PluginProbe
Search Atlas SEO – OTTO AI SEO Automation for WordPress / 2.7.1
Search Atlas SEO – OTTO AI SEO Automation for WordPress v2.7.1
2.7.1 2.7.2 2.7.0 2.6.26 2.6.25 2.6.24 2.6.23 2.6.22 2.6.21 2.6.20 2.6.19 2.6.18 2.6.17 2.6.16 2.6.15 2.6.14 2.6.13 2.6.12 2.6.11 2.6.10 2.6.9 2.6.8 2.6.7 2.6.6 2.6.5 All 141 releases
← All changes | includes/class-metasync-seo-suite.php +46 -44 2.7.0 → 2.7.1 View file →
@@ -69,9 +69,9 @@
69 69 * context so this box never engages in either.
70 70 */
71 71 private function is_block_editor_request()
72 72 {
73 - if (!empty($_REQUEST['meta-box-loader'])) {
73 + if (!empty($_REQUEST['meta-box-loader'])) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- read-only request flag for meta box registration
74 74 return true;
75 75 }
76 76 $screen = get_current_screen();
77 77 return $screen && $screen->is_block_editor();
@@ -227,9 +227,8 @@
227 227 public function render($post)
228 228 {
229 229 $P = $this->present;
230 230 $id = $post->ID;
231 - $a = 'esc_attr';
232 231
233 232 $managed = $this->is_managed_page($id);
234 233
235 234 $has_seo = isset($P['metasync-seo-meta']) || isset($P['metasync-seo-lps-notice']);
@@ -413,9 +412,9 @@
413 412 <div class="rail">
414 413 <?php
415 414 $first = true;
416 415 $tab = function ($key, $icon, $label) use (&$first) {
417 - echo '<div class="nav' . ($first ? ' active' : '') . '" role="button" tabindex="0" onclick="mssGo(this,\'' . esc_attr($key) . '\')" onkeydown="mssKey(event,this)"><span class="ic">' . $icon . '</span> ' . $label . '</div>';
416 + echo '<div class="nav' . ($first ? ' active' : '') . '" role="button" tabindex="0" onclick="mssGo(this,\'' . esc_attr($key) . '\')" onkeydown="mssKey(event,this)"><span class="ic">' . esc_html($icon) . '</span> ' . esc_html($label) . '</div>';
418 417 $first = false;
419 418 };
420 419 if ($has_seo) { $tab('seo', '&#128269;', 'SEO'); }
421 420 if ($has_robots) { $tab('robots', '&#129302;', 'Robots'); }
@@ -437,9 +436,9 @@
437 436 };
438 437 ?>
439 438
440 439 <?php if ($has_seo): ?>
441 - <div class="<?php echo $pcls(); ?>" data-p="seo">
440 + <div class="<?php echo esc_attr($pcls()); ?>" data-p="seo">
442 441 <h2 class="p-title">&#128269; Search Appearance</h2>
443 442 <p class="p-sub">Set the SEO Title and Meta Description. Leave blank to use the OTTO suggestion.</p>
444 443 <?php if ($show_imported_note): ?>
445 444 <p class="p-sub">The greyed-out value below was imported from another SEO plugin. It is used only until OTTO has a suggestion for this page.</p>
@@ -445,13 +444,13 @@
445 444 <p class="p-sub">The greyed-out value below was imported from another SEO plugin. It is used only until OTTO has a suggestion for this page.</p>
446 445 <?php endif; ?>
447 446 <div class="field">
448 447 <div class="lbl"><span>SEO Title</span><span class="cc"><span class="tC">0</span>/60</span></div>
449 - <input class="ctrl seoT" name="metasync_seo_title" value="<?php echo $a($seo_title); ?>" placeholder="<?php echo $a($ghost_title); ?>" oninput="mssRc()">
448 + <input class="ctrl seoT" name="metasync_seo_title" value="<?php echo esc_attr($seo_title); ?>" placeholder="<?php echo esc_attr($ghost_title); ?>" oninput="mssRc()">
450 449 </div>
451 450 <div class="field">
452 451 <div class="lbl"><span>Meta Description</span><span class="cc"><span class="dC">0</span>/160</span></div>
453 - <textarea class="ctrl seoD" name="metasync_seo_desc" placeholder="<?php echo $a($ghost_desc); ?>" oninput="mssRc()"><?php echo esc_textarea($seo_desc); ?></textarea>
