PluginProbe
Search Atlas SEO – OTTO AI SEO Automation for WordPress / 2.7.2
Search Atlas SEO – OTTO AI SEO Automation for WordPress v2.7.2
2.7.1 2.7.2 2.7.0 2.6.26 2.6.25 2.6.24 2.6.23 2.6.22 2.6.21 2.6.20 2.6.19 2.6.18 2.6.17 2.6.16 2.6.15 2.6.14 2.6.13 2.6.12 2.6.11 2.6.10 2.6.9 2.6.8 2.6.7 2.6.6 2.6.5 All 141 releases
← All changes | includes/class-metasync-external-importer.php +2358 -446 2.6.13 → 2.7.2 View file →
@@ -176,8 +176,9 @@
176 176 $count = 0;
177 177
178 178 switch ($plugin) {
179 179 case 'yoast':
180 + // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- one-shot import tool — bulk reads from third-party SEO plugin storage; no bulk WordPress API exists
180 181 $count = (int) $wpdb->get_var("
181 182 SELECT COUNT(DISTINCT post_id)
182 183 FROM {$wpdb->postmeta}
183 184 WHERE meta_key LIKE '_yoast_wpseo_%'
@@ -185,22 +186,23 @@
185 186 ");
186 187 break;
187 188
188 189 case 'rankmath':
189 - $count = (int) $wpdb->get_var("
190 + // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- one-shot import tool — bulk reads from third-party SEO plugin storage; no bulk WordPress API exists
191 + $count = (int) $wpdb->get_var($wpdb->prepare("
190 192 SELECT COUNT(DISTINCT post_id)
191 193 FROM {$wpdb->postmeta}
192 - WHERE meta_key LIKE 'rank_math_%'
194 + WHERE meta_key LIKE %s
193 195 AND post_id IN (SELECT ID FROM {$wpdb->posts} WHERE post_status = 'publish')
194 - ");
196 + ", 'rank_math_%'));
195 197 break;
196 198
197 199 case 'aioseo':
198 200 $table = $wpdb->prefix . 'aioseo_posts';
199 - if ($wpdb->get_var("SHOW TABLES LIKE '$table'") === $table) {
201 + if ($wpdb->get_var($wpdb->prepare('SHOW TABLES LIKE %s', $wpdb->esc_like($table))) === $table) { // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- one-shot import tool — bulk reads from third-party SEO plugin storage; no bulk WordPress API exists
200 202 $count = (int) $wpdb->get_var("
201 203 SELECT COUNT(post_id)
202 - FROM {$table}
204 + FROM {$wpdb->prefix}aioseo_posts
203 205 WHERE post_id IN (SELECT ID FROM {$wpdb->posts} WHERE post_status = 'publish')
204 206 ");
205 207 }
206 208 break;
@@ -210,59 +212,458 @@
210 212 }
211 213
212 214 /**
213 215 * Check if schema data exists for a plugin
216 + *
217 + * Counts only records the importer would actually write: the source record
218 + * must hold a supported, populated schema, and the post must not already
219 + * carry a MetaSync schema block. The per-record rule is shared with the
220 + * importers (see the *_schema_source_is_supported() helpers and
221 + * post_has_metasync_schema()), so the count the Schema Settings page shows
222 + * is the count an import can deliver — the old detector counted every
223 + * provider row and reported posts that were silently skipped.
214 224 */
215 225 private function check_schema_data($plugin, &$count)
216 226 {
217 - global $wpdb;
218 -
219 227 $count = 0;
228 + $importable_posts = [];
220 229
221 230 switch ($plugin) {
222 231 case 'yoast':
223 - // Check for Yoast schema meta
224 - // Yoast Premium stores schema type in _yoast_wpseo_schema_article_type
225 - // Free version may use _yoast_wpseo_schema (JSON)
226 - $count = (int) $wpdb->get_var("
227 - SELECT COUNT(DISTINCT post_id)
228 - FROM {$wpdb->postmeta}
229 - WHERE (meta_key = '_yoast_wpseo_schema' OR meta_key = '_yoast_wpseo_schema_article_type')
230 - AND post_id IN (SELECT ID FROM {$wpdb->posts} WHERE post_status = 'publish')
231 - ");
232 + foreach ($this->yoast_schema_candidate_rows(true) as $row) {
233 + $post_id = (int) $row->post_id;
234 + if (isset($importable_posts[$post_id])) {
235 + continue;
236 + }
237 + if ($this->yoast_schema_source_is_supported($row->meta_key, $row->meta_value) !== null) {
238 + $importable_posts[$post_id] = true;
239 + }
240 + }
232 241 break;
233 242
234 243 case 'rankmath':
235 - // Check for Rank Math schema meta (any schema type)
236 - // Rank Math uses meta keys like: rank_math_schema_Article, rank_math_schema_BlogPosting, rank_math_schema_Product, etc.
237 - // Exclude shortcode schemas (rank_math_shortcode_schema_*)
238 - $count = (int) $wpdb->get_var("
239 - SELECT COUNT(DISTINCT post_id)
240 - FROM {$wpdb->postmeta}
241 - WHERE meta_key LIKE 'rank_math_schema_%'
242 - AND meta_key NOT LIKE 'rank_math_shortcode_schema_%'
243 - AND post_id IN (SELECT ID FROM {$wpdb->posts} WHERE post_status = 'publish')
244 - ");
244 + foreach ($this->rankmath_schema_candidate_rows(true) as $row) {
245 + $post_id = (int) $row->post_id;
246 + if (isset($importable_posts[$post_id])) {
247 + continue;
248 + }
249 + if ($this->rankmath_schema_source_is_supported($row->meta_key, $row->meta_value) !== null) {
250 + $importable_posts[$post_id] = true;
251 + }
252 + }
245 253 break;
246 254
247 255 case 'aioseo':
248 - // Check for AIOSEO schema in table
249 - $table = $wpdb->prefix . 'aioseo_posts';
250 - if ($wpdb->get_var("SHOW TABLES LIKE '$table'") === $table) {
251 - $count = (int) $wpdb->get_var("
252 - SELECT COUNT(post_id)
253 - FROM {$table}
254 - WHERE (schema_type IS NOT NULL AND schema_type != '')
255 - AND post_id IN (SELECT ID FROM {$wpdb->posts} WHERE post_status = 'publish')
256 - ");
256 + // AIOSEO's `default` rows carry no per-post schema at all, so
257 + // they are filtered out before eligibility is even evaluated.
258 + foreach ($this->aioseo_schema_candidate_rows(true) as $row) {
259 + $post_id = (int) $row->post_id;
260 + if (isset($importable_posts[$post_id])) {
261 + continue;
262 + }
263 + if ($this->aioseo_schema_source_is_supported($row->schema_type, $row->schema_type_options) !== null) {
264 + $importable_posts[$post_id] = true;
265 + }
257 266 }
258 267 break;
259 268 }
260 269
270 + $count = count($importable_posts);
271 +
261 272 return $count > 0;
262 273 }
263 274
264 275 /**
276 + * Yoast source rows that could hold per-post schema, for published posts.
277 + *
278 + * Shared by check_schema_data() and import_yoast_schema() so both look at
279 + * exactly the same candidate set.
280 + *
281 + * @param bool $only_new Skip posts that already hold a MetaSync schema block.
282 + * Only the detector sets this: the importers must see
283 + * every candidate so they can report those posts as
284 + * already imported rather than silently dropping them.
285 + * @return array<object> Rows with post_id, meta_key and meta_value.
286 + */
287 + private function yoast_schema_candidate_rows($only_new = false)
288 + {
289 + global $wpdb;
290 +
291 + $query = "SELECT post_id, meta_key, meta_value
292 + FROM {$wpdb->postmeta}
293 + WHERE (meta_key = '_yoast_wpseo_schema' OR meta_key = '_yoast_wpseo_schema_article_type')
294 + AND meta_value != ''
295 + AND post_id IN (SELECT ID FROM {$wpdb->posts} WHERE post_status = 'publish')
296 + " . ($only_new ? $this->sql_exclude_posts_with_metasync_schema($wpdb->postmeta) : '') . "
297 + ORDER BY post_id ASC";
298 +
299 + // phpcs:ignore WordPress.DB.DirectDatabaseQuery, WordPress.DB.PreparedSQL.NotPrepared -- one-shot import tool — bulk reads from third-party SEO plugin storage; no bulk WordPress API exists; table names come from wpdb, exclusion fragment is class-built SQL
300 + return (array) $wpdb->get_results($query);
301 + }
302 +
303 + /**
304 + * Rank Math source rows that could hold per-post schema, for published
305 + * posts. Shortcode schemas are excluded, as the importer always has.
306 + *
307 + * @param bool $only_new Skip posts that already hold a MetaSync schema block.
308 + * @return array<object> Rows with post_id, meta_key and meta_value.
309 + */
310 + private function rankmath_schema_candidate_rows($only_new = false)
311 + {
312 + global $wpdb;
313 +
314 + $query = "SELECT pm.post_id, pm.meta_key, pm.meta_value
315 + FROM {$wpdb->postmeta} pm
316 + WHERE pm.meta_key LIKE 'rank_math_schema_%'
317 + AND pm.meta_key NOT LIKE 'rank_math_shortcode_schema_%'
318 + AND pm.meta_value != ''
319 + AND pm.meta_value != 'a:0:{}'
320 + AND pm.post_id IN (SELECT ID FROM {$wpdb->posts} WHERE post_status = 'publish')
321 + " . ($only_new ? $this->sql_exclude_posts_with_metasync_schema('pm') : '') . "
322 + ORDER BY pm.post_id ASC";
323 +
324 + // phpcs:ignore WordPress.DB.DirectDatabaseQuery, WordPress.DB.PreparedSQL.NotPrepared -- one-shot import tool — bulk reads from third-party SEO plugin storage; no bulk WordPress API exists; table names come from wpdb, exclusion fragment is class-built SQL
325 + return (array) $wpdb->get_results($query);
326 + }
327 +
328 + /**
329 + * AIOSEO source rows that could hold per-post schema, for published posts.
330 + *
331 + * Returns an empty array when the AIOSEO table is absent (the plugin was
332 + * never installed), matching the previous detector behaviour.
333 + *
334 + * @param bool $only_new Skip posts that already hold a MetaSync schema block.
335 + * @return array<object> Rows with post_id, schema_type and schema_type_options.
336 + */
337 + private function aioseo_schema_candidate_rows($only_new = false)
338 + {
339 + global $wpdb;
340 +
341 + $table = $wpdb->prefix . 'aioseo_posts';
342 + if ($wpdb->get_var($wpdb->prepare('SHOW TABLES LIKE %s', $wpdb->esc_like($table))) !== $table) { // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- one-shot import tool — bulk reads from third-party SEO plugin storage; no bulk WordPress API exists
343 + return [];
344 + }
345 +
346 + // AIOSEO writes a row for every post it tracks, and the overwhelming
347 + // majority carry schema_type 'default' with empty schema_type_options.
348 + // Those rows represent the post-type default, not per-post schema, so
349 + // they are dropped here rather than being reported as "unsupported" —
350 + // counting them is what made the card claim hundreds of ready posts
351 + // that no import could ever produce.
352 + $query = "SELECT post_id, schema_type, schema_type_options
353 + FROM {$table}
354 + WHERE schema_type IS NOT NULL
355 + AND schema_type != ''
356 + AND schema_type != 'default'
357 + AND schema_type_options IS NOT NULL
358 + AND schema_type_options NOT IN ('', '{}', '[]', 'null')
359 + AND post_id IN (SELECT ID FROM {$wpdb->posts} WHERE post_status = 'publish')
360 + " . ($only_new ? $this->sql_exclude_posts_with_metasync_schema($table) : '') . "
361 + ORDER BY post_id ASC";
362 +
363 + // phpcs:ignore WordPress.DB.DirectDatabaseQuery, WordPress.DB.PreparedSQL.NotPrepared -- one-shot import tool — bulk reads from third-party SEO plugin storage; no bulk WordPress API exists; table name comes from wpdb, exclusion fragment is class-built SQL
364 + return (array) $wpdb->get_results($query);
365 + }
366 +
367 + /**
368 + * SQL clause excluding posts that already hold a MetaSync schema block.
369 + *
370 + * Mirrors post_has_metasync_schema() in SQL: a metasync_schema_markup
371 + * value whose "types" array exists and is non-empty. Values without a
372 + * "types" list (an OTTO-deployed otto_jsonld block, for example) are
373 + * deliberately not excluded — the importer does not skip those either.
374 + * post_has_metasync_schema() is still evaluated per record in PHP, so the
375 + * two checks cannot drift apart.
376 + *
377 + * @param string $alias Table name or alias the candidate query exposes post_id under.
378 + * @return string "AND NOT EXISTS (...)" clause.
379 + */
380 + private function sql_exclude_posts_with_metasync_schema($alias)
381 + {
382 + global $wpdb;
383 +
384 + return "AND NOT EXISTS (
385 + SELECT 1
386 + FROM {$wpdb->postmeta} ms
387 + WHERE ms.post_id = {$alias}.post_id
388 + AND ms.meta_key = 'metasync_schema_markup'
389 + AND ms.meta_value LIKE '%s:5:\"types\";a:%'
390 + AND ms.meta_value NOT LIKE '%s:5:\"types\";a:0:{}%'
391 + )";
392 + }
393 +
394 + /**
395 + * Whether a post already holds a MetaSync schema block an import must not
396 + * overwrite.
397 + *
398 + * Same guard the importers have always applied: an existing
399 + * metasync_schema_markup whose "types" list is populated means the schema
400 + * was already migrated or set by hand, so the source record is skipped
401 + * and reported as already imported rather than overwritten.
402 + *
403 + * @param int $post_id Post ID.
404 + * @return bool
405 + */
406 + private function post_has_metasync_schema($post_id)
407 + {
408 + $existing = get_post_meta($post_id, 'metasync_schema_markup', true);
409 +
410 + return is_array($existing) && !empty($existing['types']);
411 + }
412 +
413 + /**
414 + * Normalise a source schema type string to a supported MetaSync type.
415 + *
416 + * Shared by the Yoast and Rank Math eligibility checks and by the
417 + * converters, so "which source types can we actually carry" has a single
418 + * answer per provider.
419 + *
420 + * @param string $raw_type Source @type / schema type, any case.
421 + * @return string|null MetaSync type slug, or null when unsupported.
422 + */
423 + private function supported_schema_type($raw_type)
424 + {
425 + $type = strtolower(trim((string) $raw_type));
426 + if ($type === '') {
427 + return null;
428 + }
429 +
430 + $map = [
431 + 'article' => 'article',
432 + 'newsarticle' => 'article',
433 + 'blogposting' => 'article',
434 + 'faqpage' => 'FAQPage',
435 + 'product' => 'product',
436 + 'recipe' => 'recipe',
437 + ];
438 +
439 + return $map[$type] ?? null;
440 + }
441 +
442 + /**
443 + * Whether a Yoast source row holds schema the importer can convert.
444 + *
445 + * Returns the resolved MetaSync type when the row is supported, or null
446 + * when it must not be counted or imported (unsupported type, empty or
447 + * invalid payload). Used by both check_schema_data() and
448 + * import_yoast_schema() so the two cannot drift.
449 + *
450 + * @param string $meta_key Source meta key.
451 + * @param string $meta_value Raw meta value.
452 + * @return string|null
453 + */
454 + private function yoast_schema_source_is_supported($meta_key, $meta_value)
455 + {
456 + if ($meta_key === '_yoast_wpseo_schema_article_type') {
457 + // Yoast Premium stores a bare type name; the importer builds an
458 + // article skeleton from it.
459 + return $this->supported_schema_type($meta_value);
460 + }
461 +
462 + if ($meta_key !== '_yoast_wpseo_schema') {
463 + return null;
464 + }
465 +
466 + $value = trim((string) $meta_value);
467 + if ($value === '') {
468 + return null;
469 + }
470 +
471 + $decoded = json_decode($value, true);
472 + if (!is_array($decoded) || $decoded === []) {
473 + return null;
474 + }
475 +
476 + foreach ($this->yoast_schema_graph_items($decoded) as $item) {
477 + if (!is_array($item) || !isset($item['@type'])) {
478 + continue;
479 + }
480 +
481 + $raw_type = $item['@type'];
482 + if (is_array($raw_type)) {
483 + $raw_type = reset($raw_type);
484 + }
485 + if (!is_string($raw_type) || $raw_type === '') {
486 + continue;
487 + }
488 +
489 + $supported = $this->supported_schema_type($raw_type);
490 + if ($supported === null) {
491 + continue;
492 + }
493 +
494 + // A FAQPage whose questions cannot be converted produces an empty
495 + // MetaSync block, so it must not be counted as importable either.
496 + if ($supported === 'FAQPage'
497 + && !$this->faq_questions_are_convertible($item['mainEntity'] ?? [], 'yoast')) {
498 + continue;
499 + }
500 +
501 + return $supported;
502 + }
503 +
504 + return null;
505 + }
506 +
507 + /**
508 + * Iterate the schema entries inside a decoded Yoast payload.
509 + *
510 + * Supports the two storage shapes Yoast has used: the current
511 + * `{"@graph": [...]}` wrapper and the legacy root array of entries.
512 + *
513 + * @param array $decoded Decoded `_yoast_wpseo_schema` value.
514 + * @return array Iterable list of schema item arrays.
515 + */
516 + private function yoast_schema_graph_items($decoded)
517 + {
518 + if (isset($decoded['@graph']) && is_array($decoded['@graph'])) {
519 + return $decoded['@graph'];
520 + }
521 +
522 + // A single schema object at the root: {"@type":"Article",...}.
523 + if (isset($decoded['@type'])) {
524 + return [$decoded];
525 + }
526 +
527 + // Legacy payload: a root array of entries, e.g.
528 + // [{"@type":"Article","headline":"..."}, ...]. Only treat it as such
529 + // when every element is an array — otherwise the value is an object
530 + // whose keys are property names, not entries, and no entry carries a
531 + // @type anyway.
532 + $is_entry_list = $decoded !== [];
533 + foreach ($decoded as $entry) {
534 + if (!is_array($entry)) {
535 + $is_entry_list = false;
536 + break;
537 + }
538 + }
539 +
540 + return $is_entry_list ? $decoded : [];
541 + }
542 +
543 + /**
544 + * Whether a Rank Math source row holds schema the importer can convert.
545 + *
546 + * Returns the resolved MetaSync type when supported, null otherwise. The
547 + * type lives in the meta key (rank_math_schema_Article), mirroring
548 + * convert_rankmath_schema_to_metasync().
549 + *
550 + * @param string $meta_key Source meta key.
551 + * @param string $meta_value Raw meta value.
552 + * @return string|null
553 + */
554 + private function rankmath_schema_source_is_supported($meta_key, $meta_value)
555 + {
556 + if (strpos((string) $meta_key, 'rank_math_schema_') !== 0) {
557 + return null;
558 + }
559 +
560 + $schema_type = str_replace('rank_math_schema_', '', (string) $meta_key);
561 + $supported = $this->supported_schema_type($schema_type);
562 +
563 + if ($supported === null) {
564 + return null;
565 + }
566 +
567 + $decoded = maybe_unserialize($meta_value);
568 + if (!is_array($decoded) || $decoded === []) {
569 + return null;
570 + }
571 +
572 + // Keep the check in step with the converter: a FAQPage whose questions
573 + // cannot be converted would yield an empty MetaSync block.
574 + if ($supported === 'FAQPage'
575 + && !$this->faq_questions_are_convertible($decoded['questions'] ?? [], 'rankmath')) {
576 + return null;
577 + }
578 +
579 + return $supported;
580 + }
581 +
582 + /**
583 + * Whether an AIOSEO row holds per-post schema the importer can convert.
584 + *
585 + * Returns the resolved MetaSync type when supported, null otherwise.
586 + * `schema_type = 'default'` rows — the post-type default AIOSEO stamps on
587 + * every tracked post — never reach this check from the candidate queries,
588 + * but it is enforced here as well so the importer cannot regress into
589 + * reporting them as "unsupported" source schemas.
