Fix broken LIKE escaping (#898)

* Fix broken LIKE escaping
spatie · Oct 5, 2023 · a91a348 · a91a348
1 parent 054fda6
commit a91a348
Showing 1 changed file with 11 additions and 2 deletions.
diff --git a/src/Filters/FiltersPartial.php b/src/Filters/FiltersPartial.php
@@ -44,11 +44,20 @@ public function __invoke(Builder $query, $value, string $property)
 
     protected function getWhereRawParameters($value, string $property): array
     {
-        $value = mb_strtolower($value, 'UTF8');
+        $value = mb_strtolower((string) $value, 'UTF8');
 
         return [
             "LOWER({$property}) LIKE ?",
-            ["%{$value}%"],
+            ['%'.self::escapeLike($value).'%'],
         ];
     }
+
+    private static function escapeLike(string $value): string
+    {
+        return str_replace(
+            ['\\', '_', '%'],
+            ['\\\\', '\\_', '\\%'],
+            $value,
+        );
+    }
 }