452 + <textarea class="ctrl seoD" name="metasync_seo_desc" placeholder="<?php echo esc_attr($ghost_desc); ?>" oninput="mssRc()"><?php echo esc_textarea($seo_desc); ?></textarea>
454 453 </div>
455 454 <?php if ($otto_kw !== ''): ?>
456 455 <div class="field">
457 456 <div class="lbl"><span>Focus Keyword</span><span class="ro-badge">Managed by OTTO</span></div>
@@ -468,9 +467,9 @@
468 467 </div>
469 468 <?php endif; ?>
470 469
471 470 <?php if ($has_robots): ?>
472 - <div class="<?php echo $pcls(); ?>" data-p="robots">
471 + <div class="<?php echo esc_attr($pcls()); ?>" data-p="robots">
473 472 <h2 class="p-title">&#129302; Robots Meta</h2>
474 473 <p class="p-sub">Crawler directives for this post. These are independent flags &mdash; combine as needed.</p>
475 474 <?php if ($has_crob): ?>
476 475 <div class="sec">Common directives</div>
@@ -485,9 +484,10 @@
485 484 'nosnippet' => array('No Snippet', 'No text snippet in results'),
486 485 );
487 486 foreach ($common as $key => $c): ?>
488 487 <label class="chip">
489 - <input type="checkbox" name="common_robots_meta[<?php echo $a($key); ?>]" value="<?php echo $a($key); ?>"<?php echo isset($cr[$key]) ? self::checked_attr($cr[$key] === $key) : ''; ?>>
488 + <input type="checkbox" name="common_robots_meta[<?php echo esc_attr($key); ?>]" value="<?php echo esc_attr($key); ?>"<?php // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- checked_attr() returns the validated checked attribute.
489 + echo isset($cr[$key]) ? esc_attr(self::checked_attr($cr[$key] === $key)) : ''; ?>>
490 490 <span class="box">&#10003;</span><div><?php echo esc_html($c[0]); ?><small><?php echo esc_html($c[1]); ?></small></div>
491 491 </label>
492 492 <?php endforeach; ?>
493 493 </div>
@@ -496,13 +496,13 @@
496 496 <div class="sec">Advanced limits <span class="sec-note">&mdash; tick a limit to apply it</span></div>
497 497 <div class="row">
498 498 <div class="field">
499 499 <label class="chip mss-advchip"><input type="checkbox" name="advanced_robots_meta[max-snippet][enable]" value="1"<?php checked('1', $ar_snip_e); ?>><span class="box">&#10003;</span><div>Max Snippet</div></label>
500 - <input class="ctrl" type="number" name="advanced_robots_meta[max-snippet][length]" value="<?php echo $a($ar_snip_l); ?>" min="-1" placeholder="e.g. 160">
500 + <input class="ctrl" type="number" name="advanced_robots_meta[max-snippet][length]" value="<?php echo esc_attr($ar_snip_l); ?>" min="-1" placeholder="e.g. 160">
501 501 <div class="hint">Max snippet length in characters.</div></div>
502 502 <div class="field">
503 503 <label class="chip mss-advchip"><input type="checkbox" name="advanced_robots_meta[max-video-preview][enable]" value="1"<?php checked('1', $ar_vid_e); ?>><span class="box">&#10003;</span><div>Max Video Preview</div></label>
504 - <input class="ctrl" type="number" name="advanced_robots_meta[max-video-preview][length]" value="<?php echo $a($ar_vid_l); ?>" min="-1" placeholder="e.g. -1">
504 + <input class="ctrl" type="number" name="advanced_robots_meta[max-video-preview][length]" value="<?php echo esc_attr($ar_vid_l); ?>" min="-1" placeholder="e.g. -1">
505 505 <div class="hint">Max preview duration in seconds.</div></div>
506 506 </div>
507 507 <div class="field">
508 508 <label class="chip mss-advchip"><input type="checkbox" name="advanced_robots_meta[max-image-preview][enable]" value="1"<?php checked('1', $ar_img_e); ?>><span class="box">&#10003;</span><div>Max Image Preview</div></label>
