Use esc_like() when building option-meta LIKE patterns

[cbravobernal]

Summary

acf_get_option_meta() builds two wp_options LIKE patterns from a caller-supplied $prefix and escapes them by hand, replacing only the _ character:

$search = str_replace( '_', '\_', "{$prefix}_%" );

That leaves the other LIKE metacharacters (%, and the \ escape character) unescaped, so the prefix is not guaranteed to be matched purely as a literal. WordPress provides $wpdb->esc_like() for exactly this purpose — it escapes %, _ and \.

Change

$search  = $wpdb->esc_like( "{$prefix}_" ) . '%';
$_search = $wpdb->esc_like( "_{$prefix}_" ) . '%';

Escape the literal portion of the pattern, then append the single intended trailing wildcard. Behaviour for ordinary prefixes is unchanged.

Tests

• Adds tests/php/includes/functions/test-acf-option-meta-like-escaping.php, which captures the generated SQL (via the dbless wpdb query filter, since the query is a no-op under WorDBless) and asserts the prefix is escaped through esc_like().
• composer test:php: OK. composer test:phpstan: clean. phpcs (changed lines): clean.

Note

This file is derived from upstream; the same change applies there.

Use of AI Tools

This PR was authored by Claude Code (Claude Fable 5) under human direction.

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

Core Committers: Use this line as a base for the props when committing in SVN:

Props cbravobernal.

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.