Changeset 28712 for trunk/src/wp-includes/user.php

Timestamp:

06/10/2014 12:43:32 AM (10 years ago)

Author:

wonderboymusic

Message:

Replace all uses of like_escape() with $wpdb->esc_like().

Props miqrogroove.
See #10041.

File:

• trunk/src/wp-includes/user.php (modified) (3 diffs)

trunk/src/wp-includes/user.php

@@ -798 +798 @@
      */
     protected function get_search_sql( $string, $cols, $wild = false ) {
-        $string = esc_sql( $string );
+        global $wpdb;
 
         $searches = array();
@@ -805 +805 @@
         foreach ( $cols as $col ) {
             if ( 'ID' == $col )
-                $searches[] = "$col = '$string'";
+                $searches[] = $wpdb->prepare( "$col = %s", $string );
             else
-                $searches[] = "$col LIKE '$leading_wild" . like_escape($string) . "$trailing_wild'";
+                $searches[] = $wpdb->prepare( "$col LIKE %s", $leading_wild . $wpdb->esc_like( $string ) . $trailing_wild );
         }
 
@@ -1150 +1150 @@
         $select_count = array();
         foreach ( $avail_roles as $this_role => $name ) {
-            $select_count[] = "COUNT(NULLIF(`meta_value` LIKE '%\"" . like_escape( $this_role ) . "\"%', false))";
+            $select_count[] = $wpdb->prepare( "COUNT(NULLIF(`meta_value` LIKE %s, false))", '%' . $wpdb->esc_like( '"' . $this_role . '"' ) . '%');
         }
         $select_count = implode(', ', $select_count);