Changeset 28712

Timestamp:

06/10/2014 12:43:32 AM (10 years ago)

Author:

wonderboymusic

Message:

Replace all uses of like_escape() with $wpdb->esc_like().

Props miqrogroove.
See #10041.

Location:

trunk/src

Files:

• wp-admin/includes/class-wp-ms-sites-list-table.php (modified) (3 diffs)
• wp-admin/includes/schema.php (modified) (1 diff)
• wp-admin/includes/template.php (modified) (1 diff)
• wp-admin/includes/upgrade.php (modified) (4 diffs)
• wp-admin/install.php (modified) (1 diff)
• wp-admin/maint/repair.php (modified) (1 diff)
• wp-admin/network.php (modified) (1 diff)
• wp-admin/network/site-settings.php (modified) (1 diff)
• wp-includes/bookmark.php (modified) (1 diff)
• wp-includes/canonical.php (modified) (1 diff)
• wp-includes/class-wp-xmlrpc-server.php (modified) (1 diff)
• wp-includes/comment.php (modified) (1 diff)
• wp-includes/functions.php (modified) (2 diffs)
• wp-includes/meta.php (modified) (1 diff)
• wp-includes/ms-load.php (modified) (1 diff)
• wp-includes/post.php (modified) (1 diff)
• wp-includes/query.php (modified) (3 diffs)
• wp-includes/taxonomy.php (modified) (2 diffs)
• wp-includes/user.php (modified) (3 diffs)

trunk/src/wp-admin/includes/class-wp-ms-sites-list-table.php

@@ -39 +39 @@
         }
 
-        $like_s = esc_sql( like_escape( $s ) );
-
         // If the network is large and a search is not being performed, show only the latest blogs with no paging in order
         // to avoid expensive count queries.
@@ -59 +57 @@
                     preg_match( '/^[0-9]{1,3}\.$/', $s ) ) {
             // IPv4 address
-            $reg_blog_ids = $wpdb->get_col( "SELECT blog_id FROM {$wpdb->registration_log} WHERE {$wpdb->registration_log}.IP LIKE ( '{$like_s}$wild' )" );
+            $sql = $wpdb->prepare( "SELECT blog_id FROM {$wpdb->registration_log} WHERE {$wpdb->registration_log}.IP LIKE %s", $wpdb->esc_like( $s ) . $wild );
+            $reg_blog_ids = $wpdb->get_col( $sql );
 
             if ( !$reg_blog_ids )
@@ -70 +69 @@
         } else {
             if ( is_numeric($s) && empty( $wild ) ) {
-                $query .= " AND ( {$wpdb->blogs}.blog_id = '{$like_s}' )";
+                $query .= $wpdb->prepare( " AND ( {$wpdb->blogs}.blog_id = %s )", $s );
             } elseif ( is_subdomain_install() ) {
-                $blog_s = str_replace( '.' . $current_site->domain, '', $like_s );
-                $blog_s .= $wild . '.' . $current_site->domain;
-                $query .= " AND ( {$wpdb->blogs}.domain LIKE '$blog_s' ) ";
+                $blog_s = str_replace( '.' . $current_site->domain, '', $s );
+                $blog_s = $wpdb->esc_like( $blog_s ) . $wild . $wpdb->esc_like( '.' . $current_site->domain );
+                $query .= $wpdb->prepare( " AND ( {$wpdb->blogs}.domain LIKE %s ) ", $blog_s );
             } else {
-                if ( $like_s != trim('/', $current_site->path) )
-                    $blog_s = $current_site->path . $like_s . $wild . '/';
-                else
-                    $blog_s = $like_s;
-                $query .= " AND  ( {$wpdb->blogs}.path LIKE '$blog_s' )";
+                if ( $s != trim('/', $current_site->path) ) {
+                    $blog_s = $wpdb->esc_like( $current_site->path . $s ) . $wild . $wpdb->esc_like( '/' );
+                } else {
+                    $blog_s = $wpdb->esc_like( $s );
+                }
+                $query .= $wpdb->prepare( " AND  ( {$wpdb->blogs}.path LIKE %s )", $blog_s );
             }
         }

