From 8981337c6e35b7d8119ae09c1bacfc01557b99c6 Mon Sep 17 00:00:00 2001 From: ashubawork Date: Thu, 14 Mar 2024 09:25:51 +0200 Subject: [PATCH] - add esc_sql() --- includes/core/class-member-directory-meta.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/includes/core/class-member-directory-meta.php b/includes/core/class-member-directory-meta.php index 55574529..72a725e4 100644 --- a/includes/core/class-member-directory-meta.php +++ b/includes/core/class-member-directory-meta.php @@ -348,7 +348,7 @@ if ( ! class_exists( 'um\core\Member_Directory_Meta' ) ) { * add_filter( 'um_members_directory_filter_select_meta', 'my_um_members_directory_filter_select_meta', 10, 2 ); */ $relation = apply_filters( 'um_members_directory_filter_select_meta', 'OR', $field ); - $values = implode( ' ' . $relation . ' ', $values_array ); + $values = implode( ' ' . esc_sql( $relation ) . ' ', $values_array ); // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- $join_alias and $values variables are pre-escaped or $wpdb->prepare. $this->where_clauses[] = $wpdb->prepare( "( {$join_alias}.um_key = %s AND ( {$values} ) )", $field );