'Properly escaping and using multiple LIKE statements in wordpress sql
I can't figure out what I'm doing wrong with my LIKE statements. I feel like this is using the esc_like function right but when I simply try to print out my prepared sql statement in the console of my web page, it says there's no data. If I remove my like statements then my sql query shows in the console just fine (also If I only have one like statement).
When I DO get the query to show in the console with 1 like statement, it still shows
LIKE \'{55fb4b89fdeb124c1e2a47c0f06ac81909b4d14c53a5991a2aeeab3a9d78f0e2}listing{55fb4b89fdeb124c1e2a47c0f06ac81909b4d14c53a5991a2aeeab3a9d78f0e2}
So how can I get this to prepare properly with multiple like statements using the same variable? And how can I properly escape this POST variable?
$sql = $wpdb->prepare( "
SELECT $prefix_post.ID
FROM $prefix_post
LEFT JOIN $prefix_tr ON ($prefix_post.ID = $prefix_tr.object_id)
LEFT JOIN $prefix_ad ON ($prefix_post.ID = $prefix_ad.ad_id)
INNER JOIN $prefix_postmeta ON ( $prefix_post.ID = $prefix_postmeta.post_id )
INNER JOIN $prefix_postmeta AS mt1 ON ( $prefix_post.ID = mt1.post_id )
WHERE $prefix_post.ID IN ($lid)
AND ( $prefix_tr.term_taxonomy_id IN ($catid))
AND ($prefix_post.post_title LIKE %s)
OR ($prefix_post.post_excerpt LIKE %s)
OR ($prefix_post.post_content LIKE %s)
OR ( $prefix_postmeta.meta_key = '_awpcp_extra_field[38]' AND $prefix_postmeta.meta_value LIKE %s )
OR ($prefix_ad.country LIKE %s)
OR ($prefix_ad.county LIKE %s)
OR ($prefix_ad.state LIKE %s)
OR ($prefix_ad.city LIKE %s) ))
AND $prefix_post.post_type = 'awpcp_listing'
AND (($prefix_post.post_status = 'publish'))
GROUP BY $prefix_post.ID
ORDER BY $prefix_post.post_date DESC;", '%' . $wpdb->esc_like($_POST['search']) . '%' );
print_r($sql);die;
$escaped = esc_sql( $wpdb->esc_like( $input ) );
print_r($escaped);die;
Updated code:
$search = $_POST['search'];
$like = '%%' . $wpdb->esc_like($search) . '%%';
$sqlStatement = "SELECT $prefix_post.ID
FROM $prefix_post
LEFT JOIN $prefix_tr ON ($prefix_post.ID = $prefix_tr.object_id)
LEFT JOIN $prefix_ad ON ($prefix_post.ID = $prefix_ad.ad_id)
INNER JOIN $prefix_postmeta ON ( $prefix_post.ID = $prefix_postmeta.post_id )
INNER JOIN $prefix_postmeta AS mt1 ON ( $prefix_post.ID = mt1.post_id )
WHERE 1=1
AND $prefix_post.ID IN ($lid)
AND ( $prefix_tr.term_taxonomy_id IN ($catid))
AND (( ($prefix_post.post_title LIKE %s)
OR ($prefix_post.post_excerpt LIKE %s)
OR ($prefix_post.post_content LIKE %s)
OR ( $prefix_postmeta.meta_key = '_awpcp_extra_field[38]' AND $prefix_postmeta.meta_value LIKE %s )
OR ($prefix_ad.country LIKE %s)
OR ($prefix_ad.county LIKE %s)
OR ($prefix_ad.state LIKE %s)
OR ($prefix_ad.city LIKE %s) ))
AND $prefix_post.post_type = 'awpcp_listing'
AND (($prefix_post.post_status = 'publish'))
GROUP BY $prefix_post.ID
ORDER BY $prefix_post.post_date DESC
LIMIT 5;";
$sqlStatement = $wpdb->prepare( $sqlStatement, $like, $like, $like, $like, $like, $like, $like, $like );
//print_r($sqlStatement);die;
$escaped = esc_sql( $sqlStatement );
print_r($escaped);die;
Sources
This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.
Source: Stack Overflow
| Solution | Source |
|---|