590 + *
591 + * @param string $schema_type Raw schema_type column value.
592 + * @param string $schema_type_options Raw schema_type_options JSON.
593 + * @return string|null
594 + */
595 + private function aioseo_schema_source_is_supported($schema_type, $schema_type_options)
596 + {
597 + $type = strtolower(trim((string) $schema_type));
598 +
599 + if ($type === '' || $type === 'default' || $type === 'none') {
600 + return null;
601 + }
602 +
603 + $supported = $this->supported_schema_type($type);
604 + if ($supported === null) {
605 + return null;
606 + }
607 +
608 + $decoded = json_decode(trim((string) $schema_type_options), true);
609 + if (!is_array($decoded) || $decoded === []) {
610 + return null;
611 + }
612 +
613 + // As above: an unconvertible FAQPage must not be counted as importable.
614 + if ($supported === 'FAQPage'
615 + && !$this->faq_questions_are_convertible($decoded['questions'] ?? [], 'aioseo')) {
616 + return null;
617 + }
618 +
619 + return $supported;
620 + }
621 +
622 + /**
623 + * Whether a FAQ question list holds at least one entry the converter can
624 + * turn into a MetaSync FAQ item, for the given provider's key shape.
625 + *
626 + * Eligibility and conversion must agree: a source counted as importable
627 + * has to produce a non-empty MetaSync block, or the detector over-reports
628 + * again — the very defect this class of fix exists to close.
629 + *
630 + * A scalar `mainEntity`/`questions` value (corrupt or foreign meta) is
631 + * simply not convertible; it must never fatal the eligibility check,
632 + * which runs on every render of the Schema import tab.
633 + *
634 + * @param mixed $questions Question list from the source record.
635 + * @param string $provider 'yoast', 'rankmath' or 'aioseo'.
636 + * @return bool
637 + */
638 + private function faq_questions_are_convertible($questions, $provider)
639 + {
640 + if (!is_array($questions)) {
641 + return false;
642 + }
643 +
644 + foreach ($questions as $question) {
645 + if (!is_array($question)) {
646 + continue;
647 + }
648 +
649 + if ($provider === 'yoast') {
650 + if (isset($question['name'], $question['acceptedAnswer']['text'])) {
651 + return true;
652 + }
653 + } elseif ($provider === 'rankmath') {
654 + if (isset($question['name'], $question['text'])) {
655 + return true;
656 + }
657 + } elseif (isset($question['question'], $question['answer'])) {
658 + return true;
659 + }
660 + }
661 +
662 + return false;
663 + }
664 +
665 + /**
265 666 * Check if SEO metadata (titles and descriptions) exists for a plugin
266 667 */
267 668 private function check_seo_metadata($plugin, &$count)
268 669 {
@@ -272,8 +673,9 @@
272 673
273 674 switch ($plugin) {
274 675 case 'yoast':
275 676 // Check for Yoast SEO title or description
677 + // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- one-shot import tool — bulk reads from third-party SEO plugin storage; no bulk WordPress API exists
276 678 $count = (int) $wpdb->get_var("
277 679 SELECT COUNT(DISTINCT post_id)
278 680 FROM {$wpdb->postmeta}
279 681 WHERE (meta_key = '_yoast_wpseo_title' OR meta_key = '_yoast_wpseo_metadesc')
@@ -283,8 +685,9 @@
283 685 break;
284 686
285 687 case 'rankmath':
286 688 // Check for Rank Math title or description
689 + // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- one-shot import tool — bulk reads from third-party SEO plugin storage; no bulk WordPress API exists
287 690 $count = (int) $wpdb->get_var("
288 691 SELECT COUNT(DISTINCT post_id)
289 692 FROM {$wpdb->postmeta}
290 693 WHERE (meta_key = 'rank_math_title' OR meta_key = 'rank_math_description')
@@ -295,15 +698,42 @@
295 698
296 699 case 'aioseo':
297 700 // Check for AIOSEO title or description in their custom table
298 701 $table = $wpdb->prefix . 'aioseo_posts';
299 - if ($wpdb->get_var("SHOW TABLES LIKE '$table'") === $table) {
702 + if ($wpdb->get_var($wpdb->prepare('SHOW TABLES LIKE %s', $wpdb->esc_like($table))) === $table) { // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- one-shot import tool — bulk reads from third-party SEO plugin storage; no bulk WordPress API exists
300 703 $count = (int) $wpdb->get_var("
301 704 SELECT COUNT(post_id)
302 - FROM {$table}
705 + FROM {$wpdb->prefix}aioseo_posts
303 706 WHERE ((title IS NOT NULL AND title != '') OR (description IS NOT NULL AND description != ''))
304 707 AND post_id IN (SELECT ID FROM {$wpdb->posts} WHERE post_status = 'publish')
305 708 ");
709 +
710 + // Per-post overrides are the exception. AIOSEO also serves a
711 + // title and description for every post from its site-wide
712 + // templates, and those are what the import mainly picks up —
713 + // so a site that never overrode an individual post still has
714 + // plenty to migrate. Counting overrides alone reported zero
715 + // there, which rendered the card "Unavailable" with a disabled
716 + // button and made the import impossible to start.
717 + $templates = $this->get_aioseo_post_type_templates();
718 + if (!empty($templates)) {
719 + $post_types = array_keys($templates);
720 + $type_placeholders = implode(', ', array_fill(0, count($post_types), '%s'));
721 +
722 + $template_count = (int) $wpdb->get_var($wpdb->prepare( // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- one-shot import tool — bulk reads from third-party SEO plugin storage; no bulk WordPress API exists
723 + "SELECT COUNT(*)
724 + FROM {$wpdb->posts}
725 + WHERE post_status = 'publish'
726 + AND post_type IN ({$type_placeholders})",
727 + $post_types
728 + ));
729 +
730 + // Take the larger of the two. Templates configured for a
731 + // post type with no published posts would otherwise report
732 + // zero and disable the card, hiding override rows that do
733 + // exist — the same dead end from the other direction.
734 + $count = max($count, $template_count);
735 + }
306 736 }
307 737 break;
308 738 }
309 739
@@ -320,8 +750,9 @@
320 750 $count = 0;
321 751
322 752 switch ($plugin) {
323 753 case 'yoast':
754 + // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- one-shot import tool — bulk reads from third-party SEO plugin storage; no bulk WordPress API exists
324 755 $count = (int) $wpdb->get_var("
325 756 SELECT COUNT(DISTINCT post_id)
326 757 FROM {$wpdb->postmeta}
327 758 WHERE meta_key = '_yoast_wpseo_primary_category'
@@ -330,8 +761,9 @@
330 761 ");
331 762 break;
332 763
333 764 case 'rankmath':
765 + // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- one-shot import tool — bulk reads from third-party SEO plugin storage; no bulk WordPress API exists
334 766 $count = (int) $wpdb->get_var("
335 767 SELECT COUNT(DISTINCT post_id)
336 768 FROM {$wpdb->postmeta}
337 769 WHERE meta_key = 'rank_math_primary_category'
@@ -340,8 +772,9 @@
340 772 ");
341 773 break;
342 774
343 775 case 'aioseo':
776 + // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- one-shot import tool — bulk reads from third-party SEO plugin storage; no bulk WordPress API exists
344 777 $count = (int) $wpdb->get_var("
345 778 SELECT COUNT(DISTINCT post_id)
346 779 FROM {$wpdb->postmeta}
347 780 WHERE meta_key = '_aioseo_primary_category'
@@ -402,8 +835,9 @@
402 835 $batch_size = intval($options['batch_size']);
403 836 $offset = intval($options['offset']);
404 837 $overwrite = (bool) $options['overwrite_existing'];
405 838
839 + // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- one-shot import tool — bulk reads from third-party SEO plugin storage; no bulk WordPress API exists
406 840 $total_posts = (int) $wpdb->get_var("
407 841 SELECT COUNT(DISTINCT post_id)
408 842 FROM {$wpdb->postmeta}
409 843 WHERE meta_key = '_yoast_wpseo_primary_category'
@@ -410,8 +844,9 @@
410 844 AND meta_value != ''
411 845 AND post_id IN (SELECT ID FROM {$wpdb->posts} WHERE post_status = 'publish')
412 846 ");
413 847
848 + // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- one-shot import tool — bulk reads from third-party SEO plugin storage; no bulk WordPress API exists
414 849 $posts = $wpdb->get_results($wpdb->prepare("
415 850 SELECT DISTINCT post_id
416 851 FROM {$wpdb->postmeta}
417 852 WHERE meta_key = '_yoast_wpseo_primary_category'
@@ -465,8 +900,9 @@
465 900 $batch_size = intval($options['batch_size']);
466 901 $offset = intval($options['offset']);
467 902 $overwrite = (bool) $options['overwrite_existing'];
468 903
904 + // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- one-shot import tool — bulk reads from third-party SEO plugin storage; no bulk WordPress API exists
469 905 $total_posts = (int) $wpdb->get_var("
470 906 SELECT COUNT(DISTINCT post_id)
471 907 FROM {$wpdb->postmeta}
472 908 WHERE meta_key = 'rank_math_primary_category'
@@ -473,8 +909,9 @@
473 909 AND meta_value != ''
474 910 AND post_id IN (SELECT ID FROM {$wpdb->posts} WHERE post_status = 'publish')
475 911 ");
476 912
913 + // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- one-shot import tool — bulk reads from third-party SEO plugin storage; no bulk WordPress API exists
477 914 $posts = $wpdb->get_results($wpdb->prepare("
478 915 SELECT DISTINCT post_id
479 916 FROM {$wpdb->postmeta}
480 917 WHERE meta_key = 'rank_math_primary_category'
@@ -528,8 +965,9 @@
528 965 $batch_size = intval($options['batch_size']);
529 966 $offset = intval($options['offset']);
530 967 $overwrite = (bool) $options['overwrite_existing'];
531 968
969 + // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- one-shot import tool — bulk reads from third-party SEO plugin storage; no bulk WordPress API exists
532 970 $total_posts = (int) $wpdb->get_var("
533 971 SELECT COUNT(DISTINCT post_id)
534 972 FROM {$wpdb->postmeta}
535 973 WHERE meta_key = '_aioseo_primary_category'
@@ -536,8 +974,9 @@
536 974 AND meta_value != ''
537 975 AND post_id IN (SELECT ID FROM {$wpdb->posts} WHERE post_status = 'publish')
538 976 ");
539 977
978 + // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- one-shot import tool — bulk reads from third-party SEO plugin storage; no bulk WordPress API exists
540 979 $posts = $wpdb->get_results($wpdb->prepare("
541 980 SELECT DISTINCT post_id
542 981 FROM {$wpdb->postmeta}
543 982 WHERE meta_key = '_aioseo_primary_category'
@@ -735,24 +1174,26 @@
735 1174 $batch_size = intval($options['batch_size']);
736 1175 $offset = intval($options['offset']);
737 1176
738 1177 // Get total count (for progress tracking)
739 - $total = (int) $wpdb->get_var("
1178 + // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- one-shot import tool — bulk reads from third-party SEO plugin storage; no bulk WordPress API exists
1179 + $total = (int) $wpdb->get_var($wpdb->prepare("
740 1180 SELECT COUNT(DISTINCT post_id)
741 1181 FROM {$wpdb->postmeta}
742 - WHERE meta_key LIKE '_yoast_wpseo_%'
1182 + WHERE meta_key LIKE %s
743 1183 AND post_id IN (SELECT ID FROM {$wpdb->posts} WHERE post_status = 'publish')
744 - ");
1184 + ", '_yoast_wpseo_%'));
745 1185
746 1186 // Get batch of posts with Yoast robots meta
1187 + // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- one-shot import tool — bulk reads from third-party SEO plugin storage; no bulk WordPress API exists
747 1188 $posts = $wpdb->get_results($wpdb->prepare("
748 1189 SELECT DISTINCT post_id
749 1190 FROM {$wpdb->postmeta}
750 - WHERE meta_key LIKE '_yoast_wpseo_%'
1191 + WHERE meta_key LIKE %s
751 1192 AND post_id IN (SELECT ID FROM {$wpdb->posts} WHERE post_status = 'publish')
752 1193 ORDER BY post_id ASC
753 1194 LIMIT %d OFFSET %d
754 - ", $batch_size, $offset));
1195 + ", '_yoast_wpseo_%', $batch_size, $offset));
755 1196
756 1197 foreach ($posts as $post_obj) {
757 1198 $post_id = $post_obj->post_id;
758 1199 $has_changes = false;
@@ -767,11 +1208,12 @@
767 1208 $yoast_noindex = get_post_meta($post_id, '_yoast_wpseo_meta-robots-noindex', true);
768 1209 if ($yoast_noindex === '1' && !isset($metasync_robots['noindex'])) {
769 1210 $metasync_robots['noindex'] = 'noindex';
770 1211 $has_changes = true;
771 - } elseif ($yoast_noindex === '2' && !isset($metasync_robots['index'])) {
772 - // '2' means 'index' in Yoast
773 - $metasync_robots['index'] = 'index';
1212 + } elseif ($yoast_noindex === '2' && isset($metasync_robots['noindex'])) {
1213 + // '2' means 'index' in Yoast. Index is the implicit default, so
1214 + // clear any stored noindex rather than recording a redundant flag.
1215 + unset($metasync_robots['noindex']);
774 1216 $has_changes = true;
775 1217 }
776 1218
777 1219 // Import nofollow
@@ -782,8 +1224,16 @@
782 1224 }
783 1225
784 1226 // Import advanced robots (noarchive, nosnippet, noimageindex)
785 1227 $yoast_adv = get_post_meta($post_id, '_yoast_wpseo_meta-robots-adv', true);
1228 + // Normalise the meta value to a string before calling explode().
1229 + // Some sites store malformed/legacy data where this meta value is
1230 + // an array, which would otherwise throw a TypeError on explode().
1231 + if (is_array($yoast_adv)) {
1232 + $yoast_adv = implode(',', $yoast_adv);
1233 + } elseif (!is_string($yoast_adv)) {
1234 + $yoast_adv = '';
1235 + }
786 1236 if (!empty($yoast_adv)) {
787 1237 $adv_directives = explode(',', $yoast_adv);
788 1238 foreach ($adv_directives as $directive) {
789 1239 $directive = trim($directive);
@@ -793,9 +1243,9 @@
793 1243 }
794 1244 }
795 1245 }
796 1246
797 - // WP-197: Also write to _metasync_robots_advanced JSON
1247 + // Also write to _metasync_robots_advanced JSON
798 1248 $robots_advanced = [];
799 1249 if (!empty($yoast_adv)) {
800 1250 $adv_directives = array_map('trim', explode(',', $yoast_adv));
801 1251 foreach (['noarchive', 'nosnippet', 'noimageindex'] as $dir) {
@@ -816,10 +1266,15 @@
816 1266 $yoast_canonical = get_post_meta($post_id, '_yoast_wpseo_canonical', true);
817 1267 if (!empty($yoast_canonical)) {
818 1268 $existing_canonical = get_post_meta($post_id, 'meta_canonical', true);
819 1269 if (empty($existing_canonical)) {
820 - update_post_meta($post_id, 'meta_canonical', sanitize_url($yoast_canonical));
821 - $has_changes = true;
1270 + // Validate: never import a corrupted value such as
1271 + // "http://Array" from third-party storage.
1272 + $clean_canonical = Metasync_Canonical_Sanitizer::sanitize_for_save($yoast_canonical);
1273 + if ($clean_canonical !== '') {
1274 + update_post_meta($post_id, 'meta_canonical', $clean_canonical);
1275 + $has_changes = true;
1276 + }
822 1277 }
823 1278 }
824 1279
825 1280 // Save Metasync robots meta if changes were made
@@ -862,24 +1317,26 @@
862 1317 $batch_size = intval($options['batch_size']);
863 1318 $offset = intval($options['offset']);
864 1319
865 1320 // Get total count (for progress tracking)
866 - $total = (int) $wpdb->get_var("
1321 + // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- one-shot import tool — bulk reads from third-party SEO plugin storage; no bulk WordPress API exists
1322 + $total = (int) $wpdb->get_var($wpdb->prepare("
867 1323 SELECT COUNT(DISTINCT post_id)
868 1324 FROM {$wpdb->postmeta}
869 - WHERE meta_key LIKE 'rank_math_%'
1325 + WHERE meta_key LIKE %s
870 1326 AND post_id IN (SELECT ID FROM {$wpdb->posts} WHERE post_status = 'publish')
871 - ");
1327 + ", 'rank_math_%'));
872 1328
873 1329 // Get batch of posts with Rank Math robots meta
1330 + // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- one-shot import tool — bulk reads from third-party SEO plugin storage; no bulk WordPress API exists
874 1331 $posts = $wpdb->get_results($wpdb->prepare("
875 1332 SELECT DISTINCT post_id
876 1333 FROM {$wpdb->postmeta}
877 - WHERE meta_key LIKE 'rank_math_%'
1334 + WHERE meta_key LIKE %s
878 1335 AND post_id IN (SELECT ID FROM {$wpdb->posts} WHERE post_status = 'publish')
879 1336 ORDER BY post_id ASC
880 1337 LIMIT %d OFFSET %d
881 - ", $batch_size, $offset));
1338 + ", 'rank_math_%', $batch_size, $offset));
882 1339
883 1340 foreach ($posts as $post_obj) {
884 1341 $post_id = $post_obj->post_id;
885 1342 $has_changes = false;
@@ -914,9 +1371,9 @@
914 1371 }
915 1372 }
916 1373 }
917 1374
918 - // WP-197: Parse max-* values and write _metasync_robots_advanced JSON
1375 + // Parse max-* values and write _metasync_robots_advanced JSON
919 1376 $robots_advanced = [];
920 1377 // Boolean directives from rank_math_robots
921 1378 if (is_array($rm_robots)) {
922 1379 foreach (['nofollow', 'noarchive', 'nosnippet', 'noimageindex'] as $dir) {
@@ -948,10 +1405,15 @@
948 1405 $rm_canonical = get_post_meta($post_id, 'rank_math_canonical_url', true);
949 1406 if (!empty($rm_canonical)) {
950 1407 $existing_canonical = get_post_meta($post_id, 'meta_canonical', true);
951 1408 if (empty($existing_canonical)) {
952 - update_post_meta($post_id, 'meta_canonical', sanitize_url($rm_canonical));
953 - $has_changes = true;
1409 + // Validate: never import a corrupted value such as
1410 + // "http://Array" from third-party storage.
