Use of LIKE ‘%%%s%%’

Hi,

At the moment your plugin has 11 cases where you use “%%%s”, e.g.

class-wpsc-dictionary.php
$wpdb->prepare('SELECT id, word FROM ' . $table_name . ' WHERE word LIKE "%%%s%%"', $search)

While this is fine at the moment, it is an undocumented “feature” that should be removed in the future.

The wpdb::prepare() documentation notes that percentage wildcards cannot be inserted directly into the SQL, and instead the complete LIKE string should be provided via the arguments, e.g.

$wpdb->prepare('SELECT id, word FROM ' . $table_name . ' WHERE word LIKE %s', '%' . $wpdb->esc_like( $search ) . '%')

It’s undocumented because the “%%” should only provide a single literal percentage sign, and not cause the following “%s” to be unquoted.