Ticket #10041: 10041.8.diff

wp-includes/deprecated.php

@@ -3463 +3463 @@
  *
  * @since 2.5.0
  * @deprecated 4.0.0
- * @deprecated Use wpdb::esc_like()
+ * @deprecated Use esc_like_sql() or wpdb::esc_like()
  *
  * @param string $text The text to be escaped.
  * @return string text, safe for inclusion in LIKE query.
  */
-function like_escape($text) {
-        _deprecated_function( __FUNCTION__, '4.0', 'wpdb::esc_like()' );
-        return str_replace( array( "%", "_" ), array( "\\%", "\\_" ), $text );
+function like_escape( $text ) {
+        return esc_like_sql( $text );
 }
 
 /**

wp-includes/formatting.php

@@ -2942 +2942 @@
 }
 
 /**
+ * First half of escaping for LIKE special characters % and _ before preparing for MySQL.
+ *
+ * Use this only before wpdb::prepare() or esc_sql().  Reversing the order is very bad for security.
+ *
+ * Example Prepared Statement:
+ *  $wild = '%';
+ *  $find = 'only 43% of planets';
+ *  $like = $wild . esc_like_sql( $find ) . $wild;
+ *  $sql  = $wpdb->prepare( "SELECT * FROM $wpdb->posts WHERE post_content LIKE %s", $like );
+ *
+ * Example Escape Chain:
+ *  $sql  = esc_sql( esc_like_sql( $input ) );
+ *
+ * @since 4.0.0
+ *
+ * @uses WPDB::esc_like()
+ * @param string $text The raw text to be escaped. The input typed by the user should have no extra or deleted slashes.
+ * @return string Text in the form of a LIKE phrase. The output is not SQL safe. Call prepare or real_escape next.
+ */
+function esc_like_sql( $text ) {
+        global $wpdb;
+        return $wpdb->esc_like( $text );
+}
+
+/**
  * Checks and cleans a URL.
  *
  * A number of characters are removed from the URL. If the URL is for displaying

wp-includes/wp-db.php

@@ -1187 +1187 @@
          * @param string $text The raw text to be escaped. The input typed by the user should have no extra or deleted slashes.
          * @return string Text in the form of a LIKE phrase. The output is not SQL safe. Call prepare or real_escape next.
          */
-        function esc_like( $text ) {
+        public function esc_like( $text ) {
                 return addcslashes( $text, '_%\\' );
         }