1411 + $clean_canonical = Metasync_Canonical_Sanitizer::sanitize_for_save($rm_canonical);
1412 + if ($clean_canonical !== '') {
1413 + update_post_meta($post_id, 'meta_canonical', $clean_canonical);
1414 + $has_changes = true;
1415 + }
954 1416 }
955 1417 }
956 1418
957 1419 // Save Metasync robots meta if changes were made
@@ -997,9 +1459,9 @@
997 1459 // AIOSEO stores data in a custom table
998 1460 $aioseo_table = $wpdb->prefix . 'aioseo_posts';
999 1461
1000 1462 // Check if table exists
1001 - $table_exists = $wpdb->get_var("SHOW TABLES LIKE '$aioseo_table'") === $aioseo_table;
1463 + $table_exists = $wpdb->get_var($wpdb->prepare('SHOW TABLES LIKE %s', $wpdb->esc_like($aioseo_table))) === $aioseo_table; // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- one-shot import tool — bulk reads from third-party SEO plugin storage; no bulk WordPress API exists
1002 1464
1003 1465 if (!$table_exists) {
1004 1466 return ['success' => false, 'message' => 'AIOSEO table not found.'];
1005 1467 }
@@ -1004,21 +1466,23 @@
1004 1466 return ['success' => false, 'message' => 'AIOSEO table not found.'];
1005 1467 }
1006 1468
1007 1469 // Get total count (for progress tracking)
1470 + // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- one-shot import tool — bulk reads from third-party SEO plugin storage; no bulk WordPress API exists
1008 1471 $total = (int) $wpdb->get_var("
1009 1472 SELECT COUNT(*)
1010 - FROM {$aioseo_table}
1473 + FROM {$wpdb->prefix}aioseo_posts
1011 1474 WHERE post_id IN (SELECT ID FROM {$wpdb->posts} WHERE post_status = 'publish')
1012 1475 ");
1013 1476
1014 1477 // Get batch of posts with AIOSEO settings
1478 + // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- one-shot import tool — bulk reads from third-party SEO plugin storage; no bulk WordPress API exists
1015 1479 $posts = $wpdb->get_results($wpdb->prepare("
1016 1480 SELECT post_id, robots_default, robots_noindex, robots_nofollow,
1017 1481 robots_noarchive, robots_nosnippet, robots_noimageindex,
1018 1482 robots_max_snippet, robots_max_imagepreview, robots_max_videopreview,
1019 1483 canonical_url
1020 - FROM {$aioseo_table}
1484 + FROM {$wpdb->prefix}aioseo_posts
1021 1485 WHERE post_id IN (SELECT ID FROM {$wpdb->posts} WHERE post_status = 'publish')
1022 1486 ORDER BY post_id ASC
1023 1487 LIMIT %d OFFSET %d
1024 1488 ", $batch_size, $offset));
@@ -1065,9 +1529,9 @@
1065 1529 $has_changes = true;
1066 1530 }
1067 1531 }
1068 1532
1069 - // WP-197: Write _metasync_robots_advanced JSON
1533 + // Write _metasync_robots_advanced JSON
1070 1534 $robots_advanced = [];
1071 1535 if ($aioseo_data->robots_default == 0) {
1072 1536 if ($aioseo_data->robots_nofollow == 1) $robots_advanced['nofollow'] = true;
1073 1537 if ($aioseo_data->robots_noarchive == 1) $robots_advanced['noarchive'] = true;
@@ -1091,10 +1555,15 @@
1091 1555 // Import canonical URL
1092 1556 if (!empty($aioseo_data->canonical_url)) {
1093 1557 $existing_canonical = get_post_meta($post_id, 'meta_canonical', true);
1094 1558 if (empty($existing_canonical)) {
1095 - update_post_meta($post_id, 'meta_canonical', sanitize_url($aioseo_data->canonical_url));
1096 - $has_changes = true;
1559 + // Validate: never import a corrupted value such as
1560 + // "http://Array" from third-party storage.
1561 + $clean_canonical = Metasync_Canonical_Sanitizer::sanitize_for_save($aioseo_data->canonical_url);
1562 + if ($clean_canonical !== '') {
1563 + update_post_meta($post_id, 'meta_canonical', $clean_canonical);
1564 + $has_changes = true;
1565 + }
1097 1566 }
1098 1567 }
1099 1568
1100 1569 // Save Metasync robots meta if changes were made
@@ -1127,24 +1596,27 @@
1127 1596 }
1128 1597
1129 1598 /**
1130 1599 * Import Schema Settings (Per-Post Schema)
1600 + *
1601 + * Composes the user-facing result from the importer's breakdown so the
1602 + * message states what actually happened: no source schema, everything
1603 + * already migrated, everything unsupported/empty, or an import — including
1604 + * the partial case where some posts were skipped alongside the imports.
1131 1605 */
1132 1606 public function import_schema($plugin)
1133 1607 {
1134 - $imported_count = 0;
1135 -
1136 1608 switch ($plugin) {
1137 1609 case 'yoast':
1138 - $imported_count = $this->import_yoast_schema();
1610 + $breakdown = $this->import_yoast_schema();
1139 1611 break;
1140 1612
1141 1613 case 'rankmath':
1142 - $imported_count = $this->import_rankmath_schema();
1614 + $breakdown = $this->import_rankmath_schema();
1143 1615 break;
1144 1616
1145 1617 case 'aioseo':
1146 - $imported_count = $this->import_aioseo_schema();
1618 + $breakdown = $this->import_aioseo_schema();
1147 1619 break;
1148 1620
1149 1621 default:
1150 1622 return ['success' => false, 'message' => 'Invalid plugin specified.'];
@@ -1149,77 +1621,147 @@
1149 1621 default:
1150 1622 return ['success' => false, 'message' => 'Invalid plugin specified.'];
1151 1623 }
1152 1624
1153 - if ($imported_count > 0) {
1154 - return ['success' => true, 'message' => "Successfully imported schema settings for $imported_count posts."];
1625 + $imported = (int) $breakdown['imported'];
1626 + $already_imported = (int) $breakdown['already_imported'];
1627 + $unsupported = (int) $breakdown['unsupported'];
1628 + $candidates = (int) $breakdown['total_candidates'];
1629 +
1630 + // No source rows at all — nothing was ever detected to begin with.
1631 + if ($candidates === 0) {
1632 + return [
1633 + 'success' => false,
1634 + 'message' => 'No post-level schema settings found to import.',
1635 + 'breakdown' => $breakdown,
1636 + ];
1155 1637 }
1156 1638
1157 - return ['success' => false, 'message' => 'No post-level schema settings found to import.'];
1639 + if ($imported === 0) {
1640 + // Every eligible source record is already in MetaSync.
1641 + if ($already_imported > 0 && $unsupported === 0) {
1642 + return [
1643 + 'success' => false,
1644 + 'message' => sprintf(
1645 + 'All %d eligible post(s) already have MetaSync schema — nothing left to import.',
1646 + $already_imported
1647 + ),
1648 + 'breakdown' => $breakdown,
1649 + ];
1650 + }
1651 +
1652 + // Source schema exists, but none of it maps to a supported type.
1653 + if ($unsupported > 0 && $already_imported === 0) {
1654 + return [
1655 + 'success' => false,
1656 + 'message' => sprintf(
1657 + 'Found %d post(s) with schema settings, but none use a supported schema type '
1658 + . '(Article, FAQPage, Product, Recipe) or their contents were empty.',
1659 + $unsupported
1660 + ),
1661 + 'breakdown' => $breakdown,
1662 + ];
1663 + }
1664 +
1665 + // Both skip reasons applied, nothing imported.
1666 + return [
1667 + 'success' => false,
1668 + 'message' => sprintf(
1669 + 'No schema settings imported: %d post(s) already had MetaSync schema and %d post(s) had unsupported or empty schema settings.',
1670 + $already_imported,
1671 + $unsupported
1672 + ),
1673 + 'breakdown' => $breakdown,
1674 + ];
1675 + }
1676 +
1677 + $message = sprintf('Successfully imported schema settings for %d post(s).', $imported);
1678 +
1679 + if ($already_imported > 0) {
1680 + $message .= sprintf(' Skipped %d post(s) that already had MetaSync schema.', $already_imported);
1681 + }
1682 + if ($unsupported > 0) {
1683 + $message .= sprintf(' Skipped %d post(s) with unsupported or empty schema settings.', $unsupported);
1684 + }
1685 +
1686 + return ['success' => true, 'message' => $message, 'breakdown' => $breakdown];
1158 1687 }
1159 1688
1160 1689 /**
1690 + * Fresh per-import counters shared by the three schema importers.
1691 + *
1692 + * `total_candidates` counts distinct posts the importer looked at, so a
1693 + * post with several source rows is one candidate. Posts already holding a
1694 + * MetaSync schema count as `already_imported`; source rows that carry no
1695 + * supported, populated schema count as `unsupported`.
1696 + *
1697 + * @return array{imported:int, already_imported:int, unsupported:int, total_candidates:int}
1698 + */
1699 + private function empty_schema_breakdown()
1700 + {
1701 + return [
1702 + 'imported' => 0,
1703 + 'already_imported' => 0,
1704 + 'unsupported' => 0,
1705 + 'total_candidates' => 0,
1706 + ];
1707 + }
1708 +
1709 + /**
1161 1710 * Import per-post schema from Yoast SEO
1711 + *
1712 + * Rows are grouped per post first, because a post can carry both source
1713 + * keys and the outcome must be decided once per post: a MetaSync schema
1714 + * that already exists wins outright; otherwise the full JSON payload under
1715 + * `_yoast_wpseo_schema` is preferred, and only when it yields nothing does
1716 + * the bare Premium article type under `_yoast_wpseo_schema_article_type`
1717 + * produce a placeholder article schema. Every other combination is
1718 + * unsupported.
1719 + *
1720 + * @return array{imported:int, already_imported:int, unsupported:int, total_candidates:int}
1162 1721 */
1163 1722 private function import_yoast_schema()
1164 1723 {
1165 - global $wpdb;
1166 - $imported_count = 0;
1724 + $breakdown = $this->empty_schema_breakdown();
1167 1725
1168 - // First, try to import from full schema JSON (free version or old approach)
1169 - $posts = $wpdb->get_results("
1170 - SELECT post_id, meta_value
1171 - FROM {$wpdb->postmeta}
1172 - WHERE meta_key = '_yoast_wpseo_schema'
1173 - AND post_id IN (SELECT ID FROM {$wpdb->posts} WHERE post_status = 'publish')
1174 - ");
1726 + // post_id => [meta_key => row]
1727 + $rows_by_post = [];
1728 + foreach ($this->yoast_schema_candidate_rows() as $row) {
1729 + $rows_by_post[(int) $row->post_id][$row->meta_key] = $row;
1730 + }
1175 1731
1176 - foreach ($posts as $post_obj) {
1177 - $post_id = $post_obj->post_id;
1178 -
1179 - // Check if Metasync schema already exists
1732 + foreach ($rows_by_post as $post_id => $rows) {
1733 + // A MetaSync schema that is already there outranks whatever the
1734 + // source plugin holds — the schema migration ran before (or an
1735 + // editor set it by hand) and overwriting it is not this tool's job.
1180 1736 $existing_schema = get_post_meta($post_id, 'metasync_schema_markup', true);
1181 - if (!empty($existing_schema) && !empty($existing_schema['types'])) {
1182 - continue; // Skip if already has Metasync schema
1183 - }
1184 -
1185 - // Decode Yoast schema JSON
1186 - $yoast_schema = json_decode((string)($post_obj->meta_value ?? ''), true);
1187 - if (empty($yoast_schema) || !is_array($yoast_schema)) {
1737 + if ($this->post_has_metasync_schema($post_id)) {
1738 + $breakdown['already_imported']++;
1188 1739 continue;
1189 1740 }
1190 1741
1191 - // Convert Yoast schema to Metasync format
1192 - $metasync_schema = $this->convert_yoast_schema_to_metasync($yoast_schema, $post_id);
1742 + $schema_row = $rows['_yoast_wpseo_schema'] ?? null;
1743 + $article_type_row = $rows['_yoast_wpseo_schema_article_type'] ?? null;
1193 1744
1194 - if (!empty($metasync_schema['types'])) {
1195 - update_post_meta($post_id, 'metasync_schema_markup', $metasync_schema);
1196 - $imported_count++;
1197 - }
1198 - }
1745 + // Full JSON payload first (free version, or the legacy root array).
1746 + if ($schema_row !== null
1747 + && $this->yoast_schema_source_is_supported($schema_row->meta_key, $schema_row->meta_value) !== null) {
1748 + $yoast_schema = json_decode((string) ($schema_row->meta_value ?? ''), true);
1749 + $metasync_schema = is_array($yoast_schema)
1750 + ? $this->convert_yoast_schema_to_metasync($yoast_schema, $post_id)
1751 + : ['types' => []];
1199 1752
1200 - // Second, try to import from schema type (Premium version)
1201 - $posts = $wpdb->get_results("
1202 - SELECT post_id, meta_value
1203 - FROM {$wpdb->postmeta}
1204 - WHERE meta_key = '_yoast_wpseo_schema_article_type'
1205 - AND post_id IN (SELECT ID FROM {$wpdb->posts} WHERE post_status = 'publish')
1206 - ");
1207 -
1208 - foreach ($posts as $post_obj) {
1209 - $post_id = $post_obj->post_id;
1210 -
1211 - // Check if Metasync schema already exists
1212 - $existing_schema = get_post_meta($post_id, 'metasync_schema_markup', true);
1213 - if (!empty($existing_schema) && !empty($existing_schema['types'])) {
1214 - continue; // Skip if already has Metasync schema
1753 + if (!empty($metasync_schema['types'])) {
1754 + update_post_meta($post_id, 'metasync_schema_markup', wp_slash(array_merge(is_array($existing_schema) ? $existing_schema : [], $metasync_schema)));
1755 + $breakdown['imported']++;
1756 + continue;
1757 + }
1215 1758 }
1216 1759
1217 - $schema_type = strtolower($post_obj->meta_value);
1218 -
1219 - // Create basic article schema with placeholders
1220 - // Yoast Premium generates schema dynamically, so we create a minimal version
1221 - if ($schema_type === 'article' || $schema_type === 'newsarticle' || $schema_type === 'blogposting') {
1760 + // Bare Premium article type: build a minimal article schema with
1761 + // placeholders, since Yoast Premium generates schema dynamically.
1762 + if ($article_type_row !== null
1763 + && $this->yoast_schema_source_is_supported($article_type_row->meta_key, $article_type_row->meta_value) !== null) {
1222 1764 $metasync_schema = [
1223 1765 'enabled' => true,
1224 1766 'types' => [
1225 1767 [
@@ -1234,102 +1776,115 @@
1234 1776 ]
1235 1777 ]
1236 1778 ];
1237 1779
1238 - update_post_meta($post_id, 'metasync_schema_markup', $metasync_schema);
1239 - $imported_count++;
1780 + update_post_meta($post_id, 'metasync_schema_markup', wp_slash(array_merge(is_array($existing_schema) ? $existing_schema : [], $metasync_schema)));
1781 + $breakdown['imported']++;
1782 + continue;
1240 1783 }
1784 +
1785 + $breakdown['unsupported']++;
1241 1786 }
1242 1787
1243 - return $imported_count;
1788 + $breakdown['total_candidates'] = count($rows_by_post);
1789 +
1790 + return $breakdown;
1244 1791 }
1245 1792
1246 1793 /**
1247 1794 * Import per-post schema from Rank Math
1795 + *
1796 + * Rows are grouped per post, mirroring check_schema_data(): a post with
1797 + * several `rank_math_schema_*` rows is a single candidate, imported from
1798 + * the first row that carries a supported, populated schema.
1799 + *
1800 + * @return array{imported:int, already_imported:int, unsupported:int, total_candidates:int}
1248 1801 */
1249 1802 private function import_rankmath_schema()
1250 1803 {
1251 - global $wpdb;
1252 - $imported_count = 0;
1804 + $breakdown = $this->empty_schema_breakdown();
1253 1805
1254 - // Get all posts with any Rank Math schema (dynamically detect schema types)
1255 - // Exclude shortcode schemas
1256 - $posts = $wpdb->get_results("
1257 - SELECT DISTINCT pm.post_id, pm.meta_key, pm.meta_value
1258 - FROM {$wpdb->postmeta} pm
1259 - WHERE pm.meta_key LIKE 'rank_math_schema_%'
1260 - AND pm.meta_key NOT LIKE 'rank_math_shortcode_schema_%'
1261 - AND pm.post_id IN (SELECT ID FROM {$wpdb->posts} WHERE post_status = 'publish')
1262 - ORDER BY pm.post_id
1263 - ");
1806 + $rows_by_post = [];
1807 + foreach ($this->rankmath_schema_candidate_rows() as $row) {
1808 + $rows_by_post[(int) $row->post_id][] = $row;
1809 + }
1264 1810
1265 - $processed_posts = [];
1811 + foreach ($rows_by_post as $post_id => $rows) {
1812 + $existing_schema = get_post_meta($post_id, 'metasync_schema_markup', true);
1813 + if ($this->post_has_metasync_schema($post_id)) {
1814 + $breakdown['already_imported']++;
1815 + continue;
1816 + }
1266 1817
1267 - foreach ($posts as $post_obj) {
1268 - $post_id = $post_obj->post_id;
1818 + $imported = false;
1269 1819
1270 - // Skip if we already processed this post
1271 - if (in_array($post_id, $processed_posts)) {
1272 - continue;
1273 - }
1820 + foreach ($rows as $row) {
1821 + if ($this->rankmath_schema_source_is_supported($row->meta_key, $row->meta_value) === null) {
1822 + continue;
1823 + }
1274 1824
1275 - // Check if Metasync schema already exists for this post
1276 - $existing_schema = get_post_meta($post_id, 'metasync_schema_markup', true);
1277 - if (!empty($existing_schema) && !empty($existing_schema['types'])) {
1278 - continue; // Skip if already has Metasync schema
1279 - }
1825 + // Extract schema type from meta key (e.g., rank_math_schema_BlogPosting -> BlogPosting)
1826 + $schema_type = str_replace('rank_math_schema_', '', $row->meta_key);
1280 1827
1281 - // Extract schema type from meta key (e.g., rank_math_schema_BlogPosting -> BlogPosting)
1282 - $schema_type = str_replace('rank_math_schema_', '', $post_obj->meta_key);
1828 + // Decode Rank Math schema
1829 + $rm_schema = maybe_unserialize($row->meta_value);
1830 + if (empty($rm_schema) || !is_array($rm_schema)) {
1831 + continue;
1832 + }
1283 1833
1284 - // Decode Rank Math schema
1285 - $rm_schema = maybe_unserialize($post_obj->meta_value);
1286 - if (empty($rm_schema) || !is_array($rm_schema)) {
1287 - continue;
1834 + // Convert Rank Math schema to Metasync format
1835 + $metasync_schema = $this->convert_rankmath_schema_to_metasync($rm_schema, $schema_type, $post_id);
1836 +
1837 + if (!empty($metasync_schema['types'])) {
1838 + update_post_meta($post_id, 'metasync_schema_markup', wp_slash(array_merge(is_array($existing_schema) ? $existing_schema : [], $metasync_schema)));
1839 + $breakdown['imported']++;
1840 + $imported = true;
1841 + break; // One schema block per post.
1842 + }
1288 1843 }
1289 1844
1290 - // Convert Rank Math schema to Metasync format
1291 - $metasync_schema = $this->convert_rankmath_schema_to_metasync($rm_schema, $schema_type, $post_id);
1292 -
1293 - if (!empty($metasync_schema['types'])) {
1294 - update_post_meta($post_id, 'metasync_schema_markup', $metasync_schema);
1295 - $imported_count++;
1296 - $processed_posts[] = $post_id; // Mark post as processed
1845 + if (!$imported) {
1846 + $breakdown['unsupported']++;
1297 1847 }
1298 1848 }
1299 1849
1300 - return $imported_count;
1850 + $breakdown['total_candidates'] = count($rows_by_post);
1851 +
1852 + return $breakdown;
1301 1853 }
1302 1854
1303 1855 /**
1304 1856 * Import per-post schema from AIOSEO
1857 + *
1858 + * `schema_type = 'default'` rows and rows whose schema options are empty
1859 + * never reach this loop — they are excluded by aioseo_schema_candidate_rows()
1860 + * for the detector and the importer alike, so the two can never disagree
1861 + * about what counts as a candidate.
1862 + *
1863 + * @return array{imported:int, already_imported:int, unsupported:int, total_candidates:int}
1305 1864 */
1306 1865 private function import_aioseo_schema()
1307 1866 {
1308 - global $wpdb;
1309 - $imported_count = 0;
1867 + $breakdown = $this->empty_schema_breakdown();
1310 1868
1311 - // Check if AIOSEO table exists
1312 - $table = $wpdb->prefix . 'aioseo_posts';
1313 - if ($wpdb->get_var("SHOW TABLES LIKE '$table'") !== $table) {
1314 - return 0;
1869 + // An absent AIOSEO table means there is nothing to import at all.
1870 + // Rows are keyed per post so the count matches check_schema_data(),
1871 + // which also counts distinct posts.
