From 2eafd45c9fefe4e84084a4fbefdefba7fffcc5e1 Mon Sep 17 00:00:00 2001 From: Sai Asish Y Date: Sun, 25 Oct 2026 01:56:30 -0700 Subject: [PATCH] Escape literal brackets in LIKE BINARY patterns Signed-off-by: Sai Asish Y --- ...s-wp-sqlite-pdo-user-defined-functions.php | 19 ++++++++++++------- .../tests/WP_MySQL_On_SQLite_Tests.php | 1 + 2 files changed, 13 insertions(+), 7 deletions(-) diff --git a/packages/mysql-on-sqlite/src/sqlite/class-wp-sqlite-pdo-user-defined-functions.php b/packages/mysql-on-sqlite/src/sqlite/class-wp-sqlite-pdo-user-defined-functions.php index 7b8828e7b..f2216972d 100644 --- a/packages/mysql-on-sqlite/src/sqlite/class-wp-sqlite-pdo-user-defined-functions.php +++ b/packages/mysql-on-sqlite/src/sqlite/class-wp-sqlite-pdo-user-defined-functions.php @@ -945,14 +945,19 @@ public function _helper_like_to_glob_pattern( $pattern ) { /* * 1. Escape characters that have special meaning in GLOB patterns. * - * We need to: - * 1. Escape "]" as "[]]" to avoid interpreting "[...]" as a character class. - * 2. Escape "*" as "[*]" (must be after 1 to avoid being escaped). - * 3. Escape "?" as "[?]" (must be after 1 to avoid being escaped). + * We need to escape "[" as "[[]", "]" as "[]]", "*" as "[*]", and "?" as "[?]". + * This is done in a single pass, so the brackets that are added by the + * escaping are not escaped again. */ - $pattern = str_replace( ']', '[]]', $pattern ); - $pattern = str_replace( '*', '[*]', $pattern ); - $pattern = str_replace( '?', '[?]', $pattern ); + $pattern = strtr( + $pattern, + array( + '[' => '[[]', + ']' => '[]]', + '*' => '[*]', + '?' => '[?]', + ) + ); /* * 2. Convert LIKE wildcards to GLOB wildcards ("%" -> "*", "_" -> "?"). diff --git a/packages/mysql-on-sqlite/tests/WP_MySQL_On_SQLite_Tests.php b/packages/mysql-on-sqlite/tests/WP_MySQL_On_SQLite_Tests.php index fa0ff7b1c..d8bee149e 100644 --- a/packages/mysql-on-sqlite/tests/WP_MySQL_On_SQLite_Tests.php +++ b/packages/mysql-on-sqlite/tests/WP_MySQL_On_SQLite_Tests.php @@ -6462,6 +6462,7 @@ public function dataLikeBinaryPatterns(): array { 'escaped wildcards' => array( "\xff%_", "\xff\\%\\_", '1' ), 'escaped newline' => array( "\n", "\\\n", '1' ), 'escaped Unicode' => array( '©🙂', '\\©\\🙂', '1' ), + 'literal brackets' => array( 'a[b]', 'a[b]', '1' ), 'null pattern' => array( 'x', null, null ), 'null value' => array( null, 'x', null ), );