@@ -515,14 +515,14 @@
515 515 </div>
516 516 <?php endif; ?>
517 517
518 518 <?php if ($has_canon): ?>
519 - <div class="<?php echo $pcls(); ?>" data-p="canonical">
519 + <div class="<?php echo esc_attr($pcls()); ?>" data-p="canonical">
520 520 <h2 class="p-title">&#128279; Canonical URL</h2>
521 521 <p class="p-sub">Point search engines to the preferred version of this content.</p>
522 522 <div class="field">
523 523 <div class="lbl"><span>Canonical URL</span></div>
524 - <input class="ctrl" type="text" name="post_canonical_url_meta" value="<?php echo $a($canon); ?>" placeholder="<?php echo $a($pretty); ?>">
524 + <input class="ctrl" type="text" name="post_canonical_url_meta" value="<?php echo esc_attr($canon); ?>" placeholder="<?php echo esc_attr($pretty); ?>">
525 525 <div class="hint">Leave blank to use this post's own URL.</div>
526 526 </div>
527 527 </div>
528 528 <?php endif; ?>
@@ -527,13 +527,14 @@
527 527 </div>
528 528 <?php endif; ?>
529 529
530 530 <?php if ($has_redir): ?>
531 - <div class="<?php echo $pcls(); ?>" data-p="redirect">
531 + <div class="<?php echo esc_attr($pcls()); ?>" data-p="redirect">
532 532 <h2 class="p-title">&#8618;&#65039; Redirection</h2>
533 533 <p class="p-sub">Send visitors of this post somewhere else.</p>
534 534 <div class="switch-card">
535 - <label class="switch"><input type="checkbox" name="post_redirect_meta[enable]" value="true"<?php echo self::checked_attr($rd_en); ?>></label>
535 + <label class="switch"><input type="checkbox" name="post_redirect_meta[enable]" value="true"<?php // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- checked_attr() returns the validated checked attribute.
536 + echo esc_attr(self::checked_attr($rd_en)); ?>></label>
536 537 <div class="m"><b>Enable redirection</b><span>Send visitors of this post to another URL</span></div>
537 538 </div>
538 539 <div class="row">
539 540 <div class="field"><div class="lbl"><span>Type</span></div>
@@ -544,36 +545,37 @@
544 545 <option value="410"<?php selected($rd_type, '410'); ?>>410 Content Deleted</option>
545 546 <option value="451"<?php selected($rd_type, '451'); ?>>451 Content Unavailable</option>
546 547 </select></div>
547 548 <div class="field"><div class="lbl"><span>Destination URL</span></div>
548 - <input class="ctrl" type="text" name="post_redirect_meta[url]" value="<?php echo $a($rd_url); ?>" placeholder="https://example.com/new-url/"></div>
549 + <input class="ctrl" type="text" name="post_redirect_meta[url]" value="<?php echo esc_attr($rd_url); ?>" placeholder="https://example.com/new-url/"></div>
549 550 </div>
550 551 </div>
551 552 <?php endif; ?>
552 553
553 554 <?php if ($has_social): ?>
554 - <div class="<?php echo $pcls(); ?>" data-p="social">
555 + <div class="<?php echo esc_attr($pcls()); ?>" data-p="social">
555 556 <h2 class="p-title">&#128226; Social &amp; Open Graph</h2>
556 557 <p class="p-sub">How this post looks when shared on social platforms.</p>
557 558 <div class="switch-card">
558 - <label class="switch"><input type="checkbox" name="_metasync_og_enabled" value="1"<?php echo self::checked_attr($og_en); ?>></label>
559 + <label class="switch"><input type="checkbox" name="_metasync_og_enabled" value="1"<?php // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- checked_attr() returns the validated checked attribute.
