Filters in SQL without proper quote escaping

[rvenable]

There are multiple instances in the code for user-input filters where the filter string is not properly escaped. All use the like_escape() function (included in WP), but from I can tell, that function does not prevent SQL injection.

bp-blogs-classes.php:
In BP_Blogs_Blog::search_blogs(): lines 205 and 208

bp-friends-classes.php:
In BP_Friends_Friendship::search_friends(): lines 168, 169, 171, 172
In BP_Friends_Friendship::search_users(): lines 233, 235
In BP_Friends_Friendship::search_users_count(): lines 255, 257

bp-groups-classes.php:
In BP_Groups_Group::filter_user_groups(): lines 262, 263
In BP_Groups_Group::search_groups(): lines 285, 286
In BP_Groups_Group::get_recently_joined(): line 702
In BP_Groups_Group::get_most_popular(): line 722
In BP_Groups_Group::get_recently_active(): line 742
In BP_Groups_Group::get_alphabetically(): lines 762
In BP_Groups_Group::get_is_admin_of(): line 782
In BP_Groups_Group::get_is_mod_of(): line 802

[rvenable]

Also, the like_escape() function returns its value, but that returned value isn't actually being used.

[DJPaul]

Good catch with the like_escape.

[Jason_JM]

This absolutely must get fixed *ASAP*

I will take care of the rest of the criticals so Andy can work on this.

[apeatling]

(In [2047]) Fixes #1223

[DJPaul]

Could I just get something clarified? Unless I am misreading, like_escape() returns a value, it doesn't do it by reference, so the returned values aren't actually being used? Thanks.

[apeatling]

(In [2052]) Fixes #1223 props DJPaul