trunk/src/wp-admin/includes/schema.php

@@ -554 +554 @@
     // and the corresponding transient_timeout record from table b.
     $time = time();
-    $wpdb->query("DELETE a, b FROM $wpdb->options a, $wpdb->options b WHERE
-            a.option_name LIKE '\_transient\_%' AND
-            a.option_name NOT LIKE '\_transient\_timeout\_%' AND
-            b.option_name = CONCAT( '_transient_timeout_', SUBSTRING( a.option_name, 12 ) )
-            AND b.option_value < $time");
+    $sql = "DELETE a, b FROM $wpdb->options a, $wpdb->options b
+        WHERE a.option_name LIKE %s
+        AND a.option_name NOT LIKE %s
+        AND b.option_name = CONCAT( '_transient_timeout_', SUBSTRING( a.option_name, 12 ) )
+        AND b.option_value < %d";
+    $wpdb->query( $wpdb->prepare( $sql, $wpdb->esc_like( '_transient_' ) . '%', $wpdb->esc_like( '_transient_timeout_' ) . '%', $time ) );
 
     if ( is_main_site() && is_main_network() ) {
-        $wpdb->query("DELETE a, b FROM $wpdb->options a, $wpdb->options b WHERE
-            a.option_name LIKE '\_site\_transient\_%' AND
-            a.option_name NOT LIKE '\_site\_transient\_timeout\_%' AND
-            b.option_name = CONCAT( '_site_transient_timeout_', SUBSTRING( a.option_name, 17 ) )
-            AND b.option_value < $time");
-    }
+        $sql = "DELETE a, b FROM $wpdb->options a, $wpdb->options b
+            WHERE a.option_name LIKE %s
+            AND a.option_name NOT LIKE %s
+            AND b.option_name = CONCAT( '_site_transient_timeout_', SUBSTRING( a.option_name, 17 ) )
+            AND b.option_value < %d";
+        $wpdb->query( $wpdb->prepare( $sql, $wpdb->esc_like( '_site_transient_' ) . '%', $wpdb->esc_like( '_site_transient_timeout_' ) . '%', $time ) );
+    }
 }
 

trunk/src/wp-admin/includes/template.php

@@ -633 +633 @@
      * @param int $limit Number of custom fields to retrieve. Default 30.
      */
-    $limit = (int) apply_filters( 'postmeta_form_limit', 30 );
-    $keys = $wpdb->get_col( "
-        SELECT meta_key
+    $limit = apply_filters( 'postmeta_form_limit', 30 );
+    $sql = "SELECT meta_key
         FROM $wpdb->postmeta
         GROUP BY meta_key
-        HAVING meta_key NOT LIKE '\_%'
+        HAVING meta_key NOT LIKE %s
         ORDER BY meta_key
-        LIMIT $limit" );
+        LIMIT %d";
+    $keys = $wpdb->get_col( $wpdb->prepare( $sql, $wpdb->esc_like( '_' ) . '%', $limit ) );
     if ( $keys ) {
         natcasesort( $keys );

trunk/src/wp-admin/includes/upgrade.php

@@ -466 +466 @@
     }
 
-    $wpdb->query("UPDATE $wpdb->options SET option_value = REPLACE(option_value, 'wp-links/links-images/', 'wp-images/links/')
-    WHERE option_name LIKE 'links_rating_image%'
-    AND option_value LIKE 'wp-links/links-images/%'");
+    $sql = "UPDATE $wpdb->options
+        SET option_value = REPLACE(option_value, 'wp-links/links-images/', 'wp-images/links/')
+        WHERE option_name LIKE %s
+        AND option_value LIKE %s";
+    $wpdb->query( $wpdb->prepare( $sql, $wpdb->esc_like( 'links_rating_image' ) . '%', $wpdb->esc_like( 'wp-links/links-images/' ) . '%' ) );
 