560 + echo esc_attr(self::checked_attr($og_en)); ?>></label>
559 561 <div class="m"><b>Enable Open Graph &amp; Social Media Tags</b><span>Adds Open Graph + Twitter Card tags for better sharing</span></div>
560 562 </div>
561 563
562 564 <div class="subhead"><span class="sq"></span> Open Graph</div>
563 - <div class="field"><div class="lbl"><span>Title (og:title)</span></div><input class="ctrl" name="_metasync_og_title" maxlength="60" value="<?php echo $a($og_title); ?>" placeholder="<?php echo $a($og_defaults['title']); ?>" oninput="mssSocial()"></div>
564 - <div class="field"><div class="lbl"><span>Description (og:description)</span></div><textarea class="ctrl" name="_metasync_og_description" maxlength="155" placeholder="<?php echo $a($og_defaults['description']); ?>" oninput="mssSocial()"><?php echo esc_textarea($og_desc); ?></textarea></div>
565 + <div class="field"><div class="lbl"><span>Title (og:title)</span></div><input class="ctrl" name="_metasync_og_title" maxlength="60" value="<?php echo esc_attr($og_title); ?>" placeholder="<?php echo esc_attr($og_defaults['title']); ?>" oninput="mssSocial()"></div>
566 + <div class="field"><div class="lbl"><span>Description (og:description)</span></div><textarea class="ctrl" name="_metasync_og_description" maxlength="155" placeholder="<?php echo esc_attr($og_defaults['description']); ?>" oninput="mssSocial()"><?php echo esc_textarea($og_desc); ?></textarea></div>
565 567 <div class="field"><div class="lbl"><span>Image (og:image)</span></div>
566 - <div class="mss-imgrow"><input class="ctrl ogimg" type="url" name="_metasync_og_image" value="<?php echo $a($og_image); ?>" placeholder="https://example.com/image.jpg" oninput="mssSocial()"><button class="btn ghost sm mss-pick" data-target=".ogimg" type="button">Select</button></div>
568 + <div class="mss-imgrow"><input class="ctrl ogimg" type="url" name="_metasync_og_image" value="<?php echo esc_attr($og_image); ?>" placeholder="https://example.com/image.jpg" oninput="mssSocial()"><button class="btn ghost sm mss-pick" data-target=".ogimg" type="button">Select</button></div>
567 569 <div class="hint">Recommended 1200&times;630px.</div></div>
568 570 <div class="row">
569 571 <div class="field"><div class="lbl"><span>Type (og:type)</span></div>
570 572 <select class="ctrl" name="_metasync_og_type">
571 573 <?php foreach (array('article', 'website', 'blog', 'product', 'video', 'music') as $t): ?>
572 - <option value="<?php echo $a($t); ?>"<?php selected($og_type, $t); ?>><?php echo esc_html(ucfirst($t)); ?></option>
574 + <option value="<?php echo esc_attr($t); ?>"<?php selected($og_type, $t); ?>><?php echo esc_html(ucfirst($t)); ?></option>
573 575 <?php endforeach; ?>
574 576 </select></div>
575 - <div class="field"><div class="lbl"><span>URL (og:url)</span></div><input class="ctrl" type="url" name="_metasync_og_url" value="<?php echo $a($og_url); ?>" placeholder="<?php echo $a($pretty); ?>"<?php echo $post->post_status === 'auto-draft' ? ' disabled' : ''; ?>></div>
577 + <div class="field"><div class="lbl"><span>URL (og:url)</span></div><input class="ctrl" type="url" name="_metasync_og_url" value="<?php echo esc_attr($og_url); ?>" placeholder="<?php echo esc_attr($pretty); ?>"<?php echo $post->post_status === 'auto-draft' ? ' disabled' : ''; ?>></div>
576 578 </div>
577 579
578 580 <div class="subhead"><span class="sq"></span> Twitter Card</div>
579 581 <div class="field"><div class="lbl"><span>Card Type</span></div>
@@ -583,36 +585,36 @@
583 585 <option value="app"<?php selected($tw_card, 'app'); ?>>App</option>
584 586 <option value="player"<?php selected($tw_card, 'player'); ?>>Player</option>
585 587 </select></div>
586 588 <div class="row">
587 - <div class="field"><div class="lbl"><span>Twitter Site</span></div><input class="ctrl" name="_metasync_twitter_site" value="<?php echo $a($tw_site); ?>" placeholder="@yoursite"></div>
