0

I'm trying to create an input field that can autocomplete only title from a CPT. They don't have to be linked, they just need to pull titles of a cpt alphabetically and searching from the first letters.

I found a great post on the stackexchange, but it is old and it uses like_escape() which is deprecated. I understand you should now use esc_like() . I was hoping that someone can point me in the right direction in how to transition from like_escape() to esc_like() from the code below ?

add_action('wp_enqueue_scripts', 'se_wp_enqueue_scripts');
function se_wp_enqueue_scripts() {
wp_enqueue_script('suggest');
}

add_action('wp_head', 'se_wp_head');
function se_wp_head() {
?>
<script type="text/javascript">
var se_ajax_url = '<?php echo admin_url('admin-ajax.php'); ?>';

jQuery(document).ready(function() {
    jQuery('#se_search_element_id').suggest(se_ajax_url + '?action=se_lookup');
});
</script>

<?php
}

add_action('wp_ajax_se_lookup', 'se_lookup');
add_action('wp_ajax_nopriv_se_lookup', 'se_lookup');

function se_lookup() {
global $wpdb;

$search = like_escape($_REQUEST['q']);

$query = 'SELECT ID,post_title FROM ' . $wpdb->posts . '
    WHERE post_title LIKE \'' . $search . '%\'
    AND post_type = \'post_type_name\'
    AND post_status = \'publish\'
    ORDER BY post_title ASC';
foreach ($wpdb->get_results($query) as $row) {
    $post_title = $row->post_title;
    $id = $row->ID;

    $meta = get_post_meta($id, 'YOUR_METANAME', TRUE);

    echo $post_title . ' (' . $meta . ')' . "\n";
}
die();
}

Original post and credit to the following:

Auto-complete or auto-suggest from list of post titles

1 Answer 1

0

Substitute $search = like_escape($_REQUEST['q']); with

$search = $wpdb->esc_like( $_REQUEST['q'] );

(Note assuming $_REQUEST has standard WP magic_quotes_gpc escaping.)

For reference, here's the exact code I put in "functions.php":

add_action('wp_enqueue_scripts', 'se_wp_enqueue_scripts');
function se_wp_enqueue_scripts() {
    wp_enqueue_script('suggest');
}

add_action('wp_footer', 'se_wp_head');
function se_wp_head() {
?>
Search: <input id="se_search_element_id" type="text">
<script type="text/javascript">
var se_ajax_url = '<?php echo admin_url('admin-ajax.php'); ?>';

jQuery(document).ready(function() {
    jQuery('#se_search_element_id').suggest(se_ajax_url + '?action=se_lookup', {minchars:1});
});
</script>

<?php
}

add_action('wp_ajax_se_lookup', 'se_lookup');
add_action('wp_ajax_nopriv_se_lookup', 'se_lookup');

function se_lookup() {
    global $wpdb;

    $search = $wpdb->esc_like($_REQUEST['q']);

    $query = 'SELECT ID,post_title FROM ' . $wpdb->posts . '
        WHERE post_title LIKE \'' . $search . '%\'
        AND post_type = \'post\'
        AND post_status = \'publish\'
        ORDER BY post_title ASC';
    $rows = $wpdb->get_results($query);
    foreach ($rows as $row) {
        $post_title = $row->post_title;
        $id = $row->ID;
        echo $post_title, "\n";
    }
    wp_die();
}

Note the suggestion box just comes up as a list so would need some styling...

7
  • 1
    Do I need the strip slashes in the query with "LIKE" and the other query variables? Commented Nov 9, 2015 at 18:00
  • No, I see what you're saying - so my saying to use esc_sql() (and dig at original answer) is wrong as the query vars will already be escaped - will update answer (which is now just a straight swop)...
    – bonger
    Commented Nov 9, 2015 at 18:37
  • Thanks. Marked as answer. I was hoping that changing from the deprecated function would get this working for me, but alas...Unless im misunderstanding this, can't I get this to work on a standard input with an ID of se_search_element_id and a name of q? Commented Nov 9, 2015 at 21:46
  • Okay, ta, just tried it - the name of the input doesn't need to be q, q is set internally by suggest, just the id of the input needs to be se_search_element_id - "works for me", though for ease of testing I used wp_footer, not wp_head, and I just returned the $post_title, no meta, and set the minchars option to 1 via jQuery('#se_search_element_id').suggest(se_ajax_url + '?action=se_lookup', {minchars:1}); but I don't think any of those changes really matter...
    – bonger
    Commented Nov 9, 2015 at 22:55
  • Added test code to answer for your reference...
    – bonger
    Commented Nov 9, 2015 at 23:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.