k, $v ) = each( $regionsRequested ) ) {
+ if ( preg_match( '/^[0-9]*$/', trim( $v ) && $v > 0 ) ) {
+ $regions[] = ( $v - 0 );
+ }
+ }
+
+ if ( isset( $regions ) && !empty( $regions ) ) {
+ $where .= $whereSep." T.region IN (" . implode( ',', $regions ) . ")";
$whereSep = ' AND ';
}
}