588 - <div class="field"><div class="lbl"><span>Twitter Title</span></div><input class="ctrl" name="_metasync_twitter_title" maxlength="70" value="<?php echo $a($tw_title); ?>" placeholder="<?php echo $a($tw_title_placeholder); ?>" oninput="mssSocial()"></div>
589 + <div class="field"><div class="lbl"><span>Twitter Site</span></div><input class="ctrl" name="_metasync_twitter_site" value="<?php echo esc_attr($tw_site); ?>" placeholder="@yoursite"></div>
590 + <div class="field"><div class="lbl"><span>Twitter Title</span></div><input class="ctrl" name="_metasync_twitter_title" maxlength="70" value="<?php echo esc_attr($tw_title); ?>" placeholder="<?php echo esc_attr($tw_title_placeholder); ?>" oninput="mssSocial()"></div>
589 591 </div>
590 - <div class="field"><div class="lbl"><span>Twitter Description</span></div><textarea class="ctrl" name="_metasync_twitter_description" maxlength="200" placeholder="<?php echo $a($tw_desc_placeholder); ?>" oninput="mssSocial()"><?php echo esc_textarea($tw_desc); ?></textarea></div>
592 + <div class="field"><div class="lbl"><span>Twitter Description</span></div><textarea class="ctrl" name="_metasync_twitter_description" maxlength="200" placeholder="<?php echo esc_attr($tw_desc_placeholder); ?>" oninput="mssSocial()"><?php echo esc_textarea($tw_desc); ?></textarea></div>
591 593 <div class="row">
592 594 <div class="field"><div class="lbl"><span>Twitter Image</span></div>
593 - <div class="mss-imgrow"><input class="ctrl twimg" type="url" name="_metasync_twitter_image" value="<?php echo $a($tw_image); ?>" placeholder="Falls back to OG image" oninput="mssSocial()"><button class="btn ghost sm mss-pick" data-target=".twimg" type="button">Select</button></div></div>
594 - <div class="field"><div class="lbl"><span>Image Alt</span></div><input class="ctrl" name="_metasync_twitter_image_alt" maxlength="420" value="<?php echo $a($tw_alt); ?>" placeholder="Accessibility description"></div>
595 + <div class="mss-imgrow"><input class="ctrl twimg" type="url" name="_metasync_twitter_image" value="<?php echo esc_attr($tw_image); ?>" placeholder="Falls back to OG image" oninput="mssSocial()"><button class="btn ghost sm mss-pick" data-target=".twimg" type="button">Select</button></div></div>
596 + <div class="field"><div class="lbl"><span>Image Alt</span></div><input class="ctrl" name="_metasync_twitter_image_alt" maxlength="420" value="<?php echo esc_attr($tw_alt); ?>" placeholder="Accessibility description"></div>
595 597 </div>
596 598
597 599 <div class="mssTwApp" style="display:<?php echo $tw_card === 'app' ? 'block' : 'none'; ?>">
598 600 <div class="subhead"><span class="sq"></span> App Card</div>
599 601 <div class="row">
600 - <div class="field"><div class="lbl"><span>iPhone App ID</span></div><input class="ctrl" name="_metasync_twitter_app_id_iphone" value="<?php echo $a($tw_app_iphone); ?>" placeholder="307234931"<?php echo $tw_app_disabled; ?>></div>
601 - <div class="field"><div class="lbl"><span>iPad App ID</span></div><input class="ctrl" name="_metasync_twitter_app_id_ipad" value="<?php echo $a($tw_app_ipad); ?>" placeholder="307234931"<?php echo $tw_app_disabled; ?>></div>
602 + <div class="field"><div class="lbl"><span>iPhone App ID</span></div><input class="ctrl" name="_metasync_twitter_app_id_iphone" value="<?php echo esc_attr($tw_app_iphone); ?>" placeholder="307234931"<?php echo esc_attr($tw_app_disabled); ?>></div>
603 + <div class="field"><div class="lbl"><span>iPad App ID</span></div><input class="ctrl" name="_metasync_twitter_app_id_ipad" value="<?php echo esc_attr($tw_app_ipad); ?>" placeholder="307234931"<?php echo esc_attr($tw_app_disabled); ?>></div>
602 604 </div>
603 - <div class="field"><div class="lbl"><span>Google Play App ID</span></div><input class="ctrl" name="_metasync_twitter_app_id_googleplay" value="<?php echo $a($tw_app_gp); ?>" placeholder="com.android.app"<?php echo $tw_app_disabled; ?>></div>
