- Patch #683736 by c960657: use db_like() where appropriate.

5 files changed, 8 insertions, 9 deletions

diff --git a/modules/field/modules/field_sql_storage/field_sql_storage.module b/modules/field/modules/field_sql_storage/field_sql_storage.module
index bc0d379d8..65ceb5228 100644
--- a/modules/field/modules/field_sql_storage/field_sql_storage.module
+++ b/modules/field/modules/field_sql_storage/field_sql_storage.module
@@ -494,17 +494,17 @@ function field_sql_storage_field_storage_query($field_id, $conditions, $options)
     switch ($operator) {
       case 'STARTS_WITH':
         $operator = 'LIKE';
-        $value .= '%';
+        $value = db_like($value) . '%';
         break;
 
       case 'ENDS_WITH':
         $operator = 'LIKE';
-        $value = "$value%";
+        $value = '%' . db_like($value);
         break;
 
       case 'CONTAINS':
         $operator = 'LIKE';
-        $value = "%$value%";
+        $value = '%' . db_like($value) . '%';
         break;
     }
     // Translate field columns into prefixed db columns.
diff --git a/modules/profile/profile.pages.inc b/modules/profile/profile.pages.inc
index bfc23e221..346223285 100644
--- a/modules/profile/profile.pages.inc
+++ b/modules/profile/profile.pages.inc
@@ -53,7 +53,7 @@ function profile_browse() {
         $query->condition('v.value', $value);
         break;
       case 'list':
-        $query->condition('v.value', '%' . $value . '%', 'LIKE');
+        $query->condition('v.value', '%' . db_like($value) . '%', 'LIKE');
         break;
       default:
         drupal_not_found();
diff --git a/modules/search/search.extender.inc b/modules/search/search.extender.inc
index 99a96057e..05daa7850 100644
--- a/modules/search/search.extender.inc
+++ b/modules/search/search.extender.inc
@@ -442,4 +442,4 @@ class SearchQuery extends SelectQueryExtender {
 
     return $this->query->execute();
   }
-}
\ No newline at end of file
+}
diff --git a/modules/taxonomy/taxonomy.module b/modules/taxonomy/taxonomy.module
index d7ee54ba6..a6ea124d0 100644
--- a/modules/taxonomy/taxonomy.module
+++ b/modules/taxonomy/taxonomy.module
@@ -813,6 +813,7 @@ class TaxonomyTermController extends DrupalDefaultEntityController {
       foreach ($conditions as $key => $condition) {
         if ($condition['field'] == 'base.name') {
           $conditions[$key]['operator'] = 'LIKE';
+          $conditions[$key]['value'] = db_like($conditions[$key]['value']);
         }
       }
     }
diff --git a/modules/taxonomy/taxonomy.pages.inc b/modules/taxonomy/taxonomy.pages.inc
index 712e8bc75..4b65472ef 100644
--- a/modules/taxonomy/taxonomy.pages.inc
+++ b/modules/taxonomy/taxonomy.pages.inc
@@ -102,13 +102,11 @@ function taxonomy_autocomplete($field_name, $tags_typed = '') {
     if (!empty($tags_typed)) {
       $query->condition('t.name', $tags_typed, 'NOT IN');
     }
+    // Select rows that match by term name.
     $tags_return = $query
       ->fields('t', array('tid', 'name'))
       ->condition('t.vid', $vids)
-      // Select rows that match by term name.
-      ->condition(db_or()
-      ->where("t.name LIKE :last_string", array(':last_string' => '%' . $tag_last . '%'))
-      )
+      ->condition('t.name', '%' . db_like($tag_last) . '%', 'LIKE')
       ->range(0, 10)
       ->execute()
       ->fetchAllKeyed();