6

I'm trying to build a prepared statement with wildcards however I'm running into an issue where the percentage wildcard characters seem to be returning what seem to be hashes for the wildcards and I'm not sure why. The code in question is:

$condition = $wpdb->prefix."posts.post_title LIKE %%%s%%";
$query['conditions'][] = $wpdb->prepare($condition, $name);

And the results are:

posts.post_title LIKE {d690dd63f5944b9bca120e110c22802f0ec841d8120d813dd4abc08cba4a59c0}BT{d690dd63f5944b9bca120e110c22802f0ec841d8120d813dd4abc08cba4a59c0}

Just wondered if anyone had any ideas on what could be causing this. Any help would be greatly appreciated.

Thanks

1 Answer 1

16

Don't worry about the hashes, they'll get replaced with % in $wpdb when you execute your query.

These hashes were introduced with WP v4.8.3 as a fix for SQL injection attack.

They're placeholders for the % character. It prevents someone from using something other than %s, %d, and %f. If there's a % other than those approved uses, it'll replace the % with a hash. That hash will get replaced back to % when $wpdb executes the query.

If you want to remove the hashes yourself, you can use remove_placeholder_escape(), like so:

$query['conditions'][] = $wpdb->remove_placeholder_escape($wpdb->prepare($condition, $name));

1
  • 1
    Seriously, after hours of scratching my head, in why I did get these hashes, this suddenly came up. Thank you sir. Jan 4, 2022 at 20:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.