605 + <div class="field"><div class="lbl"><span>Google Play App ID</span></div><input class="ctrl" name="_metasync_twitter_app_id_googleplay" value="<?php echo esc_attr($tw_app_gp); ?>" placeholder="com.android.app"<?php echo esc_attr($tw_app_disabled); ?>></div>
604 606 <div class="row">
605 - <div class="field"><div class="lbl"><span>iPhone Custom URL</span></div><input class="ctrl" type="url" name="_metasync_twitter_app_url_iphone" value="<?php echo $a($tw_app_url_iphone); ?>" placeholder="myapp://"<?php echo $tw_app_disabled; ?>></div>
606 - <div class="field"><div class="lbl"><span>iPad Custom URL</span></div><input class="ctrl" type="url" name="_metasync_twitter_app_url_ipad" value="<?php echo $a($tw_app_url_ipad); ?>" placeholder="myapp://"<?php echo $tw_app_disabled; ?>></div>
607 + <div class="field"><div class="lbl"><span>iPhone Custom URL</span></div><input class="ctrl" type="url" name="_metasync_twitter_app_url_iphone" value="<?php echo esc_attr($tw_app_url_iphone); ?>" placeholder="myapp://"<?php echo esc_attr($tw_app_disabled); ?>></div>
608 + <div class="field"><div class="lbl"><span>iPad Custom URL</span></div><input class="ctrl" type="url" name="_metasync_twitter_app_url_ipad" value="<?php echo esc_attr($tw_app_url_ipad); ?>" placeholder="myapp://"<?php echo esc_attr($tw_app_disabled); ?>></div>
607 609 </div>
608 610 <div class="row">
609 - <div class="field"><div class="lbl"><span>Google Play Custom URL</span></div><input class="ctrl" type="url" name="_metasync_twitter_app_url_googleplay" value="<?php echo $a($tw_app_url_gp); ?>" placeholder="myapp://"<?php echo $tw_app_disabled; ?>></div>
611 + <div class="field"><div class="lbl"><span>Google Play Custom URL</span></div><input class="ctrl" type="url" name="_metasync_twitter_app_url_googleplay" value="<?php echo esc_attr($tw_app_url_gp); ?>" placeholder="myapp://"<?php echo esc_attr($tw_app_disabled); ?>></div>
610 612 <div class="field"><div class="lbl"><span>App Store Country</span></div>
611 - <select class="ctrl" name="_metasync_twitter_app_country"<?php echo $tw_app_disabled; ?>>
613 + <select class="ctrl" name="_metasync_twitter_app_country"<?php echo esc_attr($tw_app_disabled); ?>>
612 614 <option value=""<?php selected($tw_app_country, ''); ?>>US (Default)</option>
613 615 <?php foreach (array('GB' => 'United Kingdom', 'CA' => 'Canada', 'AU' => 'Australia', 'DE' => 'Germany', 'FR' => 'France', 'JP' => 'Japan', 'IN' => 'India', 'BR' => 'Brazil', 'MX' => 'Mexico') as $code => $country): ?>
614 - <option value="<?php echo $a($code); ?>"<?php selected($tw_app_country, $code); ?>><?php echo esc_html($country); ?></option>
616 + <option value="<?php echo esc_attr($code); ?>"<?php selected($tw_app_country, $code); ?>><?php echo esc_html($country); ?></option>
615 617 <?php endforeach; ?>
616 618 </select>
617 619 <div class="hint">Required if your app is not available in the US App Store.</div>
618 620 </div>
@@ -619,12 +621,12 @@
619 621 </div>
620 622 </div>
621 623 <div class="mssTwPlayer" style="display:<?php echo $tw_card === 'player' ? 'block' : 'none'; ?>">
622 624 <div class="subhead"><span class="sq"></span> Player Card</div>
623 - <div class="field"><div class="lbl"><span>Player URL</span></div><input class="ctrl" type="url" name="_metasync_twitter_player" value="<?php echo $a($tw_player); ?>" placeholder="https://example.com/player"<?php echo $tw_player_disabled; ?>></div>
625 + <div class="field"><div class="lbl"><span>Player URL</span></div><input class="ctrl" type="url" name="_metasync_twitter_player" value="<?php echo esc_attr($tw_player); ?>" placeholder="https://example.com/player"<?php echo esc_attr($tw_player_disabled); ?>></div>
624 626 <div class="row">
625 - <div class="field"><div class="lbl"><span>Width (px)</span></div><input class="ctrl short" type="number" name="_metasync_twitter_player_width" min="1" value="<?php echo $a($tw_player_w); ?>" placeholder="1280"<?php echo $tw_player_disabled; ?>></div>
