wpdb::esc_like() WordPress Method

The wpdb::esc_like() method is used to escape LIKE wildcards in SQL. LIKE wildcards are used in database search operations. The method takes a string as an argument and returns the escaped string.

wpdb::esc_like( string $text ) #

First half of escaping for LIKE special characters % and _ before preparing for SQL.


Description

Use this only before wpdb::prepare() or esc_sql(). Reversing the order is very bad for security.

Example Prepared Statement:

$wild = '%';
$find = 'only 43% of planets';
$like = $wild . $wpdb->esc_like( $find ) . $wild;
$sql  = $wpdb->prepare( "SELECT * FROM $wpdb->posts WHERE post_content LIKE %s", $like );

Example Escape Chain:

$sql  = esc_sql( $wpdb->esc_like( $input ) );

Top ↑

Parameters

$text

(string)(Required)The raw text to be escaped. The input typed by the user should have no extra or deleted slashes.


Top ↑

Return

(string) Text in the form of a LIKE phrase. The output is not SQL safe. Call wpdb::prepare() or wpdb::_real_escape() next.


Top ↑

Source

File: wp-includes/wp-db.php

	public function esc_like( $text ) {
		return addcslashes( $text, '_%\\' );
	}


Top ↑

Changelog

Changelog
VersionDescription
4.0.0Introduced.

The content displayed on this page has been created in part by processing WordPress source code files which are made available under the GPLv2 (or a later version) license by theĀ Free Software Foundation. In addition to this, the content includes user-written examples and information. All material is subject to review and curation by the WPPaste.com community.