| @@ -320,9 +320,13 @@ | ||
| 320 | 320 | return; |
| 321 | 321 | } |
| 322 | 322 | |
| 323 | 323 | global $wpdb; |
| 324 | - $sql = "SELECT * FROM $wpdb->postmeta WHERE meta_key = '" . self::GATEWAY_META_KEY . "' AND meta_value LIKE '%$payment%';"; | |
| 324 | + $sql = $wpdb->prepare( | |
| 325 | + "SELECT * FROM $wpdb->postmeta WHERE meta_key = %s AND meta_value LIKE %s", | |
| 326 | + self::GATEWAY_META_KEY, | |
| 327 | + '%' . $wpdb->esc_like( $payment ) . '%' | |
| 328 | + ); | |
| 325 | 329 | |
| 326 | 330 | // phpcs:ignore WordPress.DB |
| 327 | 331 | return $wpdb->get_row( $sql, ARRAY_A ); |
| 328 | 332 | } |