     $done_ids = $wpdb->get_results("SELECT DISTINCT post_id FROM $wpdb->post2cat");
@@ -1101 +1103 @@
     // 3.0 screen options key name changes.
     if ( is_main_site() && !defined('DO_NOT_UPGRADE_GLOBAL_TABLES') ) {
-        $prefix = like_escape($wpdb->base_prefix);
-        $wpdb->query( "DELETE FROM $wpdb->usermeta WHERE meta_key LIKE '{$prefix}%meta-box-hidden%' OR meta_key LIKE '{$prefix}%closedpostboxes%' OR meta_key LIKE '{$prefix}%manage-%-columns-hidden%' OR meta_key LIKE '{$prefix}%meta-box-order%' OR meta_key LIKE '{$prefix}%metaboxorder%' OR meta_key LIKE '{$prefix}%screen_layout%'
-                     OR meta_key = 'manageedittagscolumnshidden' OR meta_key='managecategoriescolumnshidden' OR meta_key = 'manageedit-tagscolumnshidden' OR meta_key = 'manageeditcolumnshidden' OR meta_key = 'categories_per_page' OR meta_key = 'edit_tags_per_page'" );
+        $sql = "DELETE FROM $wpdb->usermeta
+            WHERE meta_key LIKE %s
+            OR meta_key LIKE %s
+            OR meta_key LIKE %s
+            OR meta_key LIKE %s
+            OR meta_key LIKE %s
+            OR meta_key LIKE %s
+            OR meta_key = 'manageedittagscolumnshidden'
+            OR meta_key = 'managecategoriescolumnshidden'
+            OR meta_key = 'manageedit-tagscolumnshidden'
+            OR meta_key = 'manageeditcolumnshidden'
+            OR meta_key = 'categories_per_page'
+            OR meta_key = 'edit_tags_per_page'";
+        $prefix = $wpdb->esc_like( $wpdb->base_prefix );
+        $wpdb->query( $wpdb->prepare( $sql,
+            $prefix . '%' . $wpdb->esc_like( 'meta-box-hidden' ) . '%',
+            $prefix . '%' . $wpdb->esc_like( 'closedpostboxes' ) . '%',
+            $prefix . '%' . $wpdb->esc_like( 'manage-'     ) . '%' . $wpdb->esc_like( '-columns-hidden' ) . '%',
+            $prefix . '%' . $wpdb->esc_like( 'meta-box-order'  ) . '%',
+            $prefix . '%' . $wpdb->esc_like( 'metaboxorder'    ) . '%',
+            $prefix . '%' . $wpdb->esc_like( 'screen_layout'   ) . '%'
+        ) );
     }
 
@@ -1285 +1306 @@
         // and the corresponding transient_timeout record from table b.
         $time = time();
-        $wpdb->query("DELETE a, b FROM $wpdb->sitemeta a, $wpdb->sitemeta b WHERE
-            a.meta_key LIKE '\_site\_transient\_%' AND
-            a.meta_key NOT LIKE '\_site\_transient\_timeout\_%' AND
-            b.meta_key = CONCAT( '_site_transient_timeout_', SUBSTRING( a.meta_key, 17 ) )
-            AND b.meta_value < $time");
+        $sql = "DELETE a, b FROM $wpdb->sitemeta a, $wpdb->sitemeta b
+            WHERE a.meta_key LIKE %s
+            AND a.meta_key NOT LIKE %s
+            AND b.meta_key = CONCAT( '_site_transient_timeout_', SUBSTRING( a.meta_key, 17 ) )
+            AND b.meta_value < %d";
+        $wpdb->query( $wpdb->prepare( $sql, $wpdb->esc_like( '_site_transient_' ) . '%', $wpdb->esc_like ( '_site_transient_timeout_' ) . '%', $time ) );
     }
 
