like转义

lisijie · May 31, 2018 · 91b8370 · 91b8370
1 parent 777c4a1
commit 91b8370
Showing 1 changed file with 23 additions and 4 deletions.
diff --git a/src/Core/Model.php b/src/Core/Model.php
@@ -349,22 +349,26 @@ protected function parseFilter(array $filter)
                             $val = [$val];
                         }
                         foreach ($val as $k => $v) {
-                            $where[] = "`{$field}` LIKE " . $this->db->quote("%{$v}%");
+                            $v = $this->escapeLike($v);
+                            $where[] = "`{$field}` LIKE '%{$v}%'";
                         }
                         break;
                     case 'notlike': //NOT LIKE ‘%%’, 支持多个
                         if (!is_array($val)) {
                             $val = [$val];
                         }
                         foreach ($val as $k => $v) {
-                            $where[] = "`{$field}` NOT LIKE " . $this->db->quote("%{$v}%");
+                            $v = $this->escapeLike($v);
+                            $where[] = "`{$field}` NOT LIKE '%{$v}%'";
                         }
                         break;
                     case 'startswith': //LIKE 'xxx%'
-                        $where[] = "`{$field}` LIKE " . $this->db->quote("{$val}%");
+                        $val = $this->escapeLike($val);
+                        $where[] = "`{$field}` LIKE '{$val}%'";
                         break;
                     case 'endswith': //LIKE '%xxx'
-                        $where[] = "`{$field}` LIKE " . $this->db->quote("%{$val}");
+                        $val = $this->escapeLike($val);
+                        $where[] = "`{$field}` LIKE '%{$val}'";
                         break;
                     case 'between': //between 'a' AND 'b'
                         $where[] = "(`{$field}` BETWEEN " . $this->db->quote($val[0]) . " AND " . $this->db->quote($val[1]) . ")";
@@ -403,6 +407,21 @@ protected function parseFilter(array $filter)
         return implode(' AND ', $where);
     }
 
+    /**
+     * like转义
+     *
+     * @param $string
+     * @return string
+     */
+    private function escapeLike($string)
+    {
+        if (empty($string)) {
+            return $string;
+        }
+        $string = strtr($string, ['\\' => '\\\\']);
+        return strtr(substr($this->db->quote($string), 1, -1), ['%' => '\%', '_' => '\_']);
+    }
+
     /**
      * 字段解析成SQL
      *