diff --git a/wp-includes/deprecated.php b/wp-includes/deprecated.php index a52753e3cb..0671dc1257 100644 --- a/wp-includes/deprecated.php +++ b/wp-includes/deprecated.php @@ -3458,6 +3458,21 @@ function format_to_post( $content ) { return $content; } +/** + * Formerly used to escape strings before searching the DB. It was poorly documented and never worked as described. + * + * @since 2.5.0 + * @deprecated 4.0.0 + * @deprecated Use wpdb::esc_like() + * + * @param string $text The text to be escaped. + * @return string text, safe for inclusion in LIKE query. + */ +function like_escape($text) { + _deprecated_function( __FUNCTION__, '4.0', 'wpdb::esc_like()' ); + return str_replace( array( "%", "_" ), array( "\\%", "\\_" ), $text ); +} + /** * Determines if the URL can be accessed over SSL. * diff --git a/wp-includes/formatting.php b/wp-includes/formatting.php index 56a9c1edd0..9292ee1762 100644 --- a/wp-includes/formatting.php +++ b/wp-includes/formatting.php @@ -3099,18 +3099,6 @@ function tag_escape($tag_name) { return apply_filters( 'tag_escape', $safe_tag, $tag_name ); } -/** - * Escapes text for SQL LIKE special characters % and _. - * - * @since 2.5.0 - * - * @param string $text The text to be escaped. - * @return string text, safe for inclusion in LIKE query. - */ -function like_escape($text) { - return str_replace(array("%", "_"), array("\\%", "\\_"), $text); -} - /** * Convert full URL paths to absolute paths. * diff --git a/wp-includes/version.php b/wp-includes/version.php index 4af280e0cf..8952cb14c0 100644 --- a/wp-includes/version.php +++ b/wp-includes/version.php @@ -4,7 +4,7 @@ * * @global string $wp_version */ -$wp_version = '4.0-alpha-20140609'; +$wp_version = '4.0-alpha-20140610'; /** * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema. diff --git a/wp-includes/wp-db.php b/wp-includes/wp-db.php index 68ac32c219..7a09d62a9e 100644 --- a/wp-includes/wp-db.php +++ b/wp-includes/wp-db.php @@ -1168,6 +1168,29 @@ class wpdb { return @vsprintf( $query, $args ); } + /** + * First half of escaping for LIKE special characters % and _ before preparing for MySQL. + * + * Use this only before wpdb::prepare() or esc_sql(). Reversing the order is very bad for security. + * + * Example Prepared Statement: + * $wild = '%'; + * $find = 'only 43% of planets'; + * $like = $wild . $wpdb->esc_like( $find ) . $wild; + * $sql = $wpdb->prepare( "SELECT * FROM $wpdb->posts WHERE post_content LIKE %s", $like ); + * + * Example Escape Chain: + * $sql = esc_sql( $wpdb->esc_like( $input ) ); + * + * @since 4.0.0 + * + * @param string $text The raw text to be escaped. The input typed by the user should have no extra or deleted slashes. + * @return string Text in the form of a LIKE phrase. The output is not SQL safe. Call prepare or real_escape next. + */ + function esc_like( $text ) { + return addcslashes( $text, '_%\\' ); + } + /** * Print SQL/DB error. *