0

I found this filter some time ago at How to filter my search in post if contains a word in title, content or excerpt?

It worked well. But now I am getting an error message of like_escape is deprecated since version 4.0.0! Use wpdb::esc_like()

It tried replacing esc_like, with wpdb::_esc_like, but that resulted in a message of:

Deprecated: Non-static method wpdb::escape()

If I removed like_escape and just left the query inside esc_sql would that be secure enough?

I am open to a better way to structure this.

Thanks.

function general_filter( $where, &$wp_query )
{
    global $wpdb;
    if ( $search_term = $wp_query->get( 'search_prod_title' ) ) {
        $where .= ' AND (' . $wpdb->posts . '.post_title LIKE \'%' . esc_sql( like_escape( $search_term ) ) . '%\' OR ' . $wpdb->posts . ' .post_excerpt LIKE \'%' . esc_sql( like_escape( $search_term ) ) . '%\' OR ' . $wpdb->posts . ' .post_content LIKE \'%' . esc_sql( like_escape( $search_term ) ) . '%\')';
    }
    return $where;
}

1 Answer 1

0

The problem is that you've interpreted wpdb::esc_like as a literal copy paste, and not a direction, and used it as a static function, when it is not a static function.

Good:

global $wpdb;
$foo = $wpdb->esc_like( $bar );

Bad:

$foo = wpdb::esc_like( $bar );

Other things to note:

  • The & in &$wp_query ) is a holdover from PHP 4 that they fixed in PHP 5. However, a lot of WP devs weren't sure and didn't know this and copy pasted it everywhere. You should remove the &. The same with &$this, change it to $this. WordPress doesn't even run on PHP 4.x
  • The filter you found was just that persons attempt that they were asking how to fix, there are other ways to do what you want
  • An actual search solution will massively outperform this without needing to write custom SQL. Look into solutions such as Elasticsearch, Solr, etc
  • Generally it's far safer to use $wpdb->prepare, though sometimes that isn't always possible. Needing to write SQL for WP tables is normally a warning sign that you're doing something wrong.
  • If you used double quotes then you wouldn't need to slash escape your single quotes inside the SQL string. E.g. "'test'" vs '\'test\''
2
  • Tom, thank you for your insights on this. I finally got the queries working. I am not familiar with Elasticsearch or Solr. This client's website does not have a lot of traffic. Would those services be a good fit for smaller websites? Jun 30 at 21:32
  • Depends how rich your client is, what their budget is for hosting and search, and how highly they value it. You should price up the options and have a conversation with them
    – Tom J Nowell
    Jun 30 at 21:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.