From f8b46dabe8ed0bd1d7c244ce3ca5ae0425de5647 Mon Sep 17 00:00:00 2001 From: Amaia Anabitarte Date: Tue, 11 Dec 2018 11:52:18 +0100 Subject: [PATCH] MDL-64003 core_message: Use sql_like_escape() in message_search_users --- message/classes/api.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/message/classes/api.php b/message/classes/api.php index c0de3dc164a..daab81d1cdd 100644 --- a/message/classes/api.php +++ b/message/classes/api.php @@ -309,7 +309,7 @@ class api { $excludeusers = array($userid, $CFG->siteguest); list($exclude, $excludeparams) = $DB->get_in_or_equal($excludeusers, SQL_PARAMS_NAMED, 'param', false); - $params = array('search' => '%' . $search . '%', 'userid1' => $userid, 'userid2' => $userid); + $params = array('search' => '%' . $DB->sql_like_escape($search) . '%', 'userid1' => $userid, 'userid2' => $userid); // Ok, let's search for contacts first. $sql = "SELECT u.id