fix: missing escaping in sql query

podlove · Feb 6, 2024 · b16b7a2 · b16b7a2
1 parent 79b3f7e
commit b16b7a2
Showing 1 changed file with 2 additions and 3 deletions.
diff --git a/model/base.php b/model/base.php
@@ -210,9 +210,8 @@ public static function find_one_by_property( $property, $value ) {
 		$model = new $class();
 		$model->flag_as_not_new();
 
-		$row = $wpdb->get_row(
-			'SELECT * FROM ' . static::table_name() . ' WHERE ' . $property .  ' = \'' . $value . '\' LIMIT 0,1'
-		);
+		$query = $wpdb->prepare('SELECT * FROM ' . static::table_name() . ' WHERE ' . $property .  ' = \'%s\' LIMIT 0,1', $value);
+		$row = $wpdb->get_row($query);
 
 		if ( ! $row ) {
 			return null;