Skip to content

fix: correct LIKE ESCAPE backslash escaping causing MySQL syntax error #4180

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
thorsten merged 3 commits into from
Apr 16, 2026
+8 −8
Merged

fix: correct LIKE ESCAPE backslash escaping causing MySQL syntax error #4180

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
a1a0c0e
Initial plan
Copilot Apr 15, 2026
f25c119
fix: SQL syntax error with LIKE ESCAPE clause - use double backslash …
Copilot Apr 15, 2026
b4c951f
fix: use pipe character as LIKE ESCAPE to work across all databases
Copilot Apr 15, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions phpmyfaq/src/phpMyFAQ/Search.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -247,9 +247,9 @@ private function searchCustomPages(string $searchTerm, bool $allLanguages = true
}

// Escape LIKE metacharacters (%, _) to prevent wildcard injection
$escapedWord = str_replace(['\\', '%', '_'], ['\\\\', '\\%', '\\_'], $word);
$escapedWord = str_replace(['|', '%', '_'], ['||', '|%', '|_'], $word);
$searchConditions[] = sprintf(
"(page_title LIKE '%%%s%%' ESCAPE '\\' OR content LIKE '%%%s%%' ESCAPE '\\')",
"(page_title LIKE '%%%s%%' ESCAPE '|' OR content LIKE '%%%s%%' ESCAPE '|')",
$escapedWord,
$escapedWord,
);
Expand Down
2 changes: 1 addition & 1 deletion phpmyfaq/src/phpMyFAQ/Search/Database/PdoPgsql.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -74,7 +74,7 @@ public function search(string $searchTerm): mixed
FROM
%s %s %s %s
WHERE
(%s) ILIKE ('%%%s%%') ESCAPE '\\'
(%s) ILIKE ('%%%s%%') ESCAPE '|'
%s
%s",
$columns,
Expand Down
4 changes: 2 additions & 2 deletions phpmyfaq/src/phpMyFAQ/Search/SearchDatabase.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -264,7 +264,7 @@ public function getMatchClause(string $searchTerm = ''): string
}

$where = sprintf(
"%s%s LIKE '%%%s%%' ESCAPE '\\'",
"%s%s LIKE '%%%s%%' ESCAPE '|'",
$where,
$this->matchingColumns[$j],
self::escapeLikeWildcards($this->configuration->getDb()->escape($keys[$i])),
Expand Down Expand Up @@ -292,6 +292,6 @@ public function disableRelevance(): void
*/
protected static function escapeLikeWildcards(string $term): string
{
return str_replace(['\\', '%', '_'], ['\\\\', '\\%', '\\_'], $term);
return str_replace(['|', '%', '_'], ['||', '|%', '|_'], $term);
}
}
6 changes: 3 additions & 3 deletions tests/phpMyFAQ/Search/SearchDatabaseTest.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -149,7 +149,7 @@ public function testGetMatchClause()
{
$this->searchDatabase->setMatchingColumns(['faqdata.author']);
$this->assertEquals(
" (faqdata.author LIKE '%Thorsten%' ESCAPE '\\')",
" (faqdata.author LIKE '%Thorsten%' ESCAPE '|')",
$this->searchDatabase->getMatchClause('Thorsten'),
);
$this->assertIsString($this->searchDatabase->getMatchClause('Thorsten'));
Expand All @@ -159,7 +159,7 @@ public function testGetMatchClauseWithTwoSearchTerms()
{
$this->searchDatabase->setMatchingColumns(['faqdata.author']);
$this->assertEquals(
" (faqdata.author LIKE '%Thorsten%' ESCAPE '\\') OR (faqdata.author LIKE '%Rinne%' ESCAPE '\\')",
" (faqdata.author LIKE '%Thorsten%' ESCAPE '|') OR (faqdata.author LIKE '%Rinne%' ESCAPE '|')",
$this->searchDatabase->getMatchClause('Thorsten Rinne'),
);
$this->assertIsString($this->searchDatabase->getMatchClause('Thorsten'));
Expand All @@ -169,7 +169,7 @@ public function testGetMatchClauseWithTwoColumns()
{
$this->searchDatabase->setMatchingColumns(['faqdata.author', 'faqdata.thema']);
$this->assertEquals(
" (faqdata.author LIKE '%Thorsten%' ESCAPE '\\' OR faqdata.thema LIKE '%Thorsten%' ESCAPE '\\')",
" (faqdata.author LIKE '%Thorsten%' ESCAPE '|' OR faqdata.thema LIKE '%Thorsten%' ESCAPE '|')",
$this->searchDatabase->getMatchClause('Thorsten'),
);
$this->assertIsString($this->searchDatabase->getMatchClause('Thorsten'));
Expand Down
Loading