Refactor the meta query portion of search_orders() to use properly-prepared SQL

Author: stevegrunwell

includes/class-wc-order-data-store-custom-table.php

@@ -556,24 +556,34 @@ public function search_orders( $term ) {
 
 		$order_ids = array();
 
+		// Treat a numeric search term as an order ID.
 		if ( is_numeric( $term ) ) {
 			$order_ids[] = absint( $term );
 		}
 
+		// Search given post meta columns for the query.
+		$postmeta_search = array();
+
 		/**
 		 * Searches on meta data can be slow - this lets you choose what fields to search.
 		 *
 		 * WooCommerce 2.7.0 added _billing_address and _shipping_address meta which contains all
 		 * address data to make this faster. However, this won't work on older orders unless they
 		 * are updated, so search a few others (expand this using the filter if needed).
 		 */
-		$meta_search_fields = array_map( 'wc_clean', apply_filters( 'woocommerce_shop_order_search_fields', array(
-			// While we are searching the custom table, we will also search meta when filtered for backwards compatibility.
-		) ) );
-
-		$postmeta_search = ! empty( $meta_search_fields ) ? $wpdb->get_col(
-			$wpdb->prepare( "SELECT DISTINCT p1.post_id FROM {$wpdb->postmeta} p1 WHERE p1.meta_key IN ('" . implode( "','", array_map( 'esc_sql', $meta_search_fields ) ) . "') AND p1.meta_value LIKE '%%%s%%';", wc_clean( $term ) )
-		) : array();
+		$meta_search_fields = array_map( 'wc_clean', apply_filters( 'woocommerce_shop_order_search_fields', array() ) );
+
+		// If we were given meta fields to search, make it happen.
+		if ( ! empty( $meta_search_fields ) ) {
+			$postmeta_search = $wpdb->get_col( $wpdb->prepare( "
+					SELECT DISTINCT post_id
+					FROM {$wpdb->postmeta}
+					WHERE meta_key IN (" . implode( ',', array_fill( 0, count( $meta_search_fields ), '%s' ) ) . ')
+					AND meta_value LIKE %s
+				',
+				array_merge( $meta_search_fields, array( '%' . $wpdb->esc_like( $term ) . '%' ) )
+			) );
+		}
 
 		return array_unique( array_merge(
 			$order_ids,
@@ -583,7 +593,7 @@ public function search_orders( $term ) {
 						SELECT order_id
 						FROM {$wpdb->prefix}woocommerce_order_items as order_items
 						WHERE order_item_name LIKE %s
-						",
+					",
 					'%' . $wpdb->esc_like( $term ) . '%'
 				)
 			)