@@ -1383 +1405 @@
 function maybe_create_table($table_name, $create_ddl) {
     global $wpdb;
-    if ( $wpdb->get_var("SHOW TABLES LIKE '$table_name'") == $table_name )
+    
+    $query = $wpdb->prepare( "SHOW TABLES LIKE %s", $wpdb->esc_like( $table_name ) );
+
+    if ( $wpdb->get_var( $query ) == $table_name ) {
         return true;
+    }
     //didn't find it try to create it.
     $wpdb->query($create_ddl);
     // we cannot directly tell that whether this succeeded!
-    if ( $wpdb->get_var("SHOW TABLES LIKE '$table_name'") == $table_name )
+    if ( $wpdb->get_var( $query ) == $table_name ) {
         return true;
+    }
     return false;
 }

trunk/src/wp-admin/install.php

@@ -75 +75 @@
 function display_setup_form( $error = null ) {
     global $wpdb;
-    $user_table = ( $wpdb->get_var("SHOW TABLES LIKE '$wpdb->users'") != null );
+
+    $sql = $wpdb->prepare( "SHOW TABLES LIKE %s", $wpdb->esc_like( $wpdb->users ) );
+    $user_table = ( $wpdb->get_var( $sql ) != null );
 
     // Ensure that Blogs appear in search engines by default

trunk/src/wp-admin/maint/repair.php

@@ -37 +37 @@
 
     // Sitecategories may not exist if global terms are disabled.
-    if ( is_multisite() && ! $wpdb->get_var( "SHOW TABLES LIKE '$wpdb->sitecategories'" ) )
+    $query = $wpdb->prepare( "SHOW TABLES LIKE %s", $wpdb->esc_like( $wpdb->sitecategories ) );
+    if ( is_multisite() && ! $wpdb->get_var( $query ) ) {
         unset( $tables['sitecategories'] );
+    }
 
     /**

trunk/src/wp-admin/network.php

@@ -40 +40 @@
 function network_domain_check() {
     global $wpdb;
-    if ( $wpdb->get_var( "SHOW TABLES LIKE '$wpdb->site'" ) )
+
+    $sql = $wpdb->prepare( "SHOW TABLES LIKE %s", $wpdb->esc_like( $wpdb->site ) );
+    if ( $wpdb->get_var( $sql ) ) {
         return $wpdb->get_var( "SELECT domain FROM $wpdb->site ORDER BY id ASC LIMIT 1" );
+    }
     return false;
 }

trunk/src/wp-admin/network/site-settings.php

@@ -114 +114 @@
         <?php
         $blog_prefix = $wpdb->get_blog_prefix( $id );
-        $options = $wpdb->get_results( "SELECT * FROM {$blog_prefix}options WHERE option_name NOT LIKE '\_%' AND option_name NOT LIKE '%user_roles'" );
+        $sql = "SELECT * FROM {$blog_prefix}options
+            WHERE option_name NOT LIKE %s
+            AND option_name NOT LIKE %s";
+        $query = $wpdb->prepare( $sql,
+            $wpdb->esc_like( '_' ) . '%',
+            '%' . $wpdb->esc_like( 'user_roles' )
+        );
+        $options = $wpdb->get_results( $query );
         foreach ( $options as $option ) {
             if ( $option->option_name == 'default_role' )

trunk/src/wp-includes/bookmark.php

@@ -209 +209 @@
     $search = '';
     if ( ! empty( $r['search'] ) ) {
-        $search = esc_sql( like_escape( $r['search'] ) );
-        $search = " AND ( (link_url LIKE '%$search%') OR (link_name LIKE '%$search%') OR (link_description LIKE '%$search%') ) ";
+        $like = '%' . $wpdb->esc_like( $r['search'] ) . '%';
+        $search = $wpdb->prepare(" AND ( (link_url LIKE %s) OR (link_name LIKE %s) OR (link_description LIKE %s) ) ", $like, $like, $like );
     }
 

trunk/src/wp-includes/canonical.php

@@ -505 +505 @@
 
     if ( get_query_var('name') ) {
-        $where = $wpdb->prepare("post_name LIKE %s", like_escape( get_query_var('name') ) . '%');
+        $where = $wpdb->prepare("post_name LIKE %s", $wpdb->esc_like( get_query_var('name') ) . '%');
 
