-
Notifications
You must be signed in to change notification settings - Fork 257
Closed
Description
Version
- Carbon Fields: 3.1.2
- WordPress: 5.2.2
- PHP: 7.2.16
Expected Behavior
Use esc_like to a proper escape and avoid a full scan on tables;
Actual Behavior
The $storage_key
is not bein property escaped:
carbon-fields/core/Toolset/Key_Toolset.php
Line 260 in 39c08e4
$comparison = $table_column . ' LIKE "' . esc_sql( $storage_key ) . '%"'; |
Container definition
Container::make( 'theme_options', __( 'Settings' ) )
->set_page_parent( 'edit.php' )
->add_fields(
[
Field::make( 'rich_text', 'footer_posts', __( 'Footer' ) ),
]
);
Steps to Reproduce the Problem
- Get the query being generated to get the value of field;
- Execute a
explain
onmysql
; - See how many rows are being scaned;
Comments
Example of query being generated:
SELECT option_name AS `key`, option_value AS `value` FROM cp45e3_options WHERE ( option_name = "_footer_posts" OR option_name LIKE "_footer_posts|%" ) ORDER BY option_name ASC
Expected query:
SELECT option_name AS `key`, option_value AS `value` FROM cp45e3_options WHERE ( option_name = "_footer_posts" OR option_name LIKE "\_footer\_posts|%" ) ORDER BY option_name ASC
Metadata
Metadata
Assignees
Labels
No labels