Searching by meta values showing inappropriate result

3 comments

1. First of all, one never should rely on raw $_REQUEST: believe me, this is a security issue.

   PHP has 2 functions: filter_input and filter_input_array that helps you to sanitize your request data.

   In addition, in your request dump I don’t see any $_REQUEST['custom_bath'], but you are using that value, that can be a cause for the issue. You should check that a variable is setted before use it.

   Using my suggestions your code becomes something like this

   $args = array(
     'custom_textarea'   => FILTER_SANITIZE_STRING,
     'custom_price'      => FILTER_VALIDATE_INT,
     'custom_price1'     => FILTER_VALIDATE_INT,
     'custom_beds'       => FILTER_SANITIZE_STRING,
     'custom_bath'       => FILTER_SANITIZE_STRING,
     'custom_garage'     => FILTER_SANITIZE_STRING
   );
   
   $get = filter_input_array( INPUT_GET, $args, TRUE );
   $post = filter_input_array( INPUT_POST, $args, TRUE );
   $request = array_merge( $get, $post );
   
   $query_args = array( 'relation' => 'OR' );
   
   if ( ! empty( $request['custom_textarea'] ) ) {
      $query_args[] = array(
        'key' => 'custom_textarea',
        'value' => "%{$request['custom_textarea']}%", 
        'compare' => 'LIKE'
      );
   }
   
   if ( ! empty( $request['custom_price'] ) && ! empty($request['custom_price1']) ) {
      $query_args[] = array(
        'key' => 'custom_price',
        'value' => array( "{$request['custom_price']}", "{$request['custom_price1']}" ), 
        'compare' => 'BETWEEN',
        'type'    => 'SIGNED'
      );
   }
   
   if ( ! empty( $request['custom_beds'] ) ) {
      $query_args[] = array(
        'key' => 'custom_beds',
        'value' => "{$request['custom_beds']}", 
      );
   }
   
   if ( ! empty( $request['custom_bath'] ) ) {
      $query_args[] = array(
        'key' => 'custom_bath',
        'value' => "{$request['custom_bath']}", 
      );
   }   
   
   if ( ! empty( $request['custom_garage'] ) ) {
      $query_args[] = array(
        'key' => 'custom_garage',
        'value' => "{$request['custom_garage']}", 
      );
   } 
   
   $query = new WP_Query( $query_args );  
   

2. The problem is when you have a string variable WordPress doesn’t automatically add quotes to the variable and therefore the search filter doesn’t generate any result.

   I suggest the following answer.

   $custom_textarea = '''.$_REQUEST['custom_textarea'].''';  // declare a variable something like this.
   

   And then your meta_query would be:

   'meta_query' => array(
                        'relation' => 'OR',
                        array(
                         'key' => 'custom_textarea',
                         'value' => $custom_textarea, 
                         'compare' => 'LIKE'
                         ),
                         array(
                         'key' => 'custom_price',
                         'value' => array( $_REQUEST['custom_price'], $_REQUEST['custom_price1'] ),
                         'type' => 'numeric',
                         'compare' => 'BETWEEN'
                         ),
                         array(
                         'key' => 'custom_beds',
                         'value' => $_REQUEST['custom_beds'],
                         'compare' => '='
                         ),
                         array(
                         'key' => 'custom_bath',
                         'value' => $_REQUEST['custom_bath'],
                         'compare' => '='
                         ),
                         array(
                         'key' => 'custom_garage',
                         'value' => $_REQUEST['custom_garage'],
                         'compare' => '='
                         )
                         )
   

3. For mine, I use it like so on search results page:

   $pricemax = $_POST['price'];
   

   then in the query…

   array(
           'key' => 'custom_rent',
           'value' => array('', $pricemax),
           'compare' => 'BETWEEN',
           'type' => 'NUMERIC'
           ),
   

   Does this help? Try using $_POST rather than $_REQUEST?

Comments are closed.