         // if any of post_type, year, monthnum, or day are set, use them to refine the query

trunk/src/wp-includes/class-wp-xmlrpc-server.php

@@ -5765 +5765 @@
                 // ...or a string #title, a little more complicated
                 $title = preg_replace('/[^a-z0-9]/i', '.', $urltest['fragment']);
-                $sql = $wpdb->prepare("SELECT ID FROM $wpdb->posts WHERE post_title RLIKE %s", like_escape( $title ) );
+                $sql = $wpdb->prepare("SELECT ID FROM $wpdb->posts WHERE post_title RLIKE %s", $title );
                 if (! ($post_ID = $wpdb->get_var($sql)) ) {
                     // returning unknown error '0' is better than die()ing

trunk/src/wp-includes/comment.php

@@ -482 +482 @@
      */
     protected function get_search_sql( $string, $cols ) {
-        $string = esc_sql( like_escape( $string ) );
+        global $wpdb;
 
         $searches = array();
         foreach ( $cols as $col )
-            $searches[] = "$col LIKE '%$string%'";
+            $searches[] = $wpdb->prepare( "$col LIKE %s", $wpdb->esc_like( $string ) );
 
         return ' AND (' . implode(' OR ', $searches) . ')';

trunk/src/wp-includes/functions.php

@@ -480 +480 @@
     foreach ( $pung as $link_test ) {
         if ( ! in_array( $link_test, $post_links_temp ) ) { // link no longer in post
-            $mids = $wpdb->get_col( $wpdb->prepare("SELECT meta_id FROM $wpdb->postmeta WHERE post_id = %d AND meta_key = 'enclosure' AND meta_value LIKE (%s)", $post_ID, like_escape( $link_test ) . '%') );
+            $mids = $wpdb->get_col( $wpdb->prepare("SELECT meta_id FROM $wpdb->postmeta WHERE post_id = %d AND meta_key = 'enclosure' AND meta_value LIKE %s", $post_ID, $wpdb->esc_like( $link_test ) . '%') );
             foreach ( $mids as $mid )
                 delete_metadata_by_mid( 'post', $mid );
@@ -499 +499 @@
 
     foreach ( (array) $post_links as $url ) {
-        if ( $url != '' && !$wpdb->get_var( $wpdb->prepare( "SELECT post_id FROM $wpdb->postmeta WHERE post_id = %d AND meta_key = 'enclosure' AND meta_value LIKE (%s)", $post_ID, like_escape( $url ) . '%' ) ) ) {
+        if ( $url != '' && !$wpdb->get_var( $wpdb->prepare( "SELECT post_id FROM $wpdb->postmeta WHERE post_id = %d AND meta_key = 'enclosure' AND meta_value LIKE %s", $post_ID, $wpdb->esc_like( $url ) . '%' ) ) ) {
 
             if ( $headers = wp_get_http_headers( $url) ) {

trunk/src/wp-includes/meta.php

@@ -1048 +1048 @@
                 $meta_value = array_slice( $meta_value, 0, 2 );
                 $meta_compare_string = '%s AND %s';
-            } elseif ( 'LIKE' == substr( $meta_compare, -4 ) ) {
-                $meta_value = '%' . like_escape( $meta_value ) . '%';
+            } elseif ( 'LIKE' == $meta_compare || 'NOT LIKE' == $meta_compare ) {
+                $meta_value = '%' . $wpdb->esc_like( $meta_value ) . '%';
                 $meta_compare_string = '%s';
             } else {

