'Properly escaping and using multiple LIKE statements in wordpress sql

I can't figure out what I'm doing wrong with my LIKE statements. I feel like this is using the esc_like function right but when I simply try to print out my prepared sql statement in the console of my web page, it says there's no data. If I remove my like statements then my sql query shows in the console just fine (also If I only have one like statement).

When I DO get the query to show in the console with 1 like statement, it still shows

LIKE \'{55fb4b89fdeb124c1e2a47c0f06ac81909b4d14c53a5991a2aeeab3a9d78f0e2}listing{55fb4b89fdeb124c1e2a47c0f06ac81909b4d14c53a5991a2aeeab3a9d78f0e2}

So how can I get this to prepare properly with multiple like statements using the same variable? And how can I properly escape this POST variable?


$sql  = $wpdb->prepare( "
                SELECT $prefix_post.ID 
                FROM $prefix_post 
                LEFT JOIN $prefix_tr ON ($prefix_post.ID = $prefix_tr.object_id) 
                LEFT JOIN $prefix_ad ON ($prefix_post.ID = $prefix_ad.ad_id)
                INNER JOIN $prefix_postmeta ON ( $prefix_post.ID = $prefix_postmeta.post_id )  
                INNER JOIN $prefix_postmeta AS mt1 ON ( $prefix_post.ID = mt1.post_id ) 
                WHERE  $prefix_post.ID IN ($lid) 
                AND ( $prefix_tr.term_taxonomy_id IN ($catid)) 
                AND ($prefix_post.post_title LIKE %s) 
                    OR ($prefix_post.post_excerpt LIKE %s) 
                    OR ($prefix_post.post_content LIKE %s) 
                    OR ( $prefix_postmeta.meta_key = '_awpcp_extra_field[38]' AND $prefix_postmeta.meta_value LIKE %s ) 
                    OR ($prefix_ad.country LIKE %s) 
                    OR ($prefix_ad.county LIKE %s) 
                    OR ($prefix_ad.state LIKE %s) 
                    OR ($prefix_ad.city LIKE %s) ))
                AND $prefix_post.post_type = 'awpcp_listing' 
                AND (($prefix_post.post_status = 'publish')) 
                GROUP BY $prefix_post.ID 
                ORDER BY $prefix_post.post_date DESC;", '%' . $wpdb->esc_like($_POST['search']) . '%' );
            
            print_r($sql);die;
            $escaped  = esc_sql( $wpdb->esc_like( $input ) );
            print_r($escaped);die;

Updated code:

$search = $_POST['search'];
            $like = '%%' . $wpdb->esc_like($search) . '%%';

            $sqlStatement = "SELECT $prefix_post.ID 
                FROM $prefix_post 
                LEFT JOIN $prefix_tr ON ($prefix_post.ID = $prefix_tr.object_id) 
                LEFT JOIN $prefix_ad ON ($prefix_post.ID = $prefix_ad.ad_id)
                INNER JOIN $prefix_postmeta ON ( $prefix_post.ID = $prefix_postmeta.post_id )  
                INNER JOIN $prefix_postmeta AS mt1 ON ( $prefix_post.ID = mt1.post_id ) 
                WHERE 1=1 
                AND $prefix_post.ID IN ($lid) 
                AND ( $prefix_tr.term_taxonomy_id IN ($catid)) 
                AND (( ($prefix_post.post_title LIKE %s) 
                    OR ($prefix_post.post_excerpt LIKE %s) 
                    OR ($prefix_post.post_content LIKE %s) 
                    OR ( $prefix_postmeta.meta_key = '_awpcp_extra_field[38]' AND $prefix_postmeta.meta_value LIKE %s ) 
                    OR ($prefix_ad.country LIKE %s) 
                    OR ($prefix_ad.county LIKE %s) 
                    OR ($prefix_ad.state LIKE %s) 
                    OR ($prefix_ad.city LIKE %s) ))
                AND $prefix_post.post_type = 'awpcp_listing' 
                AND (($prefix_post.post_status = 'publish')) 
                GROUP BY $prefix_post.ID 
                ORDER BY $prefix_post.post_date DESC
                LIMIT 5;";

            $sqlStatement  = $wpdb->prepare( $sqlStatement, $like, $like, $like, $like, $like, $like, $like, $like );
            
            //print_r($sqlStatement);die;
            $escaped  = esc_sql( $sqlStatement );
            print_r($escaped);die;


Sources

This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.

Source: Stack Overflow

Solution Source