diff --git a/distfiles/search.php b/distfiles/search.php
index d179cbe..3e0ad9f 100644
--- a/distfiles/search.php
+++ b/distfiles/search.php
@@ -129,15 +129,22 @@ if ($search) {
             $logfromtables[]="lognotes";
             $logconstraints[]="lognotes.lognote like \"%$srchtext%\"";
         }
-        // fixme
         // flags
         if (!empty($srchflags)) {
-            foreach ($srchflags as $flagtblnum) {
-                $flagtblname="flag_{$flagtblnum}";
-                $logfromtables[]="lognotes";
-                $logfromtables[]=$flagtblname;
-                $logconstraints[]="lognotes.lognoteid={$flagtblname}.id and {$flagtblname}.target=\"lognotes\"";
+            unset($flagconstraints);
+            $flagcount=count($srchflags);
+            $logfromtables[]="lognotes";
+            $logfromtables[]="flagmap";
+            $flagconstraints[]="flagmap.lognoteid=lognotes.lognoteid and flagmap.flagid in (";
+            foreach ($srchflags as $flagid) {
+                $flagconstraints[]="\"$flagid\"";
+                $flagconstraints[]=",";
             }
+            // remove final comma
+            array_splice($flagconstraints, -1, 1);
+            $flagconstraints[]=") group by flagmap.lognoteid having count(distinct flagmap.flagid)=$flagcount";
+            // make flagconstraints a single string so that the final implode doesn't split it
+            $logconstraints[]=join('', $flagconstraints);
         }
         // uid
         if ($srchuid != "any" && $srchuid != "") {
@@ -192,9 +199,24 @@ if ($search) {
             $logconstraints[]="lognotes.lognoteid=logparts.lognoteid and logparts.partid=parts.partid and maintforms.mfpart=parts.partid and maintforms.repord=\"{$srchrepord}\"";
         }
         // build the clauses and run the query
+        echo "logfromtables: ";
+        foreach ($logfromtables as $lft) {
+            echo "$lft ";
+        }
+        echo "<br><br>";
+        
+        echo "logconstraints: ";
+        foreach ($logconstraints as $lc) {
+            echo "$lc&nbsp;";
+        }
+        echo "<br><br>";
+        
         $logfromclause=implode(",",array_unique($logfromtables));
+        echo "logfromclause: $logfromclause <br><br>";
         $logwhereclause=implode(" and ",$logconstraints);
+        echo "logwhereclause: $logwhereclause <br><br>";
         $logrowqry=mysqli_query($db,"select lognotes.* from $logfromclause where $logwhereclause order by lognotes.date asc, lognotes.time asc");
+        echo "select lognotes.* from $logfromclause where $logwhereclause order by lognotes.date asc, lognotes.time asc";
     }
     if ($target[0]=="") $target=[];
     if (in_array("maintform",$target)) {
@@ -239,13 +261,22 @@ if ($search) {
             $mffromtables[]="maintactions";
             $mfconstraints[]="maintforms.mfmalfunction like \"%$srchtext%\" or (maintactions.action like \"%$srchtext%\" and maintforms.maintformid=maintactions.maintformnum)";
         }
-        // fixme
         // flags
-        foreach ($srchflags as $flagtblnum) {
-            $flagtblname="flag_{$flagtblnum}";
+        if (!empty($srchflags)) {
+            unset($flagconstraints);
+            $flagcount=count($srchflags);
             $mffromtables[]="maintforms";
-            $mffromtables[]=$flagtblname;
-            $mfconstraints[]="maintforms.maintformid={$flagtblname}.id and {$flagtblname}.target=\"maintforms\"";
+            $mffromtables[]="flagmap";
+            $flagconstraints[]="flagmap.maintformid=maintforms.maintformid and flagmap.flagid in (";
+            foreach ($srchflags as $flagid) {
+                $flagconstraints[]="\"$flagid\"";
+                $flagconstraints[]=",";
+            }
+            // remove final comma
+            array_splice($flagconstraints, -1, 1);
+            $flagconstraints[]=") group by flagmap.maintformid having count(distinct flagmap.flagid)=$flagcount";
+            // make flagconstraints a single string so that the final implode doesn't split it
+            $logconstraints[]=join('', $flagconstraints);
         }
         // uid
         if ($srchuid != "any" && $srchuid != "") {
@@ -476,7 +507,7 @@ if (!$print) {
     $flagsperline = 8;
     $flagcount = 1;
     while ($flagcheckbox = mysqli_fetch_assoc($flagslist)) {
-        if ($srchflags[0] == "") $srchflags = [];
+        //if ($srchflags[0] == "") $srchflags = [];
         if (in_array($flagcheckbox["flagid"], $srchflags)) {
             printf(
                 "<input type=\"checkbox\" name=\"srchflags[]\" value=\"%s\" checked title=\"When checked, only results with this flag set will be shown\"><font color=\"%s\" title=\"%s\">%s</font>",