` attribute * for a credential field. Empty string when nothing is stored, the * sentinel placeholder when something is stored. * * @param bool $has_value Whether a value is currently stored. * @param string $sentinel Override the placeholder (rare; mostly for tests). * @return string Sentinel placeholder or empty string. */ public static function value_for_input( $has_value, $sentinel = self::SENTINEL ) { return $has_value ? $sentinel : ''; } /** * Detect whether a submitted form value is the unchanged-sentinel. * Save handlers that get true here MUST short-circuit and leave the * existing storage untouched. * * Callers MUST pass the raw `wp_unslash()`-ed value. Do not chain * `sanitize_text_field()`, `wp_kses*()`, `mb_convert_encoding()`, or * any other byte-altering filter before the check, or the multi-byte * bullet bytes get stripped/normalized and the comparison fails open * (the sentinel becomes a real submission and overwrites storage). * * @param mixed $submitted Submitted form value (typically from $_POST). * @param string $sentinel Override the placeholder (rare; mostly for tests). * @return bool True if the submitted value equals the sentinel. */ public static function is_sentinel( $submitted, $sentinel = self::SENTINEL ) { return is_string( $submitted ) && $submitted === $sentinel; } }