First half of escaping for LIKE special characters % and _ before preparing for SQL.
Description
Use this only before wpdb::prepare() or esc_sql(). Reversing the order is very bad for security. Example Prepared Statement: $wild = '%';
$find = 'only 43% of planets';
$like = $wild . $wpdb->esc_like( $find ) . $wild;
$sql = $wpdb->prepare( "SELECT * FROM $wpdb->posts WHERE post_content LIKE %s", $like ); Example Escape Chain: $sql = esc_sql( $wpdb->esc_like( $input ) );
Parameters
$textstring
The raw text to be escaped. The input typed by the user should have no extra or deleted slashes.
Return
string
Text in the form of a LIKE phrase. The output is not SQL safe. Call wpdb::prepare() or wpdb::_real_escape() next.
Signature, return type and hooks compared across 5 parsed releases.
About this page
Parsed data
Generated from the wordpress-develop 6.9.7 tag, from src/wp-includes/class-wpdb.php, and regenerated for each WordPress release so it tracks the code rather than a snapshot of it.
Corrections
Something wrong on this page? Report it and it gets fixed in the next regeneration.