escape match value for the query

craftcms · Nov 20, 2024 · 84be10c · 84be10c
1 parent 2478858
commit 84be10c
Showing 8 changed files with 11 additions and 8 deletions.
diff --git a/src/fields/CalendarEvents.php b/src/fields/CalendarEvents.php
@@ -8,6 +8,7 @@
 use craft\feedme\base\FieldInterface;
 use craft\feedme\helpers\DataHelper;
 use craft\feedme\Plugin;
+use craft\helpers\Db;
 use craft\helpers\Json;
 use Solspace\Calendar\Elements\Event as EventElement;
 
@@ -124,7 +125,7 @@ public function parseField(): mixed
             $criteria['status'] = null;
             $criteria['typeId'] = $typeIds;
             $criteria['limit'] = $limit;
-            $criteria[$match] = $dataValue;
+            $criteria[$match] = Db::escapeParam($dataValue);
 
             Craft::configure($query, $criteria);
 

diff --git a/src/fields/Categories.php b/src/fields/Categories.php
@@ -145,7 +145,7 @@ public function parseField(): mixed
 
             $criteria['status'] = null;
             $criteria['limit'] = $limit;
-            $criteria[$match] = $dataValue;
+            $criteria[$match] = Db::escapeParam($dataValue);
 
             Craft::configure($query, $criteria);
 

diff --git a/src/fields/CommerceProducts.php b/src/fields/CommerceProducts.php
@@ -129,7 +129,7 @@ public function parseField(): mixed
             $criteria['status'] = null;
             $criteria['typeId'] = $typeIds;
             $criteria['limit'] = $limit;
-            $criteria[$match] = $dataValue;
+            $criteria[$match] = Db::escapeParam($dataValue);
 
             Craft::configure($query, $criteria);
 

diff --git a/src/fields/CommerceVariants.php b/src/fields/CommerceVariants.php
@@ -10,6 +10,7 @@
 use craft\feedme\base\FieldInterface;
 use craft\feedme\helpers\DataHelper;
 use craft\feedme\Plugin;
+use craft\helpers\Db;
 use craft\helpers\Json;
 
 /**
@@ -128,7 +129,7 @@ public function parseField(): mixed
             $criteria['status'] = null;
             $criteria['typeId'] = $typeIds;
             $criteria['limit'] = $limit;
-            $criteria[$match] = $dataValue;
+            $criteria[$match] = Db::escapeParam($dataValue);
 
             Craft::configure($query, $criteria);
 

diff --git a/src/fields/DigitalProducts.php b/src/fields/DigitalProducts.php
@@ -9,6 +9,7 @@
 use craft\feedme\base\FieldInterface;
 use craft\feedme\helpers\DataHelper;
 use craft\feedme\Plugin;
+use craft\helpers\Db;
 use craft\helpers\Json;
 
 /**
@@ -129,7 +130,7 @@ public function parseField(): mixed
             $criteria['status'] = null;
             $criteria['typeId'] = $typeIds;
             $criteria['limit'] = $limit;
-            $criteria[$match] = $dataValue;
+            $criteria[$match] = Db::escapeParam($dataValue);
 
             Craft::configure($query, $criteria);
 

diff --git a/src/fields/Entries.php b/src/fields/Entries.php
@@ -164,7 +164,7 @@ public function parseField(): mixed
 
             $criteria['status'] = null;
             $criteria['limit'] = $limit;
-            $criteria[$match] = $dataValue;
+            $criteria[$match] = Db::escapeParam($dataValue);
 
             Craft::configure($query, $criteria);
 

diff --git a/src/fields/Tags.php b/src/fields/Tags.php
@@ -127,7 +127,7 @@ public function parseField(): mixed
             $criteria['status'] = null;
             $criteria['groupId'] = $groupId;
             $criteria['limit'] = $limit;
-            $criteria[$match] = $dataValue;
+            $criteria[$match] = Db::escapeParam($dataValue);
 
             Craft::configure($query, $criteria);
 

diff --git a/src/fields/Users.php b/src/fields/Users.php
@@ -152,7 +152,7 @@ public function parseField(): mixed
             $ids = [];
             $criteria['status'] = null;
             $criteria['limit'] = $limit;
-            $criteria[$match] = $dataValue;
+            $criteria[$match] = Db::escapeParam($dataValue);
 
             // If the only source for the Users field is "admins" we don't have to bother with this query.
             if (!($isAdmin && empty($groupIds) && empty($customSources))) {