626 - <div class="field"><div class="lbl"><span>Height (px)</span></div><input class="ctrl short" type="number" name="_metasync_twitter_player_height" min="1" value="<?php echo $a($tw_player_h); ?>" placeholder="720"<?php echo $tw_player_disabled; ?>></div>
627 + <div class="field"><div class="lbl"><span>Width (px)</span></div><input class="ctrl short" type="number" name="_metasync_twitter_player_width" min="1" value="<?php echo esc_attr($tw_player_w); ?>" placeholder="1280"<?php echo esc_attr($tw_player_disabled); ?>></div>
628 + <div class="field"><div class="lbl"><span>Height (px)</span></div><input class="ctrl short" type="number" name="_metasync_twitter_player_height" min="1" value="<?php echo esc_attr($tw_player_h); ?>" placeholder="720"<?php echo esc_attr($tw_player_disabled); ?>></div>
627 629 </div>
628 630 </div>
629 631
630 632 <div class="subhead"><span class="sq"></span> Social preview</div>
@@ -666,9 +668,9 @@
666 668 </div>
667 669 <?php endif; ?>
668 670
669 671 <?php if ($has_schema): ?>
670 - <div class="<?php echo $pcls(); ?>" data-p="schema">
672 + <div class="<?php echo esc_attr($pcls()); ?>" data-p="schema">
671 673 <h2 class="p-title">&#128208; Schema Markup</h2>
672 674 <div class="mss-native">
673 675 <?php
674 676 if (!empty($this->schema_box['callback'])) {
@@ -681,16 +683,16 @@
681 683 </div>
682 684 <?php endif; ?>
683 685
684 686 <?php if ($has_video): ?>
685 - <div class="<?php echo $pcls(); ?>" data-p="video">
687 + <div class="<?php echo esc_attr($pcls()); ?>" data-p="video">
686 688 <h2 class="p-title">&#127916; Video Sitemap</h2>
687 689 <p class="p-sub">Override auto-detected video data. Leave blank to use auto-detection.</p>
688 - <div class="field"><div class="lbl"><span>Video URL</span></div><input class="ctrl" type="url" name="metasync_video_url" value="<?php echo $a($v_url); ?>" placeholder="https://www.youtube.com/watch?v=..."></div>
689 - <div class="field"><div class="lbl"><span>Thumbnail URL</span></div><input class="ctrl" type="url" name="metasync_video_thumbnail" value="<?php echo $a($v_thumb); ?>" placeholder="https://img.youtube.com/vi/.../hqdefault.jpg"></div>
690 - <div class="field"><div class="lbl"><span>Video Title</span></div><input class="ctrl" name="metasync_video_title" value="<?php echo $a($v_title); ?>" placeholder="Defaults to post title"></div>
690 + <div class="field"><div class="lbl"><span>Video URL</span></div><input class="ctrl" type="url" name="metasync_video_url" value="<?php echo esc_attr($v_url); ?>" placeholder="https://www.youtube.com/watch?v=..."></div>
691 + <div class="field"><div class="lbl"><span>Thumbnail URL</span></div><input class="ctrl" type="url" name="metasync_video_thumbnail" value="<?php echo esc_attr($v_thumb); ?>" placeholder="https://img.youtube.com/vi/.../hqdefault.jpg"></div>
692 + <div class="field"><div class="lbl"><span>Video Title</span></div><input class="ctrl" name="metasync_video_title" value="<?php echo esc_attr($v_title); ?>" placeholder="Defaults to post title"></div>
691 693 <div class="field"><div class="lbl"><span>Video Description</span></div><textarea class="ctrl" name="metasync_video_description" placeholder="Defaults to post excerpt"><?php echo esc_textarea($v_desc); ?></textarea></div>
692 - <div class="field"><div class="lbl"><span>Duration (seconds)</span></div><input class="ctrl short" type="number" name="metasync_video_duration" min="0" step="1" value="<?php echo $a($v_dur); ?>" placeholder="300"></div>
694 + <div class="field"><div class="lbl"><span>Duration (seconds)</span></div><input class="ctrl short" type="number" name="metasync_video_duration" min="0" step="1" value="<?php echo esc_attr($v_dur); ?>" placeholder="300"></div>
693 695 </div>
694 696 <?php endif; ?>
695 697
696 698 </div>