10

Are these {xxx...} placeholders for % in a LIKE statement normal? If so, when do they get converted back to %'s?

SHELL
wp> global $wpdb;
wp> $q = "%s";
=> string(2) "%s"
wp> $pq = $wpdb->prepare($q, '%hi%');
=> string(136) "'{6e039dc0b074a5ff6828a070d0c24708d132341f32dff55a053f1410beabaacd}hi{6e039dc0b074a5ff6828a070d0c24708d132341f32dff55a053f1410beabaacd}'"

1 Answer 1

13

Yes, they're normal. They were added in 4.8.3 to fix an SQL injection vulnerability.

You can read an article describing the technical reasons for this happening here and the ticket for the change here.

The placeholder characters are replaced by the random characters on the last line of $wpdb->prepare() with the $wpdb->add_placeholder_escape() function, which calls $wpdb->placeholder_escape() internally.

These placeholders are removed in $wpdb->query() by the $wpdb->remove_placeholder_escape() function which is added as a filter to the query hook.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.