1872 + $rows_by_post = [];
1873 + foreach ($this->aioseo_schema_candidate_rows() as $aioseo_data) {
1874 + $rows_by_post[(int) $aioseo_data->post_id] = $aioseo_data;
1315 1875 }
1316 1876
1317 - // Get all posts with AIOSEO schema
1318 - $posts = $wpdb->get_results("
1319 - SELECT post_id, schema_type, schema_type_options
1320 - FROM {$table}
1321 - WHERE (schema_type IS NOT NULL AND schema_type != '')
1322 - AND post_id IN (SELECT ID FROM {$wpdb->posts} WHERE post_status = 'publish')
1323 - ");
1877 + foreach ($rows_by_post as $post_id => $aioseo_data) {
1878 + $existing_schema = get_post_meta($post_id, 'metasync_schema_markup', true);
1879 + if ($this->post_has_metasync_schema($post_id)) {
1880 + $breakdown['already_imported']++;
1881 + continue;
1882 + }
1324 1883
1325 - foreach ($posts as $aioseo_data) {
1326 - $post_id = $aioseo_data->post_id;
1327 -
1328 - // Check if Metasync schema already exists
1329 - $existing_schema = get_post_meta($post_id, 'metasync_schema_markup', true);
1330 - if (!empty($existing_schema) && !empty($existing_schema['types'])) {
1331 - continue; // Skip if already has Metasync schema
1884 + if ($this->aioseo_schema_source_is_supported($aioseo_data->schema_type, $aioseo_data->schema_type_options) === null) {
1885 + $breakdown['unsupported']++;
1886 + continue;
1332 1887 }
1333 1888
1334 1889 // Decode AIOSEO schema options
1335 1890 $schema_options = json_decode((string)($aioseo_data->schema_type_options ?? ''), true);
@@ -1344,18 +1899,28 @@
1344 1899 $post_id
1345 1900 );
1346 1901
1347 1902 if (!empty($metasync_schema['types'])) {
1348 - update_post_meta($post_id, 'metasync_schema_markup', $metasync_schema);
1349 - $imported_count++;
1903 + update_post_meta($post_id, 'metasync_schema_markup', wp_slash(array_merge(is_array($existing_schema) ? $existing_schema : [], $metasync_schema)));
1904 + $breakdown['imported']++;
1905 + } else {
1906 + $breakdown['unsupported']++;
1350 1907 }
1351 1908 }
1352 1909
1353 - return $imported_count;
1910 + $breakdown['total_candidates'] = count($rows_by_post);
1911 +
1912 + return $breakdown;
1354 1913 }
1355 1914
1356 1915 /**
1357 1916 * Convert Yoast schema to Metasync format
1917 + *
1918 + * Handles both storage shapes Yoast has used: the current `@graph`
1919 + * wrapper and the legacy root array of entries. Both are iterated through
1920 + * yoast_schema_graph_items(), which is also what the eligibility check
1921 + * walks — so a payload the detector counts is a payload the importer can
1922 + * convert.
1358 1923 */
1359 1924 private function convert_yoast_schema_to_metasync($yoast_schema, $post_id)
1360 1925 {
1361 1926 $metasync_schema = [
@@ -1362,12 +1927,14 @@
1362 1927 'enabled' => true,
1363 1928 'types' => []
1364 1929 ];
1365 1930
1366 - // Yoast stores schema as a graph array
1367 - if (isset($yoast_schema['@graph']) && is_array($yoast_schema['@graph'])) {
1368 - foreach ($yoast_schema['@graph'] as $item) {
1369 - if (!isset($item['@type'])) {
1931 + // Yoast stores schema as a graph array (legacy installs: a root array
1932 + // of entries, or a single root object, instead of an @graph wrapper).
1933 + $graph_items = $this->yoast_schema_graph_items($yoast_schema);
1934 + if ($graph_items !== []) {
1935 + foreach ($graph_items as $item) {
1936 + if (!is_array($item) || !isset($item['@type'])) {
1370 1937 continue;
1371 1938 }
1372 1939
1373 1940 $raw_type = $item['@type'];
@@ -1554,9 +2121,13 @@
1554 2121 'enabled' => true,
1555 2122 'types' => []
1556 2123 ];
1557 2124
1558 - $type = strtolower($schema_type);
2125 + // Normalise through the shared map so the article family
2126 + // (NewsArticle, BlogPosting) imports the same way the Yoast and Rank
2127 + // Math converters handle it — eligibility resolves them to 'article'
2128 + // too, and the two must agree on every type they let through.
2129 + $type = $this->supported_schema_type($schema_type);
1559 2130
1560 2131 if ($type === 'article') {
1561 2132 $metasync_schema['types'][] = [
1562 2133 'type' => 'article',
@@ -1567,9 +2138,9 @@
1567 2138 'organization_name' => isset($schema_options['organizationName']) ? $schema_options['organizationName'] : '',
1568 2139 'organization_logo' => isset($schema_options['organizationLogo']) ? $schema_options['organizationLogo'] : ''
1569 2140 ]
1570 2141 ];
1571 - } elseif ($type === 'faqpage') {
2142 + } elseif ($type === 'FAQPage') {
1572 2143 $faq_items = [];
1573 2144 if (isset($schema_options['questions']) && is_array($schema_options['questions'])) {
1574 2145 foreach ($schema_options['questions'] as $question) {
1575 2146 if (isset($question['question']) && isset($question['answer'])) {
@@ -1721,8 +2292,67 @@
1721 2292 return is_string($text) ? $text : $default;
1722 2293 }
1723 2294
1724 2295 /**
2296 + * Tokens whose value is the post's own body or excerpt.
2297 + *
2298 + * Keyed by source plugin. These are the only tokens that can carry the text
2299 + * a password withholds; everything else (title, author, dates, taxonomy) is
2300 + * already public on a protected post.
2301 + *
2302 + * @param string $plugin 'yoast', 'rankmath', or 'aioseo'.
2303 + * @return string[]
2304 + */
2305 + private function content_derived_tokens($plugin) {
2306 + switch ($plugin) {
2307 + case 'yoast':
2308 + return ['%%excerpt%%', '%%excerpt_only%%'];
2309 +
2310 + case 'rankmath':
2311 + return ['%excerpt%', '%excerpt_only%'];
2312 +
2313 + case 'aioseo':
2314 + return [
2315 + '#post_content',
2316 + '#post_excerpt',
2317 + '#post_excerpt_only',
2318 + '#attachment_description',
2319 + '#attachment_caption',
2320 + ];
2321 + }
2322 +
2323 + return [];
2324 + }
2325 +
2326 + /**
2327 + * Whether a raw template would publish text that a post password withholds.
2328 + *
2329 + * WordPress keeps a protected post's body and excerpt behind the password
2330 + * but leaves the post itself published, so an import walks straight past the
2331 + * usual visibility checks: the source plugin stores a template, we resolve it
2332 + * against the raw row, and the body ends up in a meta description that every
2333 + * visitor and crawler can read without ever entering the password.
2334 + *
2335 + * @param string $text Raw value from the source plugin.
2336 + * @param WP_Post $post Post the value belongs to.
2337 + * @param string $plugin Source plugin.
2338 + * @return bool
2339 + */
2340 + private function references_protected_content($text, $post, $plugin) {
2341 + if (empty($post->post_password)) {
2342 + return false;
2343 + }
2344 +
2345 + foreach ($this->content_derived_tokens($plugin) as $token) {
2346 + if (strpos($text, $token) !== false) {
2347 + return true;
2348 + }
2349 + }
2350 +
2351 + return false;
2352 + }
2353 +
2354 + /**
1725 2355 * Resolve SEO placeholder tokens to their actual values.
1726 2356 *
1727 2357 * Tries each source plugin's own replacement engine first so the result
1728 2358 * matches exactly what Yoast / Rank Math / AIOSEO would render. Falls back
@@ -1742,8 +2372,17 @@
1742 2372 if (!$post) {
1743 2373 return $text;
1744 2374 }
1745 2375
2376 + // Drop the whole value rather than resolve the content token to nothing
2377 + // and keep the rest. A half-template ("Title |") is worse than no import:
2378 + // it still occupies the meta key, and it still outranks whatever OTTO
2379 + // would have recommended for a page we know nothing publishable about.
2380 + // Callers skip empty values, so nothing is persisted.
2381 + if ($this->references_protected_content($text, $post, $plugin)) {
2382 + return '';
2383 + }
2384 +
1746 2385 // Yoast SEO — %%var%% tokens
1747 2386 if ($plugin === 'yoast' && class_exists('WPSEO_Replace_Vars')) {
1748 2387 try {
1749 2388 $replacer = new WPSEO_Replace_Vars();
@@ -1767,9 +2406,9 @@
1767 2406 // fall through to manual replacement
1768 2407 }
1769 2408 }
1770 2409
1771 - // All in One SEO — #var# tokens
2410 + // All in One SEO — #var tokens
1772 2411 if ($plugin === 'aioseo') {
1773 2412 try {
1774 2413 if (function_exists('aioseo') && isset(aioseo()->tags) && method_exists(aioseo()->tags, 'replaceTags')) {
1775 2414 $resolved = aioseo()->tags->replaceTags($text, $post_id);
@@ -1781,20 +2420,27 @@
1781 2420 // fall through to manual replacement
1782 2421 }
1783 2422 }
1784 2423
1785 - return $this->manually_replace_seo_placeholders($text, $post_id);
2424 + return $this->manually_replace_seo_placeholders($text, $post_id, $plugin);
1786 2425 }
1787 2426
1788 2427 /**
1789 2428 * Manual fallback: replace the most common SEO placeholder tokens from
1790 - * Yoast (%%var%%), Rank Math (%var%), and AIOSEO (#var#) formats.
2429 + * Yoast (%%var%%), Rank Math (%var%), and AIOSEO (#var) formats.
1791 2430 *
2431 + * AIOSEO tags are handled by resolve_aioseo_placeholders() because they
2432 + * need pattern matching rather than plain string replacement — see the
2433 + * docblock there.
2434 + *
1792 2435 * @param string $text Text that may contain placeholder tokens.
1793 2436 * @param int $post_id Post ID used for context.
2437 + * @param string $plugin Optional source plugin ('yoast', 'rankmath',
2438 + * 'aioseo') so the separator is read from the
2439 + * plugin the data actually came from.
1794 2440 * @return string Text with tokens replaced.
1795 2441 */
1796 - private function manually_replace_seo_placeholders($text, $post_id) {
2442 + private function manually_replace_seo_placeholders($text, $post_id, $plugin = '') {
1797 2443 $post = get_post($post_id);
1798 2444 if (!$post) {
1799 2445 return $text;
1800 2446 }
@@ -1801,9 +2447,9 @@
1801 2447
1802 2448 $site_name = get_bloginfo('name');
1803 2449 $post_title = get_the_title($post_id);
1804 2450 $post_excerpt = has_excerpt($post_id) ? wp_strip_all_tags(get_the_excerpt($post)) : '';
1805 - $author = get_the_author_meta('display_name', $post->post_author);
2451 + $author = get_the_author_meta('display_name', (int) $post->post_author);
1806 2452 $date = get_the_date('', $post_id);
1807 2453 $modified = get_the_modified_date('', $post_id);
1808 2454
1809 2455 $categories = get_the_category($post_id);
@@ -1811,30 +2457,9 @@
1811 2457
1812 2458 $tags = get_the_tags($post_id);
1813 2459 $first_tag = !empty($tags) ? $tags[0]->name : '';
1814 2460
1815 - // Try to read the separator from whichever plugin is active
1816 - $sep = '-';
1817 - if (defined('WPSEO_VERSION') && class_exists('WPSEO_Options')) {
1818 - try {
1819 - $raw = WPSEO_Options::get('separator', 'sc-dash');
1820 - // Yoast stores separator keys like 'sc-dash'; convert to glyph
1821 - // via the public get_separator_options() lookup table.
1822 - if (class_exists('WPSEO_Option_Titles')) {
1823 - $options = WPSEO_Option_Titles::get_instance()->get_separator_options();
1824 - if (isset($options[$raw])) {
1825 - $sep = html_entity_decode($options[$raw], ENT_QUOTES, 'UTF-8');
1826 - }
1827 - }
1828 - } catch (Exception $e) {
1829 - $sep = '-';
1830 - }
1831 - } elseif (defined('RANK_MATH_VERSION')) {
1832 - $rm_settings = get_option('rank_math_general_settings', []);
1833 - if (!empty($rm_settings['title_separator'])) {
1834 - $sep = html_entity_decode($rm_settings['title_separator'], ENT_QUOTES, 'UTF-8');
1835 - }
1836 - }
2461 + $sep = $this->resolve_source_separator($plugin);
1837 2462
1838 2463 $map = [
1839 2464 // ── Yoast (%%var%%) ──────────────────────────────────────────────
1840 2465 '%%title%%' => $post_title,
@@ -1865,19 +2490,8 @@
1865 2490 '%page%' => '',
1866 2491 '%category%' => $primary_category,
1867 2492 '%tag%' => $first_tag,
1868 2493 '%focus_keyword%' => (string) get_post_meta($post_id, 'rank_math_focus_keyword', true),
1869 - // ── AIOSEO (#var#) ───────────────────────────────────────────────
1870 - '#site_title#' => $site_name,
1871 - '#post_title#' => $post_title,
1872 - '#post_excerpt#' => $post_excerpt,
1873 - '#separator_sa#' => $sep,
1874 - '#author_name#' => $author,
1875 - '#current_date#' => $date,
1876 - '#post_date#' => $date,
1877 - '#category_title#' => $primary_category,
1878 - '#tag_title#' => $first_tag,
1879 - '#id#' => (string) $post_id,
1880 2494 ];
1881 2495
1882 2496 // Sort longest token first to avoid partial matches
1883 2497 // e.g. %%primary_category%% must replace before %%category%%
@@ -1884,12 +2498,1047 @@
1884 2498 uksort($map, function ($a, $b) {
1885 2499 return strlen($b) - strlen($a);
1886 2500 });
1887 2501
1888 - return str_replace(array_keys($map), array_values($map), $text);
2502 + $text = str_replace(array_keys($map), array_values($map), $text);
2503 +
2504 + // ── AIOSEO (#var) ────────────────────────────────────────────────────
2505 + // Only for AIOSEO data, or when the caller did not name a source. Yoast
2506 + // and Rank Math leave a literal '#categories' alone, so running this on
2507 + // their imports would rewrite text they would have preserved.
2508 + if ($plugin === 'aioseo' || $plugin === '') {
2509 + $text = $this->resolve_aioseo_placeholders($text, $post_id, $sep);
2510 + }
2511 +
2512 + return $text;
1889 2513 }
1890 2514
1891 2515 /**
2516 + * Resolve the title separator for the plugin the data came from.
2517 + *
2518 + * Each plugin stores its separator in its own option, so an AIOSEO import
2519 + * must not inherit Rank Math's separator just because Rank Math happens to
2520 + * still be active on the site. When the source is known we read only that
2521 + * plugin's setting and otherwise fall back to '-', which is the default
2522 + * every one of the three ships anyway.
2523 + *
2524 + * With no source named, keep the original precedence — whichever plugin is
2525 + * active, Yoast first — so callers that predate the $plugin argument see no
2526 + * behaviour change.
2527 + *
2528 + * @param string $plugin Source plugin ('yoast', 'rankmath', 'aioseo') or ''.
2529 + * @return string Separator glyph, defaulting to '-'.
2530 + */
2531 + private function resolve_source_separator($plugin = '') {
2532 + switch ($plugin) {
2533 + case 'yoast':
2534 + $sep = $this->get_yoast_separator();
2535 + return $sep !== '' ? $sep : '-';
2536 + case 'rankmath':
2537 + $sep = $this->get_rankmath_separator();
2538 + return $sep !== '' ? $sep : '-';
2539 + case 'aioseo':
2540 + $sep = $this->get_aioseo_separator();
2541 + return $sep !== '' ? $sep : '-';
2542 + }
2543 +
2544 + // Source unknown: original active-plugin precedence, including the
2545 + // class_exists() guard the old code used, so a site with WPSEO_VERSION
2546 + // defined but Yoast's classes unloaded still falls through to Rank Math
2547 + // exactly as before.
2548 + if (defined('WPSEO_VERSION') && class_exists('WPSEO_Options')) {
2549 + $sep = $this->get_yoast_separator();
2550 + return $sep !== '' ? $sep : '-';
2551 + }
2552 + if (defined('RANK_MATH_VERSION')) {
2553 + $sep = $this->get_rankmath_separator();
2554 + return $sep !== '' ? $sep : '-';
2555 + }
2556 +
2557 + return '-';
2558 + }
2559 +
2560 + /**
2561 + * Read Yoast's separator. Yoast stores separator keys like 'sc-dash';
2562 + * convert to a glyph via the public get_separator_options() lookup table.
2563 + *
2564 + * @return string Separator glyph, or '' when unavailable.
2565 + */
2566 + private function get_yoast_separator() {
2567 + if (!defined('WPSEO_VERSION') || !class_exists('WPSEO_Options') || !class_exists('WPSEO_Option_Titles')) {
2568 + return '';
2569 + }
2570 +
2571 + try {
2572 + $raw = WPSEO_Options::get('separator', 'sc-dash');
2573 + $options = WPSEO_Option_Titles::get_instance()->get_separator_options();
2574 + if (isset($options[$raw])) {
2575 + return html_entity_decode($options[$raw], ENT_QUOTES, 'UTF-8');
2576 + }
2577 + } catch (Exception $e) {
2578 + return '';
2579 + }
2580 +
2581 + return '';
2582 + }
2583 +
2584 + /**
2585 + * Read Rank Math's separator from its general settings option.
2586 + *
2587 + * @return string Separator glyph, or '' when unavailable.
2588 + */
2589 + private function get_rankmath_separator() {
2590 + if (!defined('RANK_MATH_VERSION')) {
2591 + return '';
2592 + }
2593 +
2594 + $settings = get_option('rank_math_general_settings', []);
2595 + if (is_array($settings) && !empty($settings['title_separator'])) {
2596 + return html_entity_decode($settings['title_separator'], ENT_QUOTES, 'UTF-8');
2597 + }
2598 +
2599 + return '';
2600 + }
2601 +
2602 + /**
2603 + * Read AIOSEO's separator from aioseo_options.
2604 + *
2605 + * Lives at searchAppearance.global.separator (NOT breadcrumbs.separator)
2606 + * and is stored HTML-entity encoded, e.g. '&#45;'. The option itself may
2607 + * be a JSON string or an already-decoded array depending on how it was
2608 + * written, so handle both. Read straight from the option rather than
2609 + * through aioseo() so it still works once AIOSEO is deactivated.
2610 + *
2611 + * @return string Separator glyph, or '' when unavailable.
2612 + */
2613 + private function get_aioseo_separator() {
2614 + $options = get_option('aioseo_options', '');
2615 + if (is_string($options) && $options !== '') {
2616 + $options = json_decode($options, true);
2617 + }
2618 + if (!is_array($options)) {
2619 + return '';
2620 + }
2621 +
2622 + $raw = $options['searchAppearance']['global']['separator'] ?? '';
2623 + if (!is_string($raw) || $raw === '') {
2624 + return '';
2625 + }
2626 +
2627 + return html_entity_decode($raw, ENT_QUOTES, 'UTF-8');
2628 + }
2629 +
2630 + /**
2631 + * AIOSEO's site-wide title / meta description templates, per post type.
2632 + *
2633 + * A post with no per-post override still gets a title and description from
2634 + * these — AIOSEO's own getPostDescription() falls back to the post type
2635 + * template before anything else. Reading only the per-post columns therefore
2636 + * imports nothing at all on a site that never overrode individual posts,
2637 + * which is the common case: templates are the default, overrides are the
2638 + * exception.
2639 + *
2640 + * Stored in the 'aioseo_options_dynamic' option, which may be a JSON string
2641 + * or an already-decoded array depending on how it was written — same as
2642 + * get_aioseo_separator() above, and read straight from the option so it keeps
2643 + * working once AIOSEO is deactivated.
2644 + *
2645 + * A post type is included only when AIOSEO is set to show SEO for it AND
2646 + * WordPress registers it as public. The public test is deliberately
2647 + * $obj->public rather than is_post_type_viewable(): a logging CPT registered
2648 + * public=false, publicly_queryable=true is "viewable" by that helper, and
2649 + * would drag hundreds of internal records into the import.
2650 + *
2651 + * @return array<string,array{title:string,description:string}> Keyed by post type.
