← All changes | classes/class-group.php +5 -3 114 → 158 View file →

		@@ -7,8 +7,9 @@
7	7
8	8	namespace LassoLite\Classes;
9	9
10	10	use LassoLite\Admin\Constant;
	11	+use LassoLite\Classes\Helper;
11	12	use LassoLite\Models\Model;
12	13
13	14	/**
14	15	* Model
		@@ -30,10 +31,10 @@
30	31	$term_taxonomy = Model::get_wpdb()->term_taxonomy;
31	32	$term_relationships = Model::get_wpdb()->term_relationships;
32	33	$posts = Model::get_wpdb()->posts;
33	34	if ( ! empty( $search ) ) {
34		- $search_body = '%' . str_replace( ' ', '%', $search ) . '%';
35		- $search = "AND t.name LIKE '" . $search_body . "'";
	35	+ $search_body = Helper::esc_like_query( $search );
	36	+ $search = Model::get_wpdb()->prepare( 'AND t.name LIKE %s', $search_body );
36	37	}
37	38	$sql = "
38	39	SELECT
39	40	t.term_id as `post_id`,
		@@ -100,9 +101,10 @@
100	101	$term_taxonomy = Model::get_wpdb()->term_taxonomy;
101	102	$term_relationships = Model::get_wpdb()->term_relationships;
102	103	$posts = Model::get_wpdb()->posts;
103	104	if ( ! empty( $search ) ) {
104		- $search = "AND t.name LIKE '" . $search . "'";
	105	+ $search = Helper::esc_like_query( $search );
	106	+ $search = Model::get_wpdb()->prepare( 'AND t.name LIKE %s', $search );
105	107	}
106	108	$sql = "
107	109	SELECT
108	110	t.term_id as `post_id`,