0

I have a query like this,

    $query = "... user LIKE '%-guest-%' ...";

And when I implemented wpdb->prepare in my query, % characters replaced by random strings. I found solution to apply prepare to the part of the query which needs sql injection protection( I mean separating query to multiple string and apply prepare to only the parts where I need to inject user entered variables). So my question is why I get random string when I use wpdb->prepare for a query which includes % character?

I'm using Wordpress 6.1.1 and non of the those ( How do you properly prepare a %LIKE% SQL statement? ) and those (prepare() not working) solutions worked for me. Wordpress created long random string instead of % character on all queries I tried. I also tried deactivating all plugins and loading a default theme, but I got the same results.

When I did

    echo $wpdb->prepare(" LIKE '%%-guest-%%'" );
    echo $wpdb->prepare(" LIKE '%-guest-%'" );
    echo $wpdb->prepare("%s", "%-guest-%" );
    echo $wpdb->prepare("%%%s", "-guest-%" );
    echo $wpdb->prepare("%%%s%%", "-guest-" );
    echo $wpdb->prepare("'%%%s%%'", "-guest-" );
    echo $wpdb->prepare("%s", "%%-guest-%%" );

I got those outputs in order. String is randomly generated on every page refresh.

LIKE '{abaadfbc0a08cdc488b3b5787097ca4c33fd03adf665dfe397675231bcd7d263}-guest-{abaadfbc0a08cdc488b3b5787097ca4c33fd03adf665dfe397675231bcd7d263}'

LIKE '{abaadfbc0a08cdc488b3b5787097ca4c33fd03adf665dfe397675231bcd7d263}-guest-{abaadfbc0a08cdc488b3b5787097ca4c33fd03adf665dfe397675231bcd7d263}'

    '{abaadfbc0a08cdc488b3b5787097ca4c33fd03adf665dfe397675231bcd7d263}-guest-{abaadfbc0a08cdc488b3b5787097ca4c33fd03adf665dfe397675231bcd7d263}'

 {abaadfbc0a08cdc488b3b5787097ca4c33fd03adf665dfe397675231bcd7d263}-guest-{abaadfbc0a08cdc488b3b5787097ca4c33fd03adf665dfe397675231bcd7d263} 

{abaadfbc0a08cdc488b3b5787097ca4c33fd03adf665dfe397675231bcd7d263}-guest-{abaadfbc0a08cdc488b3b5787097ca4c33fd03adf665dfe397675231bcd7d263}

'{abaadfbc0a08cdc488b3b5787097ca4c33fd03adf665dfe397675231bcd7d263}-guest-{abaadfbc0a08cdc488b3b5787097ca4c33fd03adf665dfe397675231bcd7d263}'

{abaadfbc0a08cdc488b3b5787097ca4c33fd03adf665dfe397675231bcd7d263}-guest-{abaadfbc0a08cdc488b3b5787097ca4c33fd03adf665dfe397675231bcd7d263}
4
  • 1
    despite this, does the SQL query work? You never stated your question, are you asking why it does it? Or are you asking if it's correct? Or are you asking how to remove it? Please edit your question to include a question
    – Tom J Nowell
    Commented Mar 1, 2023 at 18:08
  • If I use wpdb->prepare on my sql it is not working as random strange string added to the query. wpdb->prepare not working as it should when I have % character on my query. I tried all of the suggested solutions on different stack overflow threads, but I always got a corrupted output (I mean output of wpdb->prepare) with random string injected instead of % characters. (I edited and I added my question more clearly to my thread)
    – doraemon
    Commented Mar 1, 2023 at 21:46
  • 1
    @doraemon see my answer here (and do check the links or linked documentations there), and don't worry, that {abaadfbc0a...} will be changed back to % when WordPress sends the query to MySQL.
    – Sally CJ
    Commented Mar 1, 2023 at 22:50
  • Yes, I got those strings when I was debugging why my query is not working, then I tried all combination to get rid of the strings but now I learn that it is default behavior on wordpress and not effecting the final query executed by wpdb. Thanks for the answers, now it is fixed.
    – doraemon
    Commented Mar 3, 2023 at 8:21

0

Browse other questions tagged or ask your own question.