4

i'm working with search queries in wordpress and i've noticed that in the original queries terms are between curly brackets and numbers ... like this :

wp_posts.post_title LIKE '{30d0e4b86a2a793010a75740f60810aff6b57f6d18edc10be7ca6dc158e40c06}11{30d0e4b86a2a793010a75740f60810aff6b57f6d18edc10be7ca6dc158e40c06}'

what is it ?

thanks

  • Where and how did you get this? – Max Yudin Jan 16 '18 at 15:00
  • with the filter 'posts_where' for example before editing the query just print_r($where) – Aliiiiiiii Jan 16 '18 at 15:54
4

Those are placeholders for % signs. If you're sending % in the value to be compared against yourself, you'll notice it transforming '%test%' into wp_posts.post_title LIKE '{30d0e4b86a2a793010a75740f60810aff6b57f6d18edc10be7ca6dc158e40c06}\{30d0e4b86a2a793010a75740f60810aff6b57f6d18edc10be7ca6dc158e40c06}11{30d0e4b86a2a793010a75740f60810aff6b57f6d18edc10be7ca6dc158e40c06}\{30d0e4b86a2a793010a75740f60810aff6b57f6d18edc10be7ca6dc158e40c06}' when you look at $query->request.

The Query at the database side will have %. I haven't looked into why exactly and where it is done, but I've noticed that too recently. I believe it wasn't that way a few versions ago, so it might be a recent update.

Edit: I've looked into it some more. It was added in 4.8.3 and comes from wpdb:

/**
 * Adds a placeholder escape string, to escape anything that resembles a printf() placeholder.
 *
 * @since 4.8.3
 *
 * @param string $query The query to escape.
 * @return string The query with the placeholder escape string inserted where necessary.
 */
public function add_placeholder_escape( $query ) {
    /*
     * To prevent returning anything that even vaguely resembles a placeholder,
     * we clobber every % we can find.
     */
    return str_replace( '%', $this->placeholder_escape(), $query );
}

/**
 * Removes the placeholder escape strings from a query.
 *
 * @since 4.8.3
 *
 * @param string $query The query from which the placeholder will be removed.
 * @return string The query with the placeholder removed.
 */
public function remove_placeholder_escape( $query ) {
    return str_replace( $this->placeholder_escape(), '%', $query );
}

The relevant trac ticket was #41925, and it was introduced to make sure that the SQL didn't contain anything that could be misunderstood as a placeholder by sprintf, while bringing "back" numbered placeholders (which were never officially supported but worked. They had been removed because of security issues).

  • ok thanks it's exactly what i was asking to myself in fact :) because when i created my own request with % i was unable to have this placeholders back ! if i found more info i'll post them here (why are they doing it like this for example) – Aliiiiiiii Jan 16 '18 at 15:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.