| @@ -332,9 +332,10 @@ | ||
| 332 | 332 | wp_send_json_error( [ 'message' => __( 'You do not have permission to save these settings.', 'forumax' ) ] ); |
| 333 | 333 | } |
| 334 | 334 | |
| 335 | 335 | // ── Sanitize & save each field ────────────────────────────────── |
| 336 | - $post = $_POST; // phpcs:ignore WordPress.Security.NonceVerification.Missing -- verified above | |
| 336 | + // Unslash first: raw $_POST saved "Tom's Forum" as "Tom\'s Forum". | |
| 337 | + $post = wp_unslash( $_POST ); // phpcs:ignore WordPress.Security.NonceVerification.Missing -- verified above | |
| 337 | 338 | |
| 338 | 339 | // Text fields: forum title + description. |
| 339 | 340 | $text_fields = [ 'create_forum', 'forum_description' ]; |
| 340 | 341 | foreach ( $text_fields as $field ) { |