2652 + */
2653 + private function get_aioseo_post_type_templates() {
2654 + $options = get_option('aioseo_options_dynamic', '');
2655 + if (is_string($options) && $options !== '') {
2656 + $options = json_decode($options, true);
2657 + }
2658 + if (!is_array($options)) {
2659 + return [];
2660 + }
2661 +
2662 + $post_types = $options['searchAppearance']['postTypes'] ?? [];
2663 + if (!is_array($post_types)) {
2664 + return [];
2665 + }
2666 +
2667 + $templates = [];
2668 +
2669 + foreach ($post_types as $post_type => $config) {
2670 + if (!is_array($config)) {
2671 + continue;
2672 + }
2673 +
2674 + // 'show' false means AIOSEO emits no SEO for the post type at all.
2675 + if (isset($config['show']) && !$config['show']) {
2676 + continue;
2677 + }
2678 +
2679 + $object = get_post_type_object($post_type);
2680 + if (!$object || empty($object->public)) {
2681 + continue;
2682 + }
2683 +
2684 + $title = isset($config['title']) && is_string($config['title']) ? $config['title'] : '';
2685 + $description = isset($config['metaDescription']) && is_string($config['metaDescription'])
2686 + ? $config['metaDescription']
2687 + : '';
2688 +
2689 + if ($title === '' && $description === '') {
2690 + continue;
2691 + }
2692 +
2693 + $templates[$post_type] = [
2694 + 'title' => $title,
2695 + 'description' => $description,
2696 + ];
2697 + }
2698 +
2699 + return $templates;
2700 + }
2701 +
2702 + /**
2703 + * Trim a template-derived meta description to a sane length.
2704 + *
2705 + * AIOSEO does not truncate — its sanitize() only collapses whitespace — so a
2706 + * post type whose template is '#post_content' renders the entire body as the
2707 + * description. Copying that verbatim into post meta would hand every page a
2708 + * multi-thousand-character description, so template-derived values are cut at
2709 + * a word boundary instead. Values the customer typed on the post itself are
2710 + * never passed through here.
2711 + *
2712 + * @param string $text Resolved description.
2713 + * @param int $limit Maximum length in characters.
2714 + * @return string Trimmed description.
2715 + */
2716 + private function truncate_meta_description($text, $limit = 160) {
2717 + $text = trim(preg_replace('/\s+/u', ' ', (string) $text));
2718 +
2719 + if ($text === '' || mb_strlen($text) <= $limit) {
2720 + return $text;
2721 + }
2722 +
2723 + // Leave room for the ellipsis so the result never exceeds $limit.
2724 + $clipped = mb_substr($text, 0, $limit - 1);
2725 +
2726 + // Cut back to the last whole word so the value never ends mid-word.
2727 + $last_space = mb_strrpos($clipped, ' ');
2728 + if ($last_space !== false && $last_space > 0) {
2729 + $clipped = mb_substr($clipped, 0, $last_space);
2730 + }
2731 +
2732 + $trimmed = rtrim($clipped, " \t\n\r\0\x0B.,;:!?-");
2733 +
2734 + // Punctuation-only input would otherwise collapse to a bare ellipsis.
2735 + return ($trimmed === '' ? $clipped : $trimmed) . '…';
2736 + }
2737 +
2738 + /**
2739 + * Every smart-tag id AIOSEO defines, taken from its own Tags class
2740 + * (all-in-one-seo-pack/app/Common/Utils/Tags.php) plus the ids the Pro
2741 + * build adds for WooCommerce.
2742 + *
2743 + * Used for detection as well as replacement: a tag missing from this list
2744 + * is neither resolved nor flagged, so it would be written to post meta as
2745 + * literal text. Restricting detection to AIOSEO's real vocabulary means
2746 + * ordinary text containing a hash — "#1 Rated Clinic", "#hashtag" — is
2747 + * never mistaken for a tag, and tokens AIOSEO does not define (#category_title,
2748 + * #tag_title) stay literal exactly as AIOSEO itself renders them.
2749 + *
2750 + * Supersets are safe in any order thanks to the negative lookahead used
2751 + * for matching: #post_date cannot consume the start of #post_date_w3c,
2752 + * nor #featured_image the start of #featured_image_url.
2753 + *
2754 + * @return string[]
2755 + */
2756 + private function get_aioseo_tag_ids() {
2757 + return [
2758 + 'alt_tag', 'archive_date', 'archive_title', 'attachment_caption',
2759 + 'attachment_description', 'author_bio', 'author_first_name',
2760 + 'author_last_name', 'author_link', 'author_link_alt', 'author_name',
2761 + 'author_url', 'blog_link', 'blog_title', 'categories', 'category',
2762 + 'category_link', 'category_link_alt', 'current_date', 'current_day',
2763 + 'current_month', 'current_year', 'custom_field', 'description',
2764 + 'event_end_date', 'event_start_date', 'featured_image',
2765 + 'featured_image_url', 'page_number', 'parent_title', 'permalink',
2766 + 'post_content', 'post_date', 'post_date_w3c', 'post_day',
2767 + 'post_excerpt', 'post_excerpt_only', 'post_link', 'post_link_alt',
2768 + 'post_modified_date', 'post_modified_date_w3c', 'post_month',
2769 + 'post_title', 'post_year', 'search_term', 'separator_sa',
2770 + 'site_description', 'site_link', 'site_link_alt', 'site_title',
2771 + 'tagline', 'tax_name', 'tax_parent_name', 'taxonomy_description',
2772 + 'taxonomy_title', 'woocommerce_brand', 'woocommerce_price',
2773 + 'woocommerce_sku',
2774 + ];
2775 + }
2776 +
2777 + /**
2778 + * Resolve AIOSEO smart tags to their values.
2779 + *
2780 + * AIOSEO denotes a tag with a single leading '#' and no closing delimiter
2781 + * (Tags::$denotationChar), ending the match with a negative lookahead so
2782 + * supersets do not collide — #post_excerpt must not consume the start of
2783 + * #post_excerpt_only, nor #post_link the start of #post_link_alt. We use
2784 + * the same rule here so results match what AIOSEO itself would render,
2785 + * and so replacement order is irrelevant.
2786 + *
2787 + * @param string $text Text that may contain AIOSEO tags.
2788 + * @param int $post_id Post ID used for context.
2789 + * @param string $sep Separator glyph for #separator_sa.
2790 + * @return string Text with AIOSEO tags replaced.
2791 + */
2792 + private function resolve_aioseo_placeholders($text, $post_id, $sep = '-') {
2793 + if (!is_string($text) || strpos($text, '#') === false) {
2794 + return (string) $text;
2795 + }
2796 +
2797 + $post = get_post($post_id);
2798 + if (!$post) {
2799 + return $text;
2800 + }
2801 +
2802 + // Tags that carry an argument have to be handled before the plain ones.
2803 + // The plain pattern's lookahead permits '-', so '#custom_field-price'
2804 + // would otherwise match bare '#custom_field' and leave an orphan
2805 + // '-price' glued to the resolved value. AIOSEO splits these out for the
2806 + // same reason (Tags::replaceTags() skips them, then parseCustomFields()
2807 + // and parseTaxonomyNames() run afterwards).
2808 + $text = $this->resolve_aioseo_parameterised_tags($text, $post_id);
2809 +
2810 + // Resolve only the tags the text actually references. Building every
2811 + // value up front meant generating an excerpt for every imported post,
2812 + // and excerpt generation runs the whole the_content filter chain — ~8x
2813 + // the cost per post on real (page-builder) content, for a value the
2814 + // template usually never mentions.
2815 + foreach ($this->get_aioseo_tag_ids() as $tag) {
2816 + $pattern = '/#' . preg_quote($tag, '/') . '(?![a-zA-Z0-9_])/i';
2817 + if (!preg_match($pattern, $text)) {
2818 + continue;
2819 + }
2820 +
2821 + $value = $this->resolve_aioseo_tag($tag, $post_id, $post, $sep);
2822 + if ($value === null) {
2823 + // Not resolvable outside AIOSEO. Leave it in place so
2824 + // has_unresolved_placeholders() can stop the write.
2825 + continue;
2826 + }
2827 +
2828 + // Escape backslashes first, then '$', so a value containing "$1"
2829 + // is not treated as a backreference by preg_replace().
2830 + $replacement = str_replace(['\\', '$'], ['\\\\', '\\$'], (string) $value);
2831 + $result = preg_replace($pattern, $replacement, $text);
2832 + if (is_string($result)) {
2833 + $text = $result;
2834 + }
2835 + }
2836 +
2837 + return $text;
2838 + }
2839 +
2840 + /**
2841 + * Resolve the two AIOSEO tags that take an argument after a hyphen:
2842 + * '#custom_field-{meta_key}' and '#tax_name-{taxonomy}'.
2843 + *
2844 + * Patterns and fallback order mirror AIOSEO's parseCustomFields() and
2845 + * parseTaxonomyNames(), including the detail that a bare '#custom_field' or
2846 + * '#tax_name' with no argument resolves to an empty string rather than
2847 + * being left in place.
2848 + *
2849 + * @param string $text Text that may contain parameterised tags.
2850 + * @param int $post_id Post ID used for context.
2851 + * @return string Text with parameterised tags replaced.
2852 + */
2853 + private function resolve_aioseo_parameterised_tags($text, $post_id) {
2854 + $text = preg_replace_callback(
2855 + '/#custom_field-([a-zA-Z0-9_-]+)/i',
2856 + function ($m) use ($post_id) {
2857 + return $this->resolve_aioseo_custom_field($m[1], $post_id);
2858 + },
2859 + $text
2860 + );
2861 +
2862 + $text = preg_replace_callback(
2863 + '/#tax_name-([a-zA-Z0-9_-]+)/i',
2864 + function ($m) use ($post_id) {
2865 + return $this->resolve_aioseo_taxonomy_name($m[1], $post_id);
2866 + },
2867 + $text
2868 + );
2869 +
2870 + // With no argument AIOSEO drops the token entirely.
2871 + $text = preg_replace('/#custom_field(?![a-zA-Z0-9_-])/i', '', (string) $text);
2872 + $text = preg_replace('/#tax_name(?![a-zA-Z0-9_-])/i', '', (string) $text);
2873 +
2874 + return (string) $text;
2875 + }
2876 +
2877 + /**
2878 + * Value of a custom field referenced by '#custom_field-{key}'.
2879 + *
2880 + * ACF is consulted first when present, matching AIOSEO's own order, so a
2881 + * field with both an ACF definition and raw post meta resolves the way the
2882 + * live site rendered it. Non-scalar values (arrays, objects) have no textual
2883 + * form and become an empty string.
2884 + *
2885 + * @param string $field_key Meta key captured from the tag.
2886 + * @param int $post_id Post ID.
2887 + * @return string Field value as text.
2888 + */
2889 + private function resolve_aioseo_custom_field($field_key, $post_id) {
2890 + $value = '';
2891 +
2892 + if (function_exists('get_field')) {
2893 + $value = get_field($field_key, $post_id);
2894 + }
2895 +
2896 + if (empty($value)) {
2897 + $value = get_post_meta($post_id, $field_key, true);
2898 + }
2899 +
2900 + return is_scalar($value) ? wp_strip_all_tags((string) $value) : '';
2901 + }
2902 +
2903 + /**
2904 + * Term name for the taxonomy referenced by '#tax_name-{taxonomy}'.
2905 + *
2906 + * AIOSEO prefers its own "primary term" for the taxonomy and falls back to
2907 + * the first assigned term. We have no primary-term store to read once
2908 + * AIOSEO is gone, so the first assigned term is used directly.
2909 + *
2910 + * @param string $taxonomy Taxonomy slug captured from the tag.
2911 + * @param int $post_id Post ID.
2912 + * @return string Term name, or '' when unavailable.
2913 + */
2914 + private function resolve_aioseo_taxonomy_name($taxonomy, $post_id) {
2915 + if (!taxonomy_exists($taxonomy)) {
2916 + return '';
2917 + }
2918 +
2919 + $terms = get_the_terms($post_id, $taxonomy);
2920 + if (empty($terms) || is_wp_error($terms)) {
2921 + return '';
2922 + }
2923 +
2924 + $term = reset($terms);
2925 +
2926 + return (string) $term->name;
2927 + }
2928 +
2929 + /**
2930 + * Value for a single AIOSEO tag in the context of one post.
2931 + *
2932 + * Every tag AIOSEO can render for a post is resolved here. The two that take
2933 + * an argument (#custom_field, #tax_name) are handled before this switch and
2934 + * so return null, which callers treat as "leave in place" — a leftover then
2935 + * gets reported and the write skipped rather than saved half-resolved.
2936 + *
2937 + * @param string $tag AIOSEO tag id, without the leading '#'.
2938 + * @param int $post_id Post ID.
2939 + * @param WP_Post $post Post object.
2940 + * @param string $sep Separator glyph.
2941 + * @return string|null Replacement value, or null if unresolvable.
2942 + */
2943 + private function resolve_aioseo_tag($tag, $post_id, $post, $sep) {
2944 + // Second line of defence behind the whole-value check in
2945 + // resolve_seo_placeholders(). Any future caller that reaches a single
2946 + // tag directly still cannot read out a protected post's body.
2947 + if (!empty($post->post_password)
2948 + && in_array('#' . $tag, $this->content_derived_tokens('aioseo'), true)) {
2949 + return '';
2950 + }
2951 +
2952 + switch ($tag) {
2953 + case 'site_title':
2954 + case 'blog_title':
2955 + return (string) get_bloginfo('name');
2956 +
2957 + case 'tagline':
2958 + case 'site_description':
2959 + return (string) get_bloginfo('description');
2960 +
2961 + case 'post_title':
2962 + return (string) get_the_title($post_id);
2963 +
2964 + case 'parent_title':
2965 + $parent = isset($post->post_parent) ? (int) $post->post_parent : 0;
2966 + return $parent ? (string) get_the_title($parent) : '';
2967 +
2968 + case 'post_excerpt_only':
2969 + // Manual excerpt only — AIOSEO never falls back for this one.
2970 + return isset($post->post_excerpt)
2971 + ? $this->strip_builder_markup((string) $post->post_excerpt)
2972 + : '';
2973 +
2974 + case 'post_excerpt':
2975 + // Manual excerpt if set, otherwise a content-derived one, which
2976 + // is what AIOSEO does. This is the expensive branch, so it only
2977 + // runs when the template actually references the tag.
2978 + $manual = isset($post->post_excerpt) ? (string) $post->post_excerpt : '';
2979 + return $this->strip_builder_markup(
2980 + $manual !== '' ? $manual : (string) get_the_excerpt($post)
2981 + );
2982 +
2983 + case 'post_content':
2984 + return $this->strip_builder_markup((string) $post->post_content);
2985 +
2986 + case 'separator_sa':
2987 + return (string) $sep;
2988 +
2989 + case 'author_name':
2990 + return (string) get_the_author_meta('display_name', (int) $post->post_author);
2991 + case 'author_first_name':
2992 + return (string) get_the_author_meta('first_name', (int) $post->post_author);
2993 + case 'author_last_name':
2994 + return (string) get_the_author_meta('last_name', (int) $post->post_author);
2995 + case 'author_bio':
2996 + return (string) get_the_author_meta('description', (int) $post->post_author);
2997 +
2998 + case 'author_link':
2999 + case 'author_link_alt':
3000 + case 'author_url':
3001 + $author = isset($post->post_author) ? (int) $post->post_author : 0;
3002 + return $author ? (string) get_author_posts_url($author) : '';
3003 +
3004 + case 'current_date':
3005 + $format = get_option('date_format');
3006 + $format = (is_string($format) && $format !== '') ? $format : 'F j, Y';
3007 + return (string) date_i18n($format);
3008 + case 'current_day':
3009 + return (string) date_i18n('d');
3010 + case 'current_month':
3011 + return (string) date_i18n('F');
3012 + case 'current_year':
3013 + return (string) date_i18n('Y');
3014 +
3015 + case 'post_date':
3016 + return (string) get_the_date('', $post_id);
3017 + case 'post_day':
3018 + return (string) get_the_date('d', $post_id);
3019 + case 'post_month':
3020 + return (string) get_the_date('F', $post_id);
3021 + case 'post_year':
3022 + return (string) get_the_date('Y', $post_id);
3023 +
3024 + case 'permalink':
3025 + case 'post_link':
3026 + case 'post_link_alt':
3027 + return (string) get_permalink($post_id);
3028 +
3029 + case 'site_link':
3030 + case 'site_link_alt':
3031 + case 'blog_link':
3032 + return (string) home_url();
3033 +
3034 + case 'categories':
3035 + $names = [];
3036 + foreach ($this->get_post_categories($post_id) as $category) {
3037 + if (isset($category->name)) {
3038 + $names[] = $category->name;
3039 + }
3040 + }
3041 + return implode(', ', $names);
3042 +
3043 + case 'category':
3044 + case 'taxonomy_title':
3045 + $categories = $this->get_post_categories($post_id);
3046 + return !empty($categories) && isset($categories[0]->name) ? (string) $categories[0]->name : '';
3047 +
3048 + case 'taxonomy_description':
3049 + $categories = $this->get_post_categories($post_id);
3050 + return !empty($categories) && isset($categories[0]->description) ? (string) $categories[0]->description : '';
3051 +
3052 + case 'category_link':
3053 + case 'category_link_alt':
3054 + $categories = $this->get_post_categories($post_id);
3055 + return !empty($categories) && isset($categories[0]->term_id)
3056 + ? (string) get_category_link($categories[0]->term_id)
3057 + : '';
3058 +
3059 + case 'featured_image':
3060 + return (string) get_the_post_thumbnail_url($post_id, 'full');
3061 +
3062 + case 'featured_image_url':
3063 + $thumbnail_id = get_post_thumbnail_id($post_id);
3064 + if (!$thumbnail_id) {
3065 + return '';
3066 + }
3067 + $src = wp_get_attachment_image_src($thumbnail_id, 'full');
3068 + return (is_array($src) && !empty($src[0])) ? (string) $src[0] : '';
3069 +
3070 + case 'alt_tag':
3071 + // AIOSEO reads the alt off the post id itself, not off the
3072 + // featured image's attachment. Mirror that: on an ordinary post
3073 + // this is empty, which is what the live site rendered.
3074 + return (string) get_post_meta($post_id, '_wp_attachment_image_alt', true);
3075 +
3076 + case 'attachment_caption':
3077 + return (string) wp_get_attachment_caption($post_id);
3078 +
3079 + case 'attachment_description':
3080 + return $this->strip_builder_markup((string) $post->post_content);
3081 +
3082 + case 'post_modified_date':
3083 + return (string) get_the_modified_date('', $post_id);
3084 +
3085 + case 'post_date_w3c':
3086 + return (string) mysql2date(DATE_W3C, $post->post_date, false);
3087 +
3088 + case 'post_modified_date_w3c':
3089 + return (string) mysql2date(DATE_W3C, $post->post_modified, false);
3090 +
3091 + case 'woocommerce_sku':
3092 + return (string) get_post_meta($post_id, '_sku', true);
3093 +
3094 + case 'woocommerce_price':
3095 + return (string) get_post_meta($post_id, '_price', true);
3096 +
3097 + // AIOSEO renders these empty in a single-post context.
3098 + case 'description':
3099 + case 'page_number':
3100 + case 'search_term':
3101 + case 'archive_date':
3102 + case 'archive_title':
3103 + // Term-context only. AIOSEO resolves #tax_parent_name off a term id,
3104 + // so it is empty for a post.
3105 + case 'tax_parent_name':
3106 + // Supplied by AIOSEO's event add-on, which has no data to read here.
3107 + case 'event_start_date':
3108 + case 'event_end_date':
3109 + case 'woocommerce_brand':
3110 + return '';
3111 + }
3112 +
3113 + // #custom_field and #tax_name take an argument and are resolved ahead of
3114 + // this switch, in resolve_aioseo_parameterised_tags().
3115 + return null;
3116 + }
3117 +
3118 + /**
3119 + * Reduce raw post content to plain prose.
