Properly escape the LIKE comparison in search_orders()

Author: stevegrunwell

includes/class-wc-order-data-store-custom-table.php

@@ -582,9 +582,9 @@ public function search_orders( $term ) {
 				$wpdb->prepare( "
 						SELECT order_id
 						FROM {$wpdb->prefix}woocommerce_order_items as order_items
-						WHERE order_item_name LIKE '%%%s%%'
+						WHERE order_item_name LIKE %s
 						",
-					$term
+					'%' . $wpdb->esc_like( $term ) . '%'
 				)
 			)
 		) );

tests/test-data-store.php

@@ -141,6 +141,21 @@ public function test_search_orders_checks_table_for_product_item_matches() {
 		);
 	}
 
+	public function test_search_orders_checks_table_for_product_item_matches_with_like_comparison() {
+		$product = $this->factory()->product->create_and_get( array(
+			'post_title' => 'foo bar baz',
+		) );
+		$order = $this->factory()->order->create_and_get();
+		$order->add_product( $product );
+		$order->save();
+
+		$this->assertEquals(
+			array( $order->get_id() ),
+			( new WC_Order_Data_Store_Custom_Table() )->search_orders( 'bar' ),
+			'Product items should be searched using a LIKE comparison and wildcards.'
+		);
+	}
+
 	/**
 	 * @dataProvider order_type_provider()
 	 */