trunk/src/wp-includes/ms-load.php

@@ -398 +398 @@
     $title = __( 'Error establishing a database connection' );
     $msg  = '<h1>' . $title . '</h1>';
-    if ( ! is_admin() )
+    if ( ! is_admin() ) {
         die( $msg );
+    }
     $msg .= '<p>' . __( 'If your site does not display, please contact the owner of this network.' ) . '';
     $msg .= ' ' . __( 'If you are the owner of this network please check that MySQL is running properly and all tables are error free.' ) . '</p>';
-    if ( ! $wpdb->get_var( "SHOW TABLES LIKE '$wpdb->site'" ) )
+    $query = $wpdb->prepare( "SHOW TABLES LIKE %s", $wpdb->esc_like( $wpdb->site ) );
+    if ( ! $wpdb->get_var( $query ) ) {
         $msg .= '<p>' . sprintf( __( '<strong>Database tables are missing.</strong> This means that MySQL is not running, WordPress was not installed properly, or someone deleted <code>%s</code>. You really should look at your database now.' ), $wpdb->site ) . '</p>';
-    else
+    } else {
         $msg .= '<p>' . sprintf( __( '<strong>Could not find site <code>%1$s</code>.</strong> Searched for table <code>%2$s</code> in database <code>%3$s</code>. Is that right?' ), rtrim( $domain . $path, '/' ), $wpdb->blogs, DB_NAME ) . '</p>';
+    }
     $msg .= '<p><strong>' . __( 'What do I do now?' ) . '</strong> ';
     $msg .= __( 'Read the <a target="_blank" href="http://codex.wordpress.org/Debugging_a_WordPress_Network">bug report</a> page. Some of the guidelines there may help you figure out what went wrong.' );

trunk/src/wp-includes/post.php

@@ -4797 +4797 @@
     if ( ! empty($meta['thumb']) ) {
         // Don't delete the thumb if another attachment uses it
-        if (! $wpdb->get_row( $wpdb->prepare( "SELECT meta_id FROM $wpdb->postmeta WHERE meta_key = '_wp_attachment_metadata' AND meta_value LIKE %s AND post_id <> %d", '%' . $meta['thumb'] . '%', $post_id)) ) {
+        if (! $wpdb->get_row( $wpdb->prepare( "SELECT meta_id FROM $wpdb->postmeta WHERE meta_key = '_wp_attachment_metadata' AND meta_value LIKE %s AND post_id <> %d", '%' . $wpdb->esc_like( $meta['thumb'] ) . '%', $post_id)) ) {
             $thumbfile = str_replace(basename($file), $meta['thumb'], $file);
             /** This filter is documented in wp-admin/custom-header.php */

trunk/src/wp-includes/query.php

@@ -1984 +1984 @@
         $q['search_orderby_title'] = array();
         foreach ( $q['search_terms'] as $term ) {
-            $term = like_escape( esc_sql( $term ) );
-            if ( $n )
-                $q['search_orderby_title'][] = "$wpdb->posts.post_title LIKE '%$term%'";
-
-            $search .= "{$searchand}(($wpdb->posts.post_title LIKE '{$n}{$term}{$n}') OR ($wpdb->posts.post_content LIKE '{$n}{$term}{$n}'))";
+            if ( $n ) {
+                $like = '%' . $wpdb->esc_like( $term ) . '%';
+                $q['search_orderby_title'][] = $wpdb->prepare( "$wpdb->posts.post_title LIKE %s", $like );
+            }
+
+            $like = $n . $wpdb->esc_like( $term ) . $n;
+            $search .= $wpdb->prepare( "{$searchand}(($wpdb->posts.post_title LIKE %s) OR ($wpdb->posts.post_content LIKE %s))", $like, $like );
             $searchand = ' AND ';
         }
@@ -2087 +2089 @@
         if ( $q['search_terms_count'] > 1 ) {
             $num_terms = count( $q['search_orderby_title'] );
-            $search_orderby_s = like_escape( esc_sql( $q['s'] ) );
+            $like = '%' . $wpdb->esc_like( $q['s'] ) . '%';
 