3120 + *
3121 + * Page-builder pages are almost entirely shortcode markup, so a description
3122 + * template built on the content imports as '[et_pb_section][et_pb_row]…'
3123 + * without this. AIOSEO strips shortcodes too, but strip_shortcodes() only
3124 + * removes tags that are *registered* at the time it runs, and a builder
3125 + * registers its own only in the contexts it renders in — not necessarily
3126 + * during an import request. So sweep any remaining shortcode-shaped tokens
3127 + * as well, which also covers content left behind by a builder that is no
3128 + * longer installed.
3129 + *
3130 + * @param string $content Raw post content.
3131 + * @return string Plain text.
3132 + */
3133 + private function strip_builder_markup($content) {
3134 + $content = strip_shortcodes($content);
3135 +
3136 + // Opening/closing shortcode-shaped tokens: [tag], [tag a="b"], [/tag].
3137 + $content = preg_replace('/\[\/?[a-z][a-z0-9_-]*(?:\s[^\]]*)?\]/i', ' ', (string) $content);
3138 +
3139 + return trim(preg_replace('/\s+/u', ' ', wp_strip_all_tags((string) $content)));
3140 + }
3141 +
3142 + /**
3143 + * Categories for a post, normalised to an array.
3144 + *
3145 + * @param int $post_id Post ID.
3146 + * @return array
3147 + */
3148 + private function get_post_categories($post_id) {
3149 + $categories = get_the_category($post_id);
3150 + return is_array($categories) ? $categories : [];
3151 + }
3152 +
3153 + /**
3154 + * Whether a value still contains AIOSEO tags after resolution.
3155 + *
3156 + * Callers use this to skip the write instead of persisting a literal
3157 + * token such as '#post_title' as a page title. A tag that legitimately
3158 + * resolves to an empty string is gone from the text and so is not
3159 + * reported here.
3160 + *
3161 + * Only AIOSEO is checked — see the fall-through comment at the end for why
3162 + * Yoast and Rank Math are excluded.
3163 + *
3164 + * @param string $text Resolved text.
3165 + * @param string $plugin Source plugin; only 'aioseo' is checked.
3166 + * @return bool True when at least one tag survived.
3167 + */
3168 + private function has_unresolved_placeholders($text, $plugin) {
3169 + if (!is_string($text) || $text === '') {
3170 + return false;
3171 + }
3172 +
3173 + switch ($plugin) {
3174 + case 'aioseo':
3175 + if (strpos($text, '#') === false) {
3176 + return false;
3177 + }
3178 + foreach ($this->get_aioseo_tag_ids() as $tag) {
3179 + if (preg_match('/#' . preg_quote($tag, '/') . '(?![a-zA-Z0-9_])/i', $text)) {
3180 + return true;
3181 + }
3182 + }
3183 + return false;
3184 + }
3185 +
3186 + // Yoast and Rank Math deliberately fall through. Their manual fallback
3187 + // maps cover only a fraction of the variables those plugins define
3188 + // (16 of ~60 for Yoast, 12 of 49 for Rank Math), so treating a leftover
3189 + // token as a reason to skip would drop common real-world titles
3190 + // wholesale — "Best Dentist in %currentyear% %sep% %sitename%" resolves
3191 + // only partly and would import as nothing at all. Until those maps are
3192 + // filled in, their existing behaviour (save the partly-resolved value)
3193 + // is the lesser evil and is left untouched.
3194 + return false;
3195 + }
3196 +
3197 + /**
3198 + * Resolve an imported value and decide whether it is safe to persist.
3199 + *
3200 + * Returns null when a placeholder survived resolution, so the caller skips
3201 + * the write rather than saving a literal '#post_title' that would then
3202 + * render as the page title and outrank OTTO's recommendation. Skipped
3203 + * values are collected in $unresolved so the import report can surface
3204 + * them.
3205 + *
3206 + * @param string $raw Raw value from the source plugin.
3207 + * @param int $post_id Post ID used for context.
3208 + * @param string $plugin Source plugin ('yoast', 'rankmath', 'aioseo').
3209 + * @param string $meta_key Destination meta key, for the report.
3210 + * @param array $unresolved Collected failures, appended to by reference.
3211 + * @return string|null Resolved value, or null when it must be skipped.
3212 + */
3213 + private function resolve_import_value($raw, $post_id, $plugin, $meta_key, array &$unresolved) {
3214 + $resolved = $this->resolve_seo_placeholders($raw, $post_id, $plugin);
3215 +
3216 + if ($this->has_unresolved_placeholders($resolved, $plugin)) {
3217 + $unresolved[] = [
3218 + 'post_id' => (int) $post_id,
3219 + 'meta_key' => $meta_key,
3220 + 'raw' => (string) $raw,
3221 + 'resolved' => (string) $resolved,
3222 + ];
3223 +
3224 + if (defined('WP_DEBUG') && WP_DEBUG) {
3225 + error_log(sprintf( // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_error_log -- debug-gated, no secrets
3226 + 'MetaSync importer: unresolved %s placeholder for post %d (%s) — %s',
3227 + $plugin,
3228 + (int) $post_id,
3229 + $meta_key,
3230 + (string) $raw
3231 + ));
3232 + }
3233 +
3234 + return null;
3235 + }
3236 +
3237 + return $resolved;
3238 + }
3239 +
3240 + /**
3241 + * Sanitize an imported value according to what its destination key holds.
3242 + *
3243 + * Kept in one place because the post and term writers must agree: they are
3244 + * two copies of the same rule, and the pair has already had to be patched in
3245 + * lockstep once (image keys were reaching the free-text sanitizer).
3246 + *
3247 + * An image key goes through esc_url_raw(), which returns '' for anything it
3248 + * will not vouch for — a bare word, a javascript: scheme, a mangled host.
3249 + * Callers must treat that '' as "could not sanitize", not as "empty value";
3250 + * the two mean different things to an overwrite run.
3251 + *
3252 + * @param string $value Resolved value from the source plugin.
3253 + * @param string $meta_key Imported destination key.
3254 + * @return string Sanitized value, or '' if it did not survive.
3255 + */
3256 + private function sanitize_imported_value($value, $meta_key) {
3257 + if ($meta_key === Metasync_Seo_Precedence::KEY_IMPORTED_TITLE) {
3258 + return sanitize_text_field($value);
3259 + }
3260 +
3261 + if (in_array($meta_key, array(
3262 + Metasync_Seo_Precedence::KEY_IMPORTED_OG_IMAGE,
3263 + Metasync_Seo_Precedence::KEY_IMPORTED_TWITTER_IMAGE,
3264 + ), true)) {
3265 + return esc_url_raw($value);
3266 + }
3267 +
3268 + return sanitize_textarea_field($value);
3269 + }
3270 +
3271 + /**
3272 + * Persist an imported title or description on its low-priority key.
3273 + *
3274 + * Every importer routes through here so the three source plugins cannot
3275 + * drift apart on the rules that matter: imported values never land on the
3276 + * customer-override keys, a value that resolves to nothing is not written,
3277 + * and an overwrite run clears a now-stale value instead of preserving it.
3278 + *
3279 + * @param int $post_id Post being imported.
3280 + * @param string $raw Raw value from the source plugin.
3281 + * @param string $plugin 'yoast', 'rankmath', or 'aioseo'.
3282 + * @param string $meta_key Imported destination key.
3283 + * @param bool $overwrite Whether the run replaces existing values.
3284 + * @param array $unresolved Collected failures, appended to by reference.
3285 + * @param bool $truncate Trim to meta-description length first.
3286 + * @return bool Whether the post's meta changed.
3287 + */
3288 + private function store_imported_post_value($post_id, $raw, $plugin, $meta_key, $overwrite, array &$unresolved, $truncate = false) {
3289 + if ($raw === '') {
3290 + return false;
3291 + }
3292 +
3293 + $existing = get_post_meta($post_id, $meta_key, true);
3294 + if (!empty($existing) && !$overwrite) {
3295 + return false;
3296 + }
3297 +
3298 + $resolved = $this->resolve_import_value($raw, $post_id, $plugin, $meta_key, $unresolved);
3299 +
3300 + if ($resolved !== null && $truncate) {
3301 + $resolved = $this->truncate_meta_description($resolved);
3302 + }
3303 +
3304 + if ($resolved !== null && trim($resolved) !== '') {
3305 + $sanitized = $this->sanitize_imported_value($resolved, $meta_key);
3306 +
3307 + // The source gave us something, but it could not survive
3308 + // sanitization — an og:image/twitter:image URL rejected by
3309 + // esc_url_raw() is the case this guards. Writing the resulting ''
3310 + // would blank a good stored image and still report the import as a
3311 + // success. Skip instead: no write, no success, and whatever is
3312 + // already stored stays. A genuinely empty source is a different
3313 + // thing and is handled by the overwrite branch below.
3314 + if ($sanitized === '') {
3315 + return false;
3316 + }
3317 +
3318 + // update_post_meta() unslashes what it is given, so a value holding
3319 + // a backslash ("AC\DC") would be stored stripped ("ACDC"). Slash it
3320 + // here so the round trip through meta storage is lossless.
3321 + update_post_meta($post_id, $meta_key, wp_slash($sanitized));
3322 + return true;
3323 + }
3324 +
3325 + // Overwrite means "make this match the source". The source now yields
3326 + // nothing, so a value left from an earlier run is stale — clear it so
3327 + // re-importing repairs rather than preserves. Only ever touches the
3328 + // imported key, never anything the customer typed.
3329 + if ($overwrite && !empty($existing)) {
3330 + delete_post_meta($post_id, $meta_key);
3331 + return true;
3332 + }
3333 +
3334 + return false;
3335 + }
3336 +
3337 + /**
3338 + * Resolve placeholder tokens in a value imported for a taxonomy term.
3339 + *
3340 + * The post resolver cannot be reused. Every token it answers comes off a
3341 + * WP_Post, and a term has no post to answer from — asking it would either
3342 + * blank the value or, worse, resolve it against whatever post happens to
3343 + * share the term's ID. The vocabularies barely overlap anyway: a term
3344 + * template is built from the term's own name and description, so this is a
3345 + * deliberately small, separate map.
3346 + *
3347 + * @param string $text Raw value from the source plugin.
3348 + * @param WP_Term $term Term the value belongs to.
3349 + * @param string $plugin 'yoast', 'rankmath', or 'aioseo'.
3350 + * @return string Resolved string.
3351 + */
3352 + private function resolve_term_placeholders($text, $term, $plugin) {
3353 + if (empty($text) || empty($term->term_id)) {
3354 + return (string) $text;
3355 + }
3356 +
3357 + // Yoast and Rank Math both accept a term in place of a post, so their
3358 + // own engines still give the exact string the source site rendered.
3359 + if ($plugin === 'yoast' && class_exists('WPSEO_Replace_Vars')) {
3360 + try {
3361 + $replacer = new WPSEO_Replace_Vars();
3362 + $resolved = $replacer->replace($text, $term);
3363 + if (is_string($resolved) && $resolved !== '') {
3364 + return $resolved;
3365 + }
3366 + } catch (Exception $e) {
3367 + // fall through to manual replacement
3368 + }
3369 + }
3370 +
3371 + if ($plugin === 'rankmath' && function_exists('rank_math_replace_vars')) {
3372 + try {
3373 + $resolved = rank_math_replace_vars($text, $term);
3374 + if (is_string($resolved) && $resolved !== '') {
3375 + return $resolved;
3376 + }
3377 + } catch (Exception $e) {
3378 + // fall through to manual replacement
3379 + }
3380 + }
3381 +
3382 + // AIOSEO's replaceTags() takes a post ID. Handing it a term ID does not
3383 + // fail — it resolves against whatever post shares that ID and returns
3384 + // another page's title, so the native engine is deliberately skipped
3385 + // here and the manual map below is the only path for AIOSEO terms.
3386 + return $this->manually_replace_term_placeholders($text, $term, $plugin);
3387 + }
3388 +
3389 + /**
3390 + * Manual token replacement for term values.
3391 + *
3392 + * @param string $text
3393 + * @param WP_Term $term
3394 + * @param string $plugin
3395 + * @return string
3396 + */
3397 + private function manually_replace_term_placeholders($text, $term, $plugin) {
3398 + $site_name = (string) get_bloginfo('name');
3399 + $site_desc = (string) get_bloginfo('description');
3400 + $sep = $this->resolve_source_separator($plugin);
3401 + $year = (string) gmdate('Y');
3402 +
3403 + $term_name = (string) $term->name;
3404 + $term_desc = wp_strip_all_tags((string) $term->description);
3405 +
3406 + $map = [
3407 + // ── Yoast (%%var%%) ──────────────────────────────────────────────
3408 + '%%term_title%%' => $term_name,
3409 + '%%term_description%%' => $term_desc,
3410 + '%%category%%' => $term_name,
3411 + '%%category_description%%' => $term_desc,
3412 + '%%tag%%' => $term_name,
3413 + '%%sitename%%' => $site_name,
3414 + '%%sitedesc%%' => $site_desc,
3415 + '%%sep%%' => $sep,
3416 + '%%currentyear%%' => $year,
3417 + '%%page%%' => '',
3418 + '%%pagenumber%%' => '',
3419 + '%%pagetotal%%' => '',
3420 + // ── Rank Math (%var%) ────────────────────────────────────────────
3421 + '%term%' => $term_name,
3422 + '%term_description%' => $term_desc,
3423 + '%category%' => $term_name,
3424 + '%tag%' => $term_name,
3425 + '%sitename%' => $site_name,
3426 + '%sitedesc%' => $site_desc,
3427 + '%sep%' => $sep,
3428 + '%currentyear%' => $year,
3429 + '%page%' => '',
3430 + // ── AIOSEO (#var) ────────────────────────────────────────────────
3431 + '#taxonomy_title' => $term_name,
3432 + '#taxonomy_description' => $term_desc,
3433 + '#archive_title' => $term_name,
3434 + '#site_title' => $site_name,
3435 + '#blog_title' => $site_name,
3436 + '#site_description' => $site_desc,
3437 + '#tagline' => $site_desc,
3438 + '#separator_sa' => $sep,
3439 + '#current_year' => $year,
3440 + '#page_number' => '',
3441 + ];
3442 +
3443 + // Longest token first, so a short token never eats the start of a
3444 + // longer one (#site_title must not consume #site_description).
3445 + uksort($map, function ($a, $b) {
3446 + return strlen($b) - strlen($a);
3447 + });
3448 +
3449 + $resolved = str_replace(array_keys($map), array_values($map), $text);
3450 +
3451 + return trim(preg_replace('/\s+/', ' ', $resolved));
3452 + }
3453 +
3454 + /**
3455 + * Persist an imported term title or description on its low-priority key.
3456 + *
3457 + * Mirrors store_imported_post_value(): imported values never land on the
3458 + * key that means "the customer set this", a value that resolves to nothing
3459 + * is not written, and an overwrite run clears a now-stale value.
3460 + *
3461 + * @param WP_Term $term Term being imported.
3462 + * @param string $raw Raw value from the source plugin.
3463 + * @param string $plugin 'yoast', 'rankmath', or 'aioseo'.
3464 + * @param string $meta_key Imported destination key.
3465 + * @param bool $overwrite Whether the run replaces existing values.
3466 + * @return bool Whether the term's meta changed.
3467 + */
3468 + private function store_imported_term_value($term, $raw, $plugin, $meta_key, $overwrite) {
3469 + if ($raw === '') {
3470 + return false;
3471 + }
3472 +
3473 + $term_id = (int) $term->term_id;
3474 + $existing = get_term_meta($term_id, $meta_key, true);
3475 + if (!empty($existing) && !$overwrite) {
3476 + return false;
3477 + }
3478 +
3479 + $resolved = $this->resolve_term_placeholders($raw, $term, $plugin);
3480 +
3481 + // A token we do not know would otherwise be stored literally and render
3482 + // as '#taxonomy_title' on the archive — the defect this path exists to
3483 + // prevent. Skipping leaves the slot free for OTTO.
3484 + if ($this->has_unresolved_placeholders($resolved, $plugin)) {
3485 + return false;
3486 + }
3487 +
3488 + if (trim($resolved) !== '') {
3489 + $sanitized = $this->sanitize_imported_value($resolved, $meta_key);
3490 +
3491 + // See store_imported_post_value(): a value the source supplied but
3492 + // sanitization rejected must not blank an existing one, and must
3493 + // not count as a successful update.
3494 + if ($sanitized === '') {
3495 + return false;
3496 + }
3497 +
3498 + // update_term_meta() unslashes what it stores; slash first so a
3499 + // backslash in the value survives the round trip.
3500 + update_term_meta($term_id, $meta_key, wp_slash($sanitized));
3501 + return true;
3502 + }
3503 +
3504 + if ($overwrite && !empty($existing)) {
3505 + delete_term_meta($term_id, $meta_key);
3506 + return true;
3507 + }
3508 +
3509 + return false;
3510 + }
3511 +
3512 + /**
3513 + * Add unresolved-placeholder reporting to an import result.
3514 + *
3515 + * @param array $result Result array to augment.
3516 + * @param array $unresolved Failures collected during the batch.
3517 + * @return array Result with the report attached.
3518 + */
3519 + private function attach_unresolved_report(array $result, array $unresolved) {
3520 + $count = count($unresolved);
3521 + $result['unresolved'] = $count;
3522 +
3523 + if ($count === 0) {
3524 + return $result;
3525 + }
3526 +
3527 + // Keep the payload small — a few examples are enough to diagnose.
