WP_Query with LIKE in meta gives strange query

No, you’re doing everything right and this should actually work as those placeholders are removed at a later point before actually executing the query.

This is part of a security measure introduced with WordPress 4.8.3. Quoting from the corresponding developer note:

As part of the WordPress 4.8.3 release, there is a change in
esc_sql() behaviour that may affect plugin developers who expect
esc_sql() to return a string that’s usable outside of the context of
building a query to send to WPDB.

Source: https://make.wordpress.org/core/2017/10/31/changed-behaviour-of-esc_sql-in-wordpress-4-8-3/

If you’re really curious about what is going on read the blog post by Anthony Ferrara who discovered the underlying vulnerability:https://blog.ircmaxell.com/2017/10/disclosure-wordpress-wpdb-sql-injection-technical.html

Leave a Comment