From 5219bbbbc9a4214bb4dbec282aab35c9955fe146 Mon Sep 17 00:00:00 2001 From: Scott Taylor Date: Tue, 10 Jun 2014 02:20:16 +0000 Subject: [PATCH] In `WP_Comment_Query::get_search_sql()`, don't double-like-escape. Props miqrogroove. See #10041. Built from https://develop.svn.wordpress.org/trunk@28720 git-svn-id: http://core.svn.wordpress.org/trunk@28534 1a063a9b-81f0-0310-95a4-ce76da25c4cd --- wp-includes/comment.php | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/wp-includes/comment.php b/wp-includes/comment.php index eaabee66a0..e69fe3a496 100644 --- a/wp-includes/comment.php +++ b/wp-includes/comment.php @@ -483,9 +483,12 @@ class WP_Comment_Query { protected function get_search_sql( $string, $cols ) { global $wpdb; + $like = '%' . $wpdb->esc_like( $string ) . '%'; + $searches = array(); - foreach ( $cols as $col ) - $searches[] = $wpdb->prepare( "$col LIKE %s", $wpdb->esc_like( $string ) ); + foreach ( $cols as $col ) { + $searches[] = $wpdb->prepare( "$col LIKE %s", $like ); + } return ' AND (' . implode(' OR ', $searches) . ')'; }