3528 + $result['unresolved_samples'] = array_slice($unresolved, 0, 5);
3529 +
3530 + if (!empty($result['message'])) {
3531 + $result['message'] .= sprintf(
3532 + ' %d value(s) skipped because placeholders could not be resolved.',
3533 + $count
3534 + );
3535 + }
3536 +
3537 + return $result;
3538 + }
3539 +
3540 + /**
1892 3541 * Import SEO Metadata (Titles and Descriptions)
1893 3542 * Supports batch processing via AJAX
1894 3543 *
1895 3544 * @param string $plugin Plugin to import from (yoast, rankmath, aioseo)
@@ -1973,22 +3622,23 @@
1973 3622 ];
1974 3623 }
1975 3624
1976 3625 // Get total count (for progress tracking)
1977 - $meta_keys_placeholders = implode(',', array_fill(0, count($meta_keys), '%s'));
1978 - $total_posts = (int) $wpdb->get_var($wpdb->prepare("
3626 + // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- one-shot import tool — bulk reads from third-party SEO plugin storage; no bulk WordPress API exists
3627 + $total_posts = (int) $wpdb->get_var($wpdb->prepare('
1979 3628 SELECT COUNT(DISTINCT post_id)
1980 - FROM {$wpdb->postmeta}
1981 - WHERE meta_key IN ($meta_keys_placeholders)
3629 + FROM ' . $wpdb->postmeta . '
3630 + WHERE meta_key IN (' . implode(',', array_fill(0, count($meta_keys), '%s')) . ")
1982 3631 AND meta_value != ''
1983 3632 AND post_id IN (SELECT ID FROM {$wpdb->posts} WHERE post_status = 'publish')
1984 3633 ", $meta_keys));
1985 3634
1986 3635 // Get batch of posts with Yoast data
1987 - $posts = $wpdb->get_results($wpdb->prepare("
3636 + // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- one-shot import tool — bulk reads from third-party SEO plugin storage; no bulk WordPress API exists
3637 + $posts = $wpdb->get_results($wpdb->prepare('
1988 3638 SELECT DISTINCT post_id
1989 - FROM {$wpdb->postmeta}
1990 - WHERE meta_key IN ($meta_keys_placeholders)
3639 + FROM ' . $wpdb->postmeta . '
3640 + WHERE meta_key IN (' . implode(',', array_fill(0, count($meta_keys), '%s')) . ")
1991 3641 AND meta_value != ''
1992 3642 AND post_id IN (SELECT ID FROM {$wpdb->posts} WHERE post_status = 'publish')
1993 3643 ORDER BY post_id ASC
1994 3644 LIMIT %d OFFSET %d
@@ -1995,8 +3645,9 @@
1995 3645 ", array_merge($meta_keys, [$batch_size, $offset])));
1996 3646
1997 3647 $imported_count = 0;
1998 3648 $skipped_count = 0;
3649 + $unresolved = [];
1999 3650
2000 3651 foreach ($posts as $post_obj) {
2001 3652 $post_id = $post_obj->post_id;
2002 3653 $updated = false;
@@ -2004,15 +3655,16 @@
2004 3655 // Import title
2005 3656 if ($import_titles) {
2006 3657 $yoast_title = get_post_meta($post_id, '_yoast_wpseo_title', true);
2007 3658 if (!empty($yoast_title)) {
2008 - $existing_title = get_post_meta($post_id, '_metasync_seo_title', true);
2009 -
2010 - if (empty($existing_title) || $overwrite) {
2011 - $yoast_title = $this->resolve_seo_placeholders($yoast_title, $post_id, 'yoast');
2012 - update_post_meta($post_id, '_metasync_seo_title', sanitize_text_field($yoast_title));
2013 - $updated = true;
2014 - }
3659 + $updated = $this->store_imported_post_value(
3660 + $post_id,
3661 + (string) $yoast_title,
3662 + 'yoast',
3663 + Metasync_Seo_Precedence::KEY_IMPORTED_TITLE,
3664 + $overwrite,
3665 + $unresolved
3666 + );
2015 3667 }
2016 3668 }
2017 3669
2018 3670 // Import description
@@ -2018,15 +3670,16 @@
2018 3670 // Import description
2019 3671 if ($import_descriptions) {
2020 3672 $yoast_desc = get_post_meta($post_id, '_yoast_wpseo_metadesc', true);
2021 3673 if (!empty($yoast_desc)) {
2022 - $existing_desc = get_post_meta($post_id, '_metasync_seo_desc', true);
2023 -
2024 - if (empty($existing_desc) || $overwrite) {
2025 - $yoast_desc = $this->resolve_seo_placeholders($yoast_desc, $post_id, 'yoast');
2026 - update_post_meta($post_id, '_metasync_seo_desc', sanitize_textarea_field($yoast_desc));
2027 - $updated = true;
2028 - }
3674 + $updated = $this->store_imported_post_value(
3675 + $post_id,
3676 + (string) $yoast_desc,
3677 + 'yoast',
3678 + Metasync_Seo_Precedence::KEY_IMPORTED_DESC,
3679 + $overwrite,
3680 + $unresolved
3681 + ) || $updated;
2029 3682 }
2030 3683 }
2031 3684
2032 3685 // Import social text
@@ -2032,44 +3685,52 @@
2032 3685 // Import social text
2033 3686 if ($import_social_text) {
2034 3687 $yoast_og_title = get_post_meta($post_id, '_yoast_wpseo_opengraph-title', true);
2035 3688 if (!empty($yoast_og_title)) {
2036 - $existing = get_post_meta($post_id, '_metasync_og_title', true);
2037 - if (empty($existing) || $overwrite) {
2038 - $yoast_og_title = $this->resolve_seo_placeholders($yoast_og_title, $post_id, 'yoast');
2039 - update_post_meta($post_id, '_metasync_og_title', sanitize_text_field($yoast_og_title));
2040 - $updated = true;
2041 - }
3689 + $updated = $this->store_imported_post_value(
3690 + $post_id,
3691 + (string) $yoast_og_title,
3692 + 'yoast',
3693 + Metasync_Seo_Precedence::KEY_IMPORTED_OG_TITLE,
3694 + $overwrite,
3695 + $unresolved
3696 + ) || $updated;
2042 3697 }
2043 3698
2044 3699 $yoast_og_desc = get_post_meta($post_id, '_yoast_wpseo_opengraph-description', true);
2045 3700 if (!empty($yoast_og_desc)) {
2046 - $existing = get_post_meta($post_id, '_metasync_og_description', true);
2047 - if (empty($existing) || $overwrite) {
2048 - $yoast_og_desc = $this->resolve_seo_placeholders($yoast_og_desc, $post_id, 'yoast');
2049 - update_post_meta($post_id, '_metasync_og_description', sanitize_textarea_field($yoast_og_desc));
2050 - $updated = true;
2051 - }
3701 + $updated = $this->store_imported_post_value(
3702 + $post_id,
3703 + (string) $yoast_og_desc,
3704 + 'yoast',
3705 + Metasync_Seo_Precedence::KEY_IMPORTED_OG_DESC,
3706 + $overwrite,
3707 + $unresolved
3708 + ) || $updated;
2052 3709 }
2053 3710
2054 3711 $yoast_tw_title = get_post_meta($post_id, '_yoast_wpseo_twitter-title', true);
2055 3712 if (!empty($yoast_tw_title)) {
2056 - $existing = get_post_meta($post_id, '_metasync_twitter_title', true);
2057 - if (empty($existing) || $overwrite) {
2058 - $yoast_tw_title = $this->resolve_seo_placeholders($yoast_tw_title, $post_id, 'yoast');
2059 - update_post_meta($post_id, '_metasync_twitter_title', sanitize_text_field($yoast_tw_title));
2060 - $updated = true;
2061 - }
3713 + $updated = $this->store_imported_post_value(
3714 + $post_id,
3715 + (string) $yoast_tw_title,
3716 + 'yoast',
3717 + Metasync_Seo_Precedence::KEY_IMPORTED_TWITTER_TITLE,
3718 + $overwrite,
3719 + $unresolved
3720 + ) || $updated;
2062 3721 }
2063 3722
2064 3723 $yoast_tw_desc = get_post_meta($post_id, '_yoast_wpseo_twitter-description', true);
2065 3724 if (!empty($yoast_tw_desc)) {
2066 - $existing = get_post_meta($post_id, '_metasync_twitter_description', true);
2067 - if (empty($existing) || $overwrite) {
2068 - $yoast_tw_desc = $this->resolve_seo_placeholders($yoast_tw_desc, $post_id, 'yoast');
2069 - update_post_meta($post_id, '_metasync_twitter_description', sanitize_textarea_field($yoast_tw_desc));
2070 - $updated = true;
2071 - }
3725 + $updated = $this->store_imported_post_value(
3726 + $post_id,
3727 + (string) $yoast_tw_desc,
3728 + 'yoast',
3729 + Metasync_Seo_Precedence::KEY_IMPORTED_TWITTER_DESC,
3730 + $overwrite,
3731 + $unresolved
3732 + ) || $updated;
2072 3733 }
2073 3734 }
2074 3735
2075 3736 // Import social images
@@ -2075,22 +3736,28 @@
2075 3736 // Import social images
2076 3737 if ($import_social_images) {
2077 3738 $yoast_og_image = get_post_meta($post_id, '_yoast_wpseo_opengraph-image', true);
2078 3739 if (!empty($yoast_og_image)) {
2079 - $existing_og = get_post_meta($post_id, '_metasync_og_image', true);
2080 - if (empty($existing_og) || $overwrite) {
2081 - update_post_meta($post_id, '_metasync_og_image', esc_url_raw($yoast_og_image));
2082 - $updated = true;
2083 - }
3740 + $updated = $this->store_imported_post_value(
3741 + $post_id,
3742 + (string) $yoast_og_image,
3743 + 'yoast',
3744 + Metasync_Seo_Precedence::KEY_IMPORTED_OG_IMAGE,
3745 + $overwrite,
3746 + $unresolved
3747 + ) || $updated;
2084 3748 }
2085 3749
2086 3750 $yoast_twitter_image = get_post_meta($post_id, '_yoast_wpseo_twitter-image', true);
2087 3751 if (!empty($yoast_twitter_image)) {
2088 - $existing_twitter = get_post_meta($post_id, '_metasync_twitter_image', true);
2089 - if (empty($existing_twitter) || $overwrite) {
2090 - update_post_meta($post_id, '_metasync_twitter_image', esc_url_raw($yoast_twitter_image));
2091 - $updated = true;
2092 - }
3752 + $updated = $this->store_imported_post_value(
3753 + $post_id,
3754 + (string) $yoast_twitter_image,
3755 + 'yoast',
3756 + Metasync_Seo_Precedence::KEY_IMPORTED_TWITTER_IMAGE,
3757 + $overwrite,
3758 + $unresolved
3759 + ) || $updated;
2093 3760 }
2094 3761 }
2095 3762
2096 3763 if ($updated) {
@@ -2102,9 +3769,9 @@
2102 3769
2103 3770 $processed = $offset + count($posts);
2104 3771 $is_complete = $processed >= $total_posts;
2105 3772
2106 - return [
3773 + return $this->attach_unresolved_report([
2107 3774 'success' => true,
2108 3775 'imported' => $imported_count,
2109 3776 'skipped' => $skipped_count,
2110 3777 'total' => $total_posts,
@@ -2113,9 +3780,9 @@
2113 3780 'progress_percent' => $total_posts > 0 ? round(($processed / $total_posts) * 100) : 100,
2114 3781 'message' => $is_complete
2115 3782 ? "Import complete! Imported {$imported_count} posts, skipped {$skipped_count} posts."
2116 3783 : "Processing... {$imported_count} imported, {$skipped_count} skipped."
2117 - ];
3784 + ], $unresolved);
2118 3785 }
2119 3786
2120 3787 /**
2121 3788 * Import SEO metadata from Rank Math
@@ -2158,22 +3825,23 @@
2158 3825 ];
2159 3826 }
2160 3827
2161 3828 // Get total count
2162 - $meta_keys_placeholders = implode(',', array_fill(0, count($meta_keys), '%s'));
2163 - $total_posts = (int) $wpdb->get_var($wpdb->prepare("
3829 + // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- one-shot import tool — bulk reads from third-party SEO plugin storage; no bulk WordPress API exists
3830 + $total_posts = (int) $wpdb->get_var($wpdb->prepare('
2164 3831 SELECT COUNT(DISTINCT post_id)
2165 - FROM {$wpdb->postmeta}
2166 - WHERE meta_key IN ($meta_keys_placeholders)
3832 + FROM ' . $wpdb->postmeta . '
3833 + WHERE meta_key IN (' . implode(',', array_fill(0, count($meta_keys), '%s')) . ")
2167 3834 AND meta_value != ''
2168 3835 AND post_id IN (SELECT ID FROM {$wpdb->posts} WHERE post_status = 'publish')
2169 3836 ", $meta_keys));
2170 3837
2171 3838 // Get batch of posts
2172 - $posts = $wpdb->get_results($wpdb->prepare("
3839 + // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- one-shot import tool — bulk reads from third-party SEO plugin storage; no bulk WordPress API exists
3840 + $posts = $wpdb->get_results($wpdb->prepare('
2173 3841 SELECT DISTINCT post_id
2174 - FROM {$wpdb->postmeta}
2175 - WHERE meta_key IN ($meta_keys_placeholders)
3842 + FROM ' . $wpdb->postmeta . '
3843 + WHERE meta_key IN (' . implode(',', array_fill(0, count($meta_keys), '%s')) . ")
2176 3844 AND meta_value != ''
2177 3845 AND post_id IN (SELECT ID FROM {$wpdb->posts} WHERE post_status = 'publish')
2178 3846 ORDER BY post_id ASC
2179 3847 LIMIT %d OFFSET %d
@@ -2180,8 +3848,9 @@
2180 3848 ", array_merge($meta_keys, [$batch_size, $offset])));
2181 3849
2182 3850 $imported_count = 0;
2183 3851 $skipped_count = 0;
3852 + $unresolved = [];
2184 3853
2185 3854 foreach ($posts as $post_obj) {
2186 3855 $post_id = $post_obj->post_id;
2187 3856 $updated = false;
@@ -2189,15 +3858,16 @@
2189 3858 // Import title
2190 3859 if ($import_titles) {
2191 3860 $rm_title = get_post_meta($post_id, 'rank_math_title', true);
2192 3861 if (!empty($rm_title)) {
2193 - $existing_title = get_post_meta($post_id, '_metasync_seo_title', true);
2194 -
2195 - if (empty($existing_title) || $overwrite) {
2196 - $rm_title = $this->resolve_seo_placeholders($rm_title, $post_id, 'rankmath');
2197 - update_post_meta($post_id, '_metasync_seo_title', sanitize_text_field($rm_title));
2198 - $updated = true;
2199 - }
3862 + $updated = $this->store_imported_post_value(
3863 + $post_id,
3864 + (string) $rm_title,
3865 + 'rankmath',
3866 + Metasync_Seo_Precedence::KEY_IMPORTED_TITLE,
3867 + $overwrite,
3868 + $unresolved
3869 + );
2200 3870 }
2201 3871 }
2202 3872
2203 3873 // Import description
@@ -2203,15 +3873,16 @@
2203 3873 // Import description
2204 3874 if ($import_descriptions) {
2205 3875 $rm_desc = get_post_meta($post_id, 'rank_math_description', true);
2206 3876 if (!empty($rm_desc)) {
2207 - $existing_desc = get_post_meta($post_id, '_metasync_seo_desc', true);
2208 -
2209 - if (empty($existing_desc) || $overwrite) {
2210 - $rm_desc = $this->resolve_seo_placeholders($rm_desc, $post_id, 'rankmath');
2211 - update_post_meta($post_id, '_metasync_seo_desc', sanitize_textarea_field($rm_desc));
2212 - $updated = true;
2213 - }
3877 + $updated = $this->store_imported_post_value(
3878 + $post_id,
3879 + (string) $rm_desc,
3880 + 'rankmath',
3881 + Metasync_Seo_Precedence::KEY_IMPORTED_DESC,
3882 + $overwrite,
3883 + $unresolved
3884 + ) || $updated;
2214 3885 }
2215 3886 }
2216 3887
2217 3888 // Import social text
@@ -2217,44 +3888,52 @@
2217 3888 // Import social text
2218 3889 if ($import_social_text) {
2219 3890 $rm_og_title = get_post_meta($post_id, 'rank_math_facebook_title', true);
2220 3891 if (!empty($rm_og_title)) {
2221 - $existing = get_post_meta($post_id, '_metasync_og_title', true);
2222 - if (empty($existing) || $overwrite) {
2223 - $rm_og_title = $this->resolve_seo_placeholders($rm_og_title, $post_id, 'rankmath');
2224 - update_post_meta($post_id, '_metasync_og_title', sanitize_text_field($rm_og_title));
2225 - $updated = true;
2226 - }
3892 + $updated = $this->store_imported_post_value(
3893 + $post_id,
3894 + (string) $rm_og_title,
3895 + 'rankmath',
3896 + Metasync_Seo_Precedence::KEY_IMPORTED_OG_TITLE,
3897 + $overwrite,
3898 + $unresolved
3899 + ) || $updated;
2227 3900 }
2228 3901
2229 3902 $rm_og_desc = get_post_meta($post_id, 'rank_math_facebook_description', true);
2230 3903 if (!empty($rm_og_desc)) {
2231 - $existing = get_post_meta($post_id, '_metasync_og_description', true);
2232 - if (empty($existing) || $overwrite) {
2233 - $rm_og_desc = $this->resolve_seo_placeholders($rm_og_desc, $post_id, 'rankmath');
2234 - update_post_meta($post_id, '_metasync_og_description', sanitize_textarea_field($rm_og_desc));
2235 - $updated = true;
2236 - }
3904 + $updated = $this->store_imported_post_value(
3905 + $post_id,
3906 + (string) $rm_og_desc,
3907 + 'rankmath',
3908 + Metasync_Seo_Precedence::KEY_IMPORTED_OG_DESC,
3909 + $overwrite,
3910 + $unresolved
3911 + ) || $updated;
2237 3912 }
2238 3913
2239 3914 $rm_tw_title = get_post_meta($post_id, 'rank_math_twitter_title', true);
2240 3915 if (!empty($rm_tw_title)) {
2241 - $existing = get_post_meta($post_id, '_metasync_twitter_title', true);
2242 - if (empty($existing) || $overwrite) {
2243 - $rm_tw_title = $this->resolve_seo_placeholders($rm_tw_title, $post_id, 'rankmath');
2244 - update_post_meta($post_id, '_metasync_twitter_title', sanitize_text_field($rm_tw_title));
2245 - $updated = true;
2246 - }
3916 + $updated = $this->store_imported_post_value(
3917 + $post_id,
3918 + (string) $rm_tw_title,
3919 + 'rankmath',
3920 + Metasync_Seo_Precedence::KEY_IMPORTED_TWITTER_TITLE,
3921 + $overwrite,
3922 + $unresolved
3923 + ) || $updated;
2247 3924 }
2248 3925
2249 3926 $rm_tw_desc = get_post_meta($post_id, 'rank_math_twitter_description', true);
2250 3927 if (!empty($rm_tw_desc)) {
2251 - $existing = get_post_meta($post_id, '_metasync_twitter_description', true);
2252 - if (empty($existing) || $overwrite) {
2253 - $rm_tw_desc = $this->resolve_seo_placeholders($rm_tw_desc, $post_id, 'rankmath');
2254 - update_post_meta($post_id, '_metasync_twitter_description', sanitize_textarea_field($rm_tw_desc));
2255 - $updated = true;
2256 - }
3928 + $updated = $this->store_imported_post_value(
3929 + $post_id,
3930 + (string) $rm_tw_desc,
3931 + 'rankmath',
3932 + Metasync_Seo_Precedence::KEY_IMPORTED_TWITTER_DESC,
3933 + $overwrite,
3934 + $unresolved
3935 + ) || $updated;
2257 3936 }
2258 3937 }
2259 3938
2260 3939 // Import social images
@@ -2260,22 +3939,28 @@
2260 3939 // Import social images
2261 3940 if ($import_social_images) {
2262 3941 $rm_og_image = get_post_meta($post_id, 'rank_math_facebook_image', true);
2263 3942 if (!empty($rm_og_image)) {
2264 - $existing_og = get_post_meta($post_id, '_metasync_og_image', true);
2265 - if (empty($existing_og) || $overwrite) {
2266 - update_post_meta($post_id, '_metasync_og_image', esc_url_raw($rm_og_image));
2267 - $updated = true;
2268 - }
3943 + $updated = $this->store_imported_post_value(
3944 + $post_id,
3945 + (string) $rm_og_image,
3946 + 'rankmath',
3947 + Metasync_Seo_Precedence::KEY_IMPORTED_OG_IMAGE,
3948 + $overwrite,
3949 + $unresolved
3950 + ) || $updated;
2269 3951 }
2270 3952
2271 3953 $rm_twitter_image = get_post_meta($post_id, 'rank_math_twitter_image', true);
2272 3954 if (!empty($rm_twitter_image)) {
2273 - $existing_twitter = get_post_meta($post_id, '_metasync_twitter_image', true);
2274 - if (empty($existing_twitter) || $overwrite) {
2275 - update_post_meta($post_id, '_metasync_twitter_image', esc_url_raw($rm_twitter_image));
2276 - $updated = true;
2277 - }
3955 + $updated = $this->store_imported_post_value(
3956 + $post_id,
3957 + (string) $rm_twitter_image,
3958 + 'rankmath',
3959 + Metasync_Seo_Precedence::KEY_IMPORTED_TWITTER_IMAGE,
3960 + $overwrite,
3961 + $unresolved
3962 + ) || $updated;
2278 3963 }
2279 3964 }
2280 3965
2281 3966 if ($updated) {
@@ -2287,9 +3972,9 @@
2287 3972
2288 3973 $processed = $offset + count($posts);
2289 3974 $is_complete = $processed >= $total_posts;
2290 3975
2291 - return [
3976 + return $this->attach_unresolved_report([
2292 3977 'success' => true,
2293 3978 'imported' => $imported_count,
2294 3979 'skipped' => $skipped_count,
2295 3980 'total' => $total_posts,
@@ -2298,9 +3983,9 @@
2298 3983 'progress_percent' => $total_posts > 0 ? round(($processed / $total_posts) * 100) : 100,
2299 3984 'message' => $is_complete
2300 3985 ? "Import complete! Imported {$imported_count} posts, skipped {$skipped_count} posts."
2301 3986 : "Processing... {$imported_count} imported, {$skipped_count} skipped."
