fix(bom): escape name with wildcard character (#18164)
diff --git a/erpnext/controllers/queries.py b/erpnext/controllers/queries.py
index d74bc0e..47c9f0a 100644
--- a/erpnext/controllers/queries.py
+++ b/erpnext/controllers/queries.py
@@ -206,10 +206,11 @@
if(locate(%(_txt)s, name), locate(%(_txt)s, name), 99999),
idx desc, name
limit %(start)s, %(page_len)s """.format(
- fcond=get_filters_cond(doctype, filters, conditions),
+ fcond=get_filters_cond(doctype, filters, conditions).replace('%', '%%'),
mcond=get_match_cond(doctype),
- key=searchfield), {
- 'txt': '%' + txt + '%',
+ key=frappe.db.escape(searchfield)),
+ {
+ 'txt': "%"+frappe.db.escape(txt)+"%",
'_txt': txt.replace("%", ""),
'start': start or 0,
'page_len': page_len or 20