| @@ -374,9 +374,11 @@ | ||
| 374 | 374 | if( in_array( $field['type'], [ 'text', 'textarea', 'email', 'search', 'tel' ] ) ) { |
| 375 | 375 | foreach( $value as $v ) $wheres[] = "`metavalue` LIKE '%" . esc_sql( wp_unslash( $v ) ) . "%'"; |
| 376 | 376 | } elseif( $field['type'] === 'checkbox' || ( $field['type'] === 'select' && wpfval( $field, 'isMultiChoice' ) ) || ( $field['type'] === 'autocomplete' && wpfval( $field, 'isMultiChoice' ) ) ) { |
| 377 | 377 | foreach( $value as $v ) { |
| 378 | - $v = preg_quote( preg_quote( wp_unslash( $v ) ) ); | |
| 378 | + // esc_sql() neutralizes SQL quotes/backslashes; preg_quote keeps the value a regex literal. | |
| 379 | + // Without esc_sql an apostrophe breaks out of the REGEXP string literal (unauthenticated SQLi). | |
| 380 | + $v = esc_sql( preg_quote( preg_quote( wp_unslash( $v ) ) ) ); | |
| 379 | 381 | $wheres[] = "`metavalue` REGEXP '[\\\[,]\"" . $v . "\"[,\\\]]'"; |
| 380 | 382 | } |
| 381 | 383 | } else { |
| 382 | 384 | foreach( $value as $v ) $wheres[] = "`metavalue` LIKE '" . esc_sql( wp_unslash( $v ) ) . "'"; |