             $search_orderby = '(CASE ';
             // sentence match in 'post_title'
-            $search_orderby .= "WHEN $wpdb->posts.post_title LIKE '%{$search_orderby_s}%' THEN 1 ";
+            $search_orderby .= $wpdb->prepare( "WHEN $wpdb->posts.post_title LIKE %s THEN 1 ", $like );
 
             // sanity limit, sort as sentence when more than 6 terms
@@ -2104 +2106 @@
 
             // sentence match in 'post_content'
-            $search_orderby .= "WHEN $wpdb->posts.post_content LIKE '%{$search_orderby_s}%' THEN 4 ";
+            $search_orderby .= $wpdb->prepare( "WHEN $wpdb->posts.post_content LIKE %s THEN 4 ", $like );
             $search_orderby .= 'ELSE 5 END)';
         } else {

trunk/src/wp-includes/taxonomy.php

@@ -1481 +1481 @@
 
     if ( ! empty( $args['name__like'] ) ) {
-        $name__like = like_escape( $args['name__like'] );
-        $where .= $wpdb->prepare( " AND t.name LIKE %s", '%' . $name__like . '%' );
+        $where .= $wpdb->prepare( " AND t.name LIKE %s", '%' . $wpdb->esc_like( $args['name__like'] ) . '%' );
     }
 
     if ( ! empty( $args['description__like'] ) ) {
-        $description__like = like_escape( $args['description__like'] );
-        $where .= $wpdb->prepare( " AND tt.description LIKE %s", '%' . $description__like . '%' );
+        $where .= $wpdb->prepare( " AND tt.description LIKE %s", '%' . $wpdb->esc_like( $args['description__like'] ) . '%' );
     }
 
@@ -1518 +1516 @@
 
     if ( ! empty( $args['search'] ) ) {
-        $search = like_escape( $args['search'] );
-        $where .= $wpdb->prepare( ' AND ((t.name LIKE %s) OR (t.slug LIKE %s))', '%' . $search . '%', '%' . $search . '%' );
+        $like = '%' . $wpdb->esc_like( $args['search'] ) . '%';
+        $where .= $wpdb->prepare( ' AND ((t.name LIKE %s) OR (t.slug LIKE %s))', $like, $like );
     }
 

trunk/src/wp-includes/user.php

@@ -798 +798 @@
      */
     protected function get_search_sql( $string, $cols, $wild = false ) {
-        $string = esc_sql( $string );
+        global $wpdb;
 
         $searches = array();
@@ -805 +805 @@
         foreach ( $cols as $col ) {
             if ( 'ID' == $col )
-                $searches[] = "$col = '$string'";
+                $searches[] = $wpdb->prepare( "$col = %s", $string );
             else
-                $searches[] = "$col LIKE '$leading_wild" . like_escape($string) . "$trailing_wild'";
+                $searches[] = $wpdb->prepare( "$col LIKE %s", $leading_wild . $wpdb->esc_like( $string ) . $trailing_wild );
         }
 
@@ -1150 +1150 @@
         $select_count = array();
         foreach ( $avail_roles as $this_role => $name ) {
-            $select_count[] = "COUNT(NULLIF(`meta_value` LIKE '%\"" . like_escape( $this_role ) . "\"%', false))";
+            $select_count[] = $wpdb->prepare( "COUNT(NULLIF(`meta_value` LIKE %s, false))", '%' . $wpdb->esc_like( '"' . $this_role . '"' ) . '%');
         }
         $select_count = implode(', ', $select_count);