X-Git-Url: http://www.aleph1.co.uk/gitweb/?p=yaffs-website;a=blobdiff_plain;f=web%2Fcore%2Fmodules%2Fuser%2Fsrc%2FPlugin%2FEntityReferenceSelection%2FUserSelection.php;fp=web%2Fcore%2Fmodules%2Fuser%2Fsrc%2FPlugin%2FEntityReferenceSelection%2FUserSelection.php;h=b2887afb05f9936f24aa43e051b61b99686b344c;hp=d06a81c41e2db684283618df2316b6128d23bdbe;hb=0bf8d09d2542548982e81a441b1f16e75873a04f;hpb=74df008bdbb3a11eeea356744f39b802369bda3c

diff --git a/web/core/modules/user/src/Plugin/EntityReferenceSelection/UserSelection.php b/web/core/modules/user/src/Plugin/EntityReferenceSelection/UserSelection.php
index d06a81c41..b2887afb0 100644
--- a/web/core/modules/user/src/Plugin/EntityReferenceSelection/UserSelection.php
+++ b/web/core/modules/user/src/Plugin/EntityReferenceSelection/UserSelection.php
@@ -242,7 +242,7 @@ class UserSelection extends DefaultSelection {
           $value_part->condition('anonymous_name', $condition['value'], $condition['operator']);
           $value_part->compile($this->connection, $query);
           $or->condition((new Condition('AND'))
-            ->where(str_replace('anonymous_name', ':anonymous_name', (string) $value_part), $value_part->arguments() + [':anonymous_name' => \Drupal::config('user.settings')->get('anonymous')])
+            ->where(str_replace($query->escapeField('anonymous_name'), ':anonymous_name', (string) $value_part), $value_part->arguments() + [':anonymous_name' => \Drupal::config('user.settings')->get('anonymous')])
             ->condition('base_table.uid', 0)
           );
           $query->condition($or);