diff --git a/src/DataTables/Filters/Constraints/TextConstraint.php b/src/DataTables/Filters/Constraints/TextConstraint.php index 31b12a5e..c6a6fe19 100644 --- a/src/DataTables/Filters/Constraints/TextConstraint.php +++ b/src/DataTables/Filters/Constraints/TextConstraint.php @@ -96,14 +96,15 @@ class TextConstraint extends AbstractConstraint //The CONTAINS, LIKE, STARTS and ENDS operators use the LIKE operator, but we have to build the value string differently $like_value = null; + $escaped_value = str_replace(['%', '_'], ['\%', '\_'], $this->value); if ($this->operator === 'LIKE') { - $like_value = $this->value; + $like_value = $this->value; //Here we do not escape anything, as the user may provide % and _ wildcards } elseif ($this->operator === 'STARTS') { - $like_value = $this->value . '%'; + $like_value = $escaped_value . '%'; } elseif ($this->operator === 'ENDS') { - $like_value = '%' . $this->value; + $like_value = '%' . $escaped_value; } elseif ($this->operator === 'CONTAINS') { - $like_value = '%' . $this->value . '%'; + $like_value = '%' . $escaped_value . '%'; } if ($like_value !== null) { diff --git a/src/DataTables/Filters/PartSearchFilter.php b/src/DataTables/Filters/PartSearchFilter.php index 60832b26..aa8c20f4 100644 --- a/src/DataTables/Filters/PartSearchFilter.php +++ b/src/DataTables/Filters/PartSearchFilter.php @@ -144,6 +144,8 @@ class PartSearchFilter implements FilterInterface if ($this->regex) { $queryBuilder->setParameter('search_query', $this->keyword); } else { + //Escape % and _ characters in the keyword + $this->keyword = str_replace(['%', '_'], ['\%', '\_'], $this->keyword); $queryBuilder->setParameter('search_query', '%' . $this->keyword . '%'); } } diff --git a/src/Doctrine/Functions/ILike.php b/src/Doctrine/Functions/ILike.php index 5246220a..ff2d2163 100644 --- a/src/Doctrine/Functions/ILike.php +++ b/src/Doctrine/Functions/ILike.php @@ -56,7 +56,6 @@ class ILike extends FunctionNode { $platform = $sqlWalker->getConnection()->getDatabasePlatform(); - // if ($platform instanceof AbstractMySQLPlatform || $platform instanceof SQLitePlatform) { $operator = 'LIKE'; } elseif ($platform instanceof PostgreSQLPlatform) { @@ -66,6 +65,12 @@ class ILike extends FunctionNode throw new \RuntimeException('Platform ' . gettype($platform) . ' does not support case insensitive like expressions.'); } - return '(' . $this->value->dispatch($sqlWalker) . ' ' . $operator . ' ' . $this->expr->dispatch($sqlWalker) . ')'; + $escape = ""; + if ($platform instanceof SQLitePlatform) { + //SQLite needs ESCAPE explicitly defined backslash as escape character + $escape = " ESCAPE '\\'"; + } + + return '(' . $this->value->dispatch($sqlWalker) . ' ' . $operator . ' ' . $this->expr->dispatch($sqlWalker) . $escape . ')'; } -} \ No newline at end of file +}