wpdb::esc_like() WordPress Method
The wpdb::esc_like() method is used to escape LIKE wildcards in SQL. LIKE wildcards are used in database search operations. The method takes a string as an argument and returns the escaped string.
wpdb::esc_like( string $text ) #
First half of escaping for LIKE
special characters %
and _
before preparing for SQL.
Description
Use this only before wpdb::prepare() or esc_sql(). Reversing the order is very bad for security.
Example Prepared Statement:
$wild = '%';
$find = 'only 43% of planets';
$like = $wild . $wpdb->esc_like( $find ) . $wild;
$sql = $wpdb->prepare( "SELECT * FROM $wpdb->posts WHERE post_content LIKE %s", $like );
Example Escape Chain:
$sql = esc_sql( $wpdb->esc_like( $input ) );
Parameters
- $text
(string)(Required)The raw text to be escaped. The input typed by the user should have no extra or deleted slashes.
Return
(string) Text in the form of a LIKE phrase. The output is not SQL safe. Call wpdb::prepare() or wpdb::_real_escape() next.
Source
File: wp-includes/wp-db.php
public function esc_like( $text ) { return addcslashes( $text, '_%\\' ); }
Expand full source codeCollapse full source codeView on TracView on GitHub
Changelog
Version | Description |
---|---|
4.0.0 | Introduced. |