MDL-64003 core_message: Use sql_like_escape() in message_search_users

ragusa87 · Dec 11, 2018 · f8b46da · f8b46da
1 parent 44890bd
commit f8b46da
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/message/classes/api.php b/message/classes/api.php
@@ -309,7 +309,7 @@ public static function message_search_users(int $userid, string $search, int $li
         $excludeusers = array($userid, $CFG->siteguest);
         list($exclude, $excludeparams) = $DB->get_in_or_equal($excludeusers, SQL_PARAMS_NAMED, 'param', false);
 
-        $params = array('search' => '%' . $search . '%', 'userid1' => $userid, 'userid2' => $userid);
+        $params = array('search' => '%' . $DB->sql_like_escape($search) . '%', 'userid1' => $userid, 'userid2' => $userid);
 
         // Ok, let's search for contacts first.
         $sql = "SELECT u.id