Ticket #10041: 10041.2.diff

wp-includes/formatting.php

@@ -2329 +2329 @@
  * @return string text, safe for inclusion in LIKE query.
  */
 function like_escape($text) {
-        return str_replace(array("%", "_"), array("\\%", "\\_"), $text);
+        return esc_sql(addcslashes($text, '\\_%'));
 }
 
 /**