Ticket #10041: 10041.6.diff

wp-includes/bookmark.php

@@ -186 +186 @@
         }
 
         if ( ! empty($search) ) {
-                $search = like_escape($search);
+                $search = esc_sql( like_escape( stripslashes( $search ) ) );
                 $search = " AND ( (link_url LIKE '%$search%') OR (link_name LIKE '%$search%') OR (link_description LIKE '%$search%') ) ";
         }
 

wp-includes/formatting.php

@@ -2746 +2746 @@
  *
  * @since 2.5.0
  *
- * @param string $text The text to be escaped.
- * @return string text, safe for inclusion in LIKE query.
+ * @param string $text The text to be escaped (expected unslashed).
+ * @return string text, NOT safe for inclusion in LIKE query (needs an additional esc_sql()).
  */
-function like_escape($text) {
-        return str_replace(array("%", "_"), array("\\%", "\\_"), $text);
+function like_escape( $text ) {
+        return addcslashes( $text, '_%\\' );
 }
 
 /**

wp-includes/taxonomy.php

@@ -1356 +1356 @@
         }
 
         if ( !empty($search) ) {
-                $search = like_escape($search);
+                $search = esc_sql( like_escape( stripslashes( $search ) ) );
                 $where .= $wpdb->prepare( " AND (t.name LIKE %s)", '%' . $search . '%');
         }