Plugin authors and website developers who work with WordPress database queries should notice an important change coming in WordPress 4.0.
The function like_escape() is no longer used in WordPress core code. It is still available as a deprecated function, so it still works in any existing plugins that rely on it. However, a new and different function is available that should be used in all new code.
Deprecated means that anyone using code that calls like_escape() with WP_DEBUG enabled will see an error message. If WP_DEBUG_LOG is also enabled, the error message will appear in the /wp-content/debug.log file.
Let’s look at an example of core code where I removed like_escape() and implemented the new function $wpdb->esc_like().
3.9 Old Style
$search_orderby_s = like_escape( esc_sql( $q['s'] ) );
$search_orderby .= "WHEN $wpdb->posts.post_title LIKE '%{$search_orderby_s}%' THEN 1 ";What did this do? It was an old snippet from /wp-includes/query.php that set up a search for post titles. The input $q['s'] was escaped using two functions before it was added to the post_title LIKE expression. Now let’s see how I replaced that snippet in the next version.
4.0 New Style
$like = '%' . $wpdb->esc_like( $q['s'] ) . '%';
$search_orderby .= $wpdb->prepare( "WHEN $wpdb->posts.post_title LIKE %s THEN 1 ", $like );There are two important differences to notice.
- I changed the
like_escape()call to$wpdb->esc_like(). - I changed the
esc_sql()call to$wpdb->prepare().
The second change is important because esc_sql() is not secure if it is called before, or inside, the call to the new function $wpdb->esc_like(). By relying on the preferred style of the function prepare(), I can easily see that each instance of $wpdb->esc_like() will run first instead of last.
4.0 Alternative Style
Here is something that still works, but I avoided using it. Notice the old query is unchanged. It is critically important to call the two escaping functions in the correct order when using $wpdb->esc_like().
$search_orderby_s = esc_sql( $wpdb->esc_like( $q['s'] ) ); // This is the correct order.
$search_orderby .= "WHEN $wpdb->posts.post_title LIKE '%{$search_orderby_s}%' THEN 1 ";How Should I Get My Code Ready for 4.0?
The nice thing about deprecated functions is that you can still use them and they don’t change. Your existing code should work fine.
When you write new code, remember that using $wpdb->esc_like() is not compatible with WordPress 3.9. This should be avoided if you need compatibility with old versions. When you are ready to adopt 4.0 as your minimum version, consider using the new function.
If you have a specific need for the new function in old versions of WordPress, I suggest copying the new function into your plugin under a different name. This would be the simplest solution, but rarely necessary.
Why Did like_escape() Change to $wpdb->esc_like() ?
There were several problems with the old function that could not be fixed.
- Documentation said the function’s output was safe to use in SQL queries. That was not correct.
- The function’s output was not fully compatible with LIKE expressions in MySQL.
- The function had been used many different ways in core code, some of which were incompatible with the desired output.
- Changing the old function instead of creating a new one would have caused many security problems in plugins.
- The function was related to $wpdb because of its MySQL syntax, which does not work on other databases.
Is There a Security Problem with like_escape()?
The old function like_escape() was not intended to be used in any security sensitive context. There are no security problems when it is used correctly.
With that said, I am concerned that plugin authors frequently confused the old function like_escape() with esc_sql(), which was used for security. The documentation for like_escape() was misleading and very confusing about this point.
Just remember, like_escape() does not provide any security for your database!
So What Does $wpdb->esc_like() Do Anyway?
Whenever user input or other raw data are copied into a WordPress query, the data must be escaped using $wpdb->prepare() or esc_sql(). This prevents certain characters, such as quotes, from getting confused with SQL commands.
In a LIKE expression, there are additional special characters that are used as wildcards to search for partial matches in the database. Those wildcard characters have to be escaped from the user input so that they are not confused with the wildcards added by the programmer.
Before adding user input to this type of search query, $wpdb->esc_like() should be called for compatibility, and then $wpdb->prepare() must be called for security, in that order.
How to Use $wpdb in Functions
It is very rare to use $wpdb->esc_like() without also running a query. But just in case you want to …
function my_search( $input ) {
global $wpdb;
$output = $wpdb->esc_like( $input );
}… remember to reference $wpdb as a global variable.