diff -x .svn -aruN 3.32.src/nucleus/documentation/history.html 3.33.src/nucleus/documentation/history.html
--- 3.32.src/nucleus/documentation/history.html	2008-01-23 20:31:55.000000000 -0600
+++ 3.33.src/nucleus/documentation/history.html	2008-08-20 17:48:37.000000000 -0500
@@ -15,6 +15,12 @@
 
 <ul>
 	<li>
+		<b>Nucleus v3.33 (August 20, 2008)</b>
+		<ul>
+			<li>FIXED: Security issue (Thanks to Bradley Bell)</li>
+		</ul>
+	</li>
+	<li>
 		<b>Nucleus v3.32 (January 26, 2008)</b>
 		<ul>
 			<li>FIXED: An XSS issue</li>
diff -x .svn -aruN 3.32.src/nucleus/libs/globalfunctions.php 3.33.src/nucleus/libs/globalfunctions.php
--- 3.32.src/nucleus/libs/globalfunctions.php	2008-01-23 20:29:39.000000000 -0600
+++ 3.33.src/nucleus/libs/globalfunctions.php	2008-08-16 15:41:43.000000000 -0500
@@ -20,7 +20,7 @@
 // needed if we include globalfunctions from install.php
 global $nucleus, $CONF, $DIR_LIBS, $DIR_LANG, $manager, $member;
 
-$nucleus['version'] = 'v3.32';
+$nucleus['version'] = 'v3.33';
 $nucleus['codename'] = '';
 
 checkVars(array('nucleus', 'CONF', 'DIR_LIBS', 'MYSQL_HOST', 'MYSQL_USER', 'MYSQL_PASSWORD', 'MYSQL_DATABASE', 'DIR_LANG', 'DIR_PLUGINS', 'HTTP_GET_VARS', 'HTTP_POST_VARS', 'HTTP_COOKIE_VARS', 'HTTP_ENV_VARS', 'HTTP_SESSION_VARS', 'HTTP_POST_FILES', 'HTTP_SERVER_VARS', 'GLOBALS', 'argv', 'argc', '_GET', '_POST', '_COOKIE', '_ENV', '_SESSION', '_SERVER', '_FILES'));
@@ -463,7 +463,7 @@
   * returns the currently used version (100 = 1.00, 101 = 1.01, etc...)
   */
 function getNucleusVersion() {
-	return 332;
+	return 333;
 }
 
 /**
diff -x .svn -aruN 3.32.src/nucleus/libs/SEARCH.php 3.33.src/nucleus/libs/SEARCH.php
--- 3.32.src/nucleus/libs/SEARCH.php	2007-10-22 19:35:37.000000000 -0500
+++ 3.33.src/nucleus/libs/SEARCH.php	2008-08-16 15:09:51.000000000 -0500
@@ -97,26 +97,53 @@
 		return $result;
 	}
 
-	function boolean_sql_where($match){
-		$result = $this->marked;
-		$result = preg_replace(
-			"/foo\[\(\'([^\)]{4,})\'\)\]bar/e",
-			" 'match ('.\$match.') against (\''.\$this->copyvalue(\"$1\").'\') > 0 ' ",
-			$result);
-
-		$result = preg_replace(
-			"/foo\[\(\'([^\)]{1,3})\'\)\]bar/e",
-			" '('.\$this->boolean_sql_where_short(\"$1\",\"$match\").')' ",
-			$result);
-		return $result;
-	}
+    function boolean_sql_where($match){
 
-	// there must be a simple way to simply copy a value with backslashes in it through
-	// the preg_replace, but I cannot currently find it (karma 2003-12-30)
-	function copyvalue($foo) {
-		return $foo;
-	}
+        $result = $this->marked;
+
+        $this->boolean_sql_where_cb1($match); // set the static $match
+
+        $result = preg_replace_callback(
+
+            "/foo\[\(\'([^\)]{4,})\'\)\]bar/",
+
+            array($this,'boolean_sql_where_cb1'),
+
+            $result);
+
+        $this->boolean_sql_where_cb2($match); // set the static $match
+
+        $result = preg_replace_callback(
+
+            "/foo\[\(\'([^\)]{1,3})\'\)\]bar/",
+
+            array($this,'boolean_sql_where_cb2'),
+
+            $result);
+
+        return $result;
+
+    }
+
+    function boolean_sql_where_cb1($matches){
+
+        static $match;
+
+        if (!is_array($matches)) $match=$matches;
+
+        else return ' match ('.$match.') against (\''.addslashes($matches[1]).'\') > 0 ';
+
+    }
+
+    function boolean_sql_where_cb2($matches){
+
+        static $match;
+
+        if (!is_array($matches)) $match=$matches;
+
+        else return ' ('.$this->boolean_sql_where_short(addslashes($mathes[1]),$match).') ';
 
+    }	
 
 	function boolean_mark_atoms($string){
 		$result=trim($string);
