From bc409042b0404651c776e8b782262dfeda8396dc Mon Sep 17 00:00:00 2001
From: heavyrian2012 <heavyrain.lee@wildfirehat.cn>
Date: Wed, 27 Dec 2023 20:07:48 +0800
Subject: [PATCH] =?UTF-8?q?=E8=A7=A3=E5=86=B3=E6=90=9C=E7=B4=A2=E6=97=B6?=
 =?UTF-8?q?=E7=89=B9=E6=AE=8A=E5=AD=97=E7=AC=A6=E7=9A=84=E8=BD=AC=E4=B9=89?=
 =?UTF-8?q?=E9=97=AE=E9=A2=98?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../io/moquette/persistence/DatabaseStore.java   | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/broker/src/main/java/io/moquette/persistence/DatabaseStore.java b/broker/src/main/java/io/moquette/persistence/DatabaseStore.java
index ebc50dcf..42c54525 100644
--- a/broker/src/main/java/io/moquette/persistence/DatabaseStore.java
+++ b/broker/src/main/java/io/moquette/persistence/DatabaseStore.java
@@ -412,7 +412,7 @@ public class DatabaseStore {
             connection = DBUtil.getConnection();
             String sql = "select u._uid, u._name, u._display_name, u._portrait, u._mobile, u._gender, u._email, u._address, u._company, u._social, u._extra, u._dt, u._type " +
                 " from t_user u left join (select _uid, _value from t_user_setting where _scope = 27) s on u._uid = s._uid " +
-                " where u._display_name like ? and u._type <> 2 and u._deleted = 0 ";
+                " where u._display_name like ? ESCAPE '!' and u._type <> 2 and u._deleted = 0 ";
             if(nameOrIdMatched.size() == 1) {
                 sql += " and u._uid <> ? and u._name <> ?";
             } else if(nameOrIdMatched.size() == 2) {
@@ -430,6 +430,12 @@ public class DatabaseStore {
                 sql += " offset " + (page * 20 - nameOrIdMatched.size());
             }
 
+            keyword = keyword
+                .replace("!", "!!")
+                .replace("%", "!%")
+                .replace("_", "!_")
+                .replace("[", "![");
+
             statement = connection.prepareStatement(sql);
             statement.setString(1, "%" + keyword + "%");
             if(nameOrIdMatched.size() == 1) {
@@ -3631,7 +3637,7 @@ public class DatabaseStore {
                 ", `_extra`" +
                 ", `_dt` from t_channel";
             if (buzzy) {
-                sql += " where `_name` like ?";
+                sql += " where `_name` like ? ESCAPE '!' ";
             } else {
                 sql += " where `_name` = ?";
             }
@@ -3645,6 +3651,12 @@ public class DatabaseStore {
                 sql += " offset " + page * 20;
             }
 
+            keyword = keyword
+                .replace("!", "!!")
+                .replace("%", "!%")
+                .replace("_", "!_")
+                .replace("[", "![");
+
             statement = connection.prepareStatement(sql);
             int index = 1;
             if (buzzy) {