2302 - ];
3987 + ], $unresolved);
2303 3988 }
2304 3989
2305 3990 /**
2306 3991 * Import SEO metadata from All in One SEO
@@ -2318,9 +4003,9 @@
2318 4003 $overwrite = (bool) $options['overwrite_existing'];
2319 4004
2320 4005 // Check if AIOSEO table exists
2321 4006 $table = $wpdb->prefix . 'aioseo_posts';
2322 - if ($wpdb->get_var("SHOW TABLES LIKE '$table'") !== $table) {
4007 + if ($wpdb->get_var($wpdb->prepare('SHOW TABLES LIKE %s', $wpdb->esc_like($table))) !== $table) { // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- one-shot import tool — bulk reads from third-party SEO plugin storage; no bulk WordPress API exists
2323 4008 return [
2324 4009 'success' => false,
2325 4010 'message' => 'AIOSEO database table not found.'
2326 4011 ];
@@ -2332,93 +4017,209 @@
2332 4017 'message' => 'No import options selected.'
2333 4018 ];
2334 4019 }
2335 4020
2336 - // Build WHERE clause
2337 - $where_conditions = [];
4021 + // Columns read off the AIOSEO row, excluding post_id. The same list gates
4022 + // row selection, so deriving both from one array keeps them in step — a
4023 + // WHERE that admitted a column the SELECT did not fetch would read a
4024 + // property that isn't there.
4025 + $value_columns = [];
2338 4026 if ($import_titles) {
2339 - $where_conditions[] = '(title IS NOT NULL AND title != \'\')';
4027 + $value_columns[] = 'title';
2340 4028 }
2341 4029 if ($import_descriptions) {
2342 - $where_conditions[] = '(description IS NOT NULL AND description != \'\')';
4030 + $value_columns[] = 'description';
2343 4031 }
2344 4032 if ($import_social_text) {
2345 - $where_conditions[] = '(og_title IS NOT NULL AND og_title != \'\')';
2346 - $where_conditions[] = '(og_description IS NOT NULL AND og_description != \'\')';
2347 - $where_conditions[] = '(twitter_title IS NOT NULL AND twitter_title != \'\')';
2348 - $where_conditions[] = '(twitter_description IS NOT NULL AND twitter_description != \'\')';
4033 + $value_columns[] = 'og_title';
4034 + $value_columns[] = 'og_description';
4035 + $value_columns[] = 'twitter_title';
4036 + $value_columns[] = 'twitter_description';
2349 4037 }
2350 4038 if ($import_social_images) {
2351 - $where_conditions[] = '(og_image_custom_url IS NOT NULL AND og_image_custom_url != \'\')';
2352 - $where_conditions[] = '(twitter_image_custom_url IS NOT NULL AND twitter_image_custom_url != \'\')';
4039 + $value_columns[] = 'og_image_custom_url';
4040 + $value_columns[] = 'twitter_image_custom_url';
2353 4041 }
2354 - $where_clause = implode(' OR ', $where_conditions);
2355 4042
2356 - // Build SELECT columns
2357 - $select_columns = ['post_id'];
2358 - if ($import_titles) {
2359 - $select_columns[] = 'title';
4043 + $build_has_value_clause = function ($prefix) use ($value_columns) {
4044 + $conditions = [];
4045 + foreach ($value_columns as $column) {
4046 + $col = $prefix . $column;
4047 + $conditions[] = "({$col} IS NOT NULL AND {$col} != '')";
4048 + }
4049 + return implode(' OR ', $conditions);
4050 + };
4051 +
4052 + $where_clause = $build_has_value_clause('');
4053 + $joined_has_value = $build_has_value_clause('a.');
4054 +
4055 + // AIOSEO serves a title and description for every post through its
4056 + // site-wide templates, not only for posts carrying a per-post override.
4057 + // Walking the AIOSEO table alone therefore reaches almost nothing on a
4058 + // typical site — overrides are the exception, templates are the rule. So
4059 + // when templates are in play, anchor the walk on the posts table and join
4060 + // the AIOSEO row in; the per-post value still wins wherever it exists.
4061 + $templates = ($import_titles || $import_descriptions)
4062 + ? $this->get_aioseo_post_type_templates()
4063 + : [];
4064 +
4065 + $template_post_types = [];
4066 + foreach ($templates as $post_type => $template) {
4067 + if (($import_titles && $template['title'] !== '')
4068 + || ($import_descriptions && $template['description'] !== '')) {
4069 + $template_post_types[] = $post_type;
4070 + }
2360 4071 }
2361 - if ($import_descriptions) {
2362 - $select_columns[] = 'description';
2363 - }
2364 - if ($import_social_text) {
2365 - $select_columns[] = 'og_title';
2366 - $select_columns[] = 'og_description';
2367 - $select_columns[] = 'twitter_title';
2368 - $select_columns[] = 'twitter_description';
2369 - }
2370 - if ($import_social_images) {
2371 - $select_columns[] = 'og_image_custom_url';
2372 - $select_columns[] = 'twitter_image_custom_url';
2373 - }
2374 - $select_clause = implode(', ', $select_columns);
2375 4072
2376 - // Get total count
2377 - $total_posts = (int) $wpdb->get_var("
2378 - SELECT COUNT(post_id)
2379 - FROM {$table}
2380 - WHERE ({$where_clause})
2381 - AND post_id IN (SELECT ID FROM {$wpdb->posts} WHERE post_status = 'publish')
2382 - ");
4073 + if (!empty($template_post_types)) {
4074 + $type_placeholders = implode(', ', array_fill(0, count($template_post_types), '%s'));
2383 4075
2384 - // Get batch of posts
2385 - $posts = $wpdb->get_results($wpdb->prepare("
2386 - SELECT {$select_clause}
2387 - FROM {$table}
2388 - WHERE ({$where_clause})
2389 - AND post_id IN (SELECT ID FROM {$wpdb->posts} WHERE post_status = 'publish')
2390 - ORDER BY post_id ASC
2391 - LIMIT %d OFFSET %d
2392 - ", $batch_size, $offset));
4076 + // Template mode visits every published post, not just the few with an
4077 + // override, and AIOSEO's default description template is #post_excerpt
4078 + // — which on a post without a manual excerpt runs the whole the_content
4079 + // filter chain. On page-builder content that is a large fraction of a
4080 + // second each, so the caller's batch of 50 can outlive a proxy read
4081 + // timeout. Smaller batches cost more requests and finish.
4082 + $batch_size = min($batch_size, 20);
2393 4083
4084 + // COUNT and SELECT must describe the identical row set. is_complete
4085 + // compares (offset + rows returned) against this count and the client
4086 + // loops until they meet, with no iteration cap — a count broader than
4087 + // the select spins forever, a narrower one stops early and silently
4088 + // drops the remainder. Counting the joined set rather than the posts
4089 + // table alone also keeps cardinality identical if the AIOSEO table
4090 + // ever held two rows for one post: its post_id index is not unique.
4091 + //
4092 + // The post-type list governs which posts get a *template*, so it must
4093 + // not also decide which posts get read at all: a post type with no
4094 + // template — one AIOSEO never configured, one with SEO switched off,
4095 + // one registered non-public — can still carry per-post overrides that
4096 + // the override-only walk always imported. The second arm keeps every
4097 + // row holding real AIOSEO data in scope whatever its post type, so
4098 + // adding a template never removes anything from the import.
4099 + // $joined_has_value is built only from the fixed $value_columns
4100 + // allowlist above; table names are inline literals.
4101 + $from_clause = "FROM {$wpdb->posts} p
4102 + LEFT JOIN {$wpdb->prefix}aioseo_posts a ON a.post_id = p.ID
4103 + WHERE p.post_status = 'publish'
4104 + AND (p.post_type IN (" . implode(', ', array_fill(0, count($template_post_types), '%s')) . ") OR ({$joined_has_value}))";
4105 +
4106 + // Assembled from the literal fragments above; post types bind via prepare().
4107 + $count_query = "SELECT COUNT(*) {$from_clause}";
4108 + $total_posts = (int) $wpdb->get_var($wpdb->prepare($count_query, $template_post_types)); // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.DirectDatabaseQuery -- fragments built from fixed allowlists, values bound via prepare()
4109 +
4110 + $joined_columns = array_map(
4111 + function ($column) {
4112 + return "a.{$column}";
4113 + },
4114 + $value_columns
4115 + );
4116 + // At least one import flag is set — the "no import options selected"
4117 + // guard above returns before this point — so there is always at
4118 + // least one value column to select.
4119 + $joined_select = 'p.ID AS post_id, p.post_type AS post_type, '
4120 + . implode(', ', $joined_columns);
4121 +
4122 + // Assembled from the literal fragments above; post types bind via prepare().
4123 + $posts_query = "SELECT {$joined_select}
4124 + {$from_clause}
4125 + ORDER BY p.ID ASC
4126 + LIMIT %d OFFSET %d";
4127 + $posts = $wpdb->get_results($wpdb->prepare($posts_query, array_merge($template_post_types, [$batch_size, $offset]))); // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.DirectDatabaseQuery -- fragments built from fixed allowlists, values bound via prepare()
4128 + } else {
4129 + // No usable templates — e.g. only the social options are selected, or
4130 + // aioseo_options_dynamic is missing. Fall back to the original
4131 + // override-only walk so those sites behave exactly as before.
4132 + $select_clause = implode(', ', array_merge(['post_id'], $value_columns));
4133 +
4134 + // $where_clause / $select_clause are built only from the fixed
4135 + // $value_columns allowlist above.
4136 + // phpcs:disable WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- $where_clause is built only from the fixed $value_columns allowlist above
4137 + // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- one-shot import tool — bulk reads from third-party SEO plugin storage; no bulk WordPress API exists
4138 + $total_posts = (int) $wpdb->get_var("
4139 + SELECT COUNT(post_id)
4140 + FROM {$wpdb->prefix}aioseo_posts
4141 + WHERE ({$where_clause})
4142 + AND post_id IN (SELECT ID FROM {$wpdb->posts} WHERE post_status = 'publish')
4143 + ");
4144 + // phpcs:enable WordPress.DB.PreparedSQL.InterpolatedNotPrepared
4145 +
4146 + // phpcs:disable WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- $select_clause / $where_clause are built only from the fixed $value_columns allowlist above
4147 + // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- one-shot import tool — bulk reads from third-party SEO plugin storage; no bulk WordPress API exists
4148 + $posts = $wpdb->get_results($wpdb->prepare("
4149 + SELECT {$select_clause}
4150 + FROM {$wpdb->prefix}aioseo_posts
4151 + WHERE ({$where_clause})
4152 + AND post_id IN (SELECT ID FROM {$wpdb->posts} WHERE post_status = 'publish')
4153 + ORDER BY post_id ASC
4154 + LIMIT %d OFFSET %d
4155 + ", $batch_size, $offset));
4156 + // phpcs:enable WordPress.DB.PreparedSQL.InterpolatedNotPrepared
4157 + }
4158 +
2394 4159 $imported_count = 0;
2395 4160 $skipped_count = 0;
4161 + $unresolved = [];
2396 4162
2397 4163 foreach ($posts as $aioseo_data) {
2398 4164 $post_id = $aioseo_data->post_id;
2399 4165 $updated = false;
2400 4166
2401 - // Import title
2402 - if ($import_titles && !empty($aioseo_data->title)) {
2403 - $existing_title = get_post_meta($post_id, '_metasync_seo_title', true);
4167 + // Present only on the template-anchored query; the fallback walk has
4168 + // no join to read it from.
4169 + $post_type = isset($aioseo_data->post_type)
4170 + ? (string) $aioseo_data->post_type
4171 + : (string) get_post_type($post_id);
2404 4172
2405 - if (empty($existing_title) || $overwrite) {
2406 - $aioseo_title = $this->resolve_seo_placeholders($aioseo_data->title, $post_id, 'aioseo');
2407 - update_post_meta($post_id, '_metasync_seo_title', sanitize_text_field($aioseo_title));
2408 - $updated = true;
4173 + $title_template = $templates[$post_type]['title'] ?? '';
4174 + $desc_template = $templates[$post_type]['description'] ?? '';
4175 +
4176 + // Import title.
4177 + //
4178 + // The per-post value wins; the site-wide template is the fallback,
4179 + // matching the order AIOSEO itself resolves in. Destination and
4180 + // write rules come from store_imported_post_value().
4181 + if ($import_titles) {
4182 + $raw_title = !empty($aioseo_data->title) ? (string) $aioseo_data->title : '';
4183 +
4184 + if ($raw_title === '' && $title_template !== '') {
4185 + $raw_title = $title_template;
2409 4186 }
4187 +
4188 + $updated = $this->store_imported_post_value(
4189 + $post_id,
4190 + $raw_title,
4191 + 'aioseo',
4192 + Metasync_Seo_Precedence::KEY_IMPORTED_TITLE,
4193 + $overwrite,
4194 + $unresolved
4195 + );
2410 4196 }
2411 4197
2412 - // Import description
2413 - if ($import_descriptions && !empty($aioseo_data->description)) {
2414 - $existing_desc = get_post_meta($post_id, '_metasync_seo_desc', true);
4198 + // Import description — same reasoning as the title above.
4199 + if ($import_descriptions) {
4200 + $raw_desc = !empty($aioseo_data->description) ? (string) $aioseo_data->description : '';
4201 + $desc_from_template = false;
2415 4202
2416 - if (empty($existing_desc) || $overwrite) {
2417 - $aioseo_desc = $this->resolve_seo_placeholders($aioseo_data->description, $post_id, 'aioseo');
2418 - update_post_meta($post_id, '_metasync_seo_desc', sanitize_textarea_field($aioseo_desc));
2419 - $updated = true;
4203 + if ($raw_desc === '' && $desc_template !== '') {
4204 + $raw_desc = $desc_template;
4205 + $desc_from_template = true;
2420 4206 }
4207 +
4208 + // Only template-derived values are trimmed. A '#post_content'
4209 + // template resolves to the whole body, and AIOSEO emits that
4210 + // untruncated — copying it verbatim would give every page a
4211 + // multi-thousand-character description. What the customer
4212 + // typed on the post is left exactly as they wrote it.
4213 + $updated = $this->store_imported_post_value(
4214 + $post_id,
4215 + $raw_desc,
4216 + 'aioseo',
4217 + Metasync_Seo_Precedence::KEY_IMPORTED_DESC,
4218 + $overwrite,
4219 + $unresolved,
4220 + $desc_from_template
4221 + ) || $updated;
2421 4222 }
2422 4223
2423 4224 // Import social text
2424 4225 if ($import_social_text) {
@@ -2423,44 +4224,52 @@
2423 4224 // Import social text
2424 4225 if ($import_social_text) {
2425 4226 $aioseo_og_title = isset($aioseo_data->og_title) ? $aioseo_data->og_title : '';
2426 4227 if (!empty($aioseo_og_title)) {
2427 - $existing = get_post_meta($post_id, '_metasync_og_title', true);
2428 - if (empty($existing) || $overwrite) {
2429 - $aioseo_og_title = $this->resolve_seo_placeholders($aioseo_og_title, $post_id, 'aioseo');
2430 - update_post_meta($post_id, '_metasync_og_title', sanitize_text_field($aioseo_og_title));
2431 - $updated = true;
2432 - }
4228 + $updated = $this->store_imported_post_value(
4229 + $post_id,
4230 + (string) $aioseo_og_title,
4231 + 'aioseo',
4232 + Metasync_Seo_Precedence::KEY_IMPORTED_OG_TITLE,
4233 + $overwrite,
4234 + $unresolved
4235 + ) || $updated;
2433 4236 }
2434 4237
2435 4238 $aioseo_og_desc = isset($aioseo_data->og_description) ? $aioseo_data->og_description : '';
2436 4239 if (!empty($aioseo_og_desc)) {
2437 - $existing = get_post_meta($post_id, '_metasync_og_description', true);
2438 - if (empty($existing) || $overwrite) {
2439 - $aioseo_og_desc = $this->resolve_seo_placeholders($aioseo_og_desc, $post_id, 'aioseo');
2440 - update_post_meta($post_id, '_metasync_og_description', sanitize_textarea_field($aioseo_og_desc));
2441 - $updated = true;
2442 - }
4240 + $updated = $this->store_imported_post_value(
4241 + $post_id,
4242 + (string) $aioseo_og_desc,
4243 + 'aioseo',
4244 + Metasync_Seo_Precedence::KEY_IMPORTED_OG_DESC,
4245 + $overwrite,
4246 + $unresolved
4247 + ) || $updated;
2443 4248 }
2444 4249
2445 4250 $aioseo_tw_title = isset($aioseo_data->twitter_title) ? $aioseo_data->twitter_title : '';
2446 4251 if (!empty($aioseo_tw_title)) {
2447 - $existing = get_post_meta($post_id, '_metasync_twitter_title', true);
2448 - if (empty($existing) || $overwrite) {
2449 - $aioseo_tw_title = $this->resolve_seo_placeholders($aioseo_tw_title, $post_id, 'aioseo');
2450 - update_post_meta($post_id, '_metasync_twitter_title', sanitize_text_field($aioseo_tw_title));
2451 - $updated = true;
2452 - }
4252 + $updated = $this->store_imported_post_value(
4253 + $post_id,
4254 + (string) $aioseo_tw_title,
4255 + 'aioseo',
4256 + Metasync_Seo_Precedence::KEY_IMPORTED_TWITTER_TITLE,
4257 + $overwrite,
4258 + $unresolved
4259 + ) || $updated;
2453 4260 }
2454 4261
2455 4262 $aioseo_tw_desc = isset($aioseo_data->twitter_description) ? $aioseo_data->twitter_description : '';
2456 4263 if (!empty($aioseo_tw_desc)) {
2457 - $existing = get_post_meta($post_id, '_metasync_twitter_description', true);
2458 - if (empty($existing) || $overwrite) {
2459 - $aioseo_tw_desc = $this->resolve_seo_placeholders($aioseo_tw_desc, $post_id, 'aioseo');
2460 - update_post_meta($post_id, '_metasync_twitter_description', sanitize_textarea_field($aioseo_tw_desc));
2461 - $updated = true;
2462 - }
4264 + $updated = $this->store_imported_post_value(
4265 + $post_id,
4266 + (string) $aioseo_tw_desc,
4267 + 'aioseo',
4268 + Metasync_Seo_Precedence::KEY_IMPORTED_TWITTER_DESC,
4269 + $overwrite,
4270 + $unresolved
4271 + ) || $updated;
2463 4272 }
2464 4273 }
2465 4274
2466 4275 // Import social images
@@ -2466,22 +4275,28 @@
2466 4275 // Import social images
2467 4276 if ($import_social_images) {
2468 4277 $aioseo_og_image = isset($aioseo_data->og_image_custom_url) ? $aioseo_data->og_image_custom_url : '';
2469 4278 if (!empty($aioseo_og_image)) {
2470 - $existing_og = get_post_meta($post_id, '_metasync_og_image', true);
2471 - if (empty($existing_og) || $overwrite) {
2472 - update_post_meta($post_id, '_metasync_og_image', esc_url_raw($aioseo_og_image));
2473 - $updated = true;
2474 - }
4279 + $updated = $this->store_imported_post_value(
4280 + $post_id,
4281 + (string) $aioseo_og_image,
4282 + 'aioseo',
4283 + Metasync_Seo_Precedence::KEY_IMPORTED_OG_IMAGE,
4284 + $overwrite,
4285 + $unresolved
4286 + ) || $updated;
2475 4287 }
2476 4288
2477 4289 $aioseo_twitter_image = isset($aioseo_data->twitter_image_custom_url) ? $aioseo_data->twitter_image_custom_url : '';
2478 4290 if (!empty($aioseo_twitter_image)) {
2479 - $existing_twitter = get_post_meta($post_id, '_metasync_twitter_image', true);
2480 - if (empty($existing_twitter) || $overwrite) {
2481 - update_post_meta($post_id, '_metasync_twitter_image', esc_url_raw($aioseo_twitter_image));
2482 - $updated = true;
2483 - }
4291 + $updated = $this->store_imported_post_value(
4292 + $post_id,
4293 + (string) $aioseo_twitter_image,
4294 + 'aioseo',
4295 + Metasync_Seo_Precedence::KEY_IMPORTED_TWITTER_IMAGE,
4296 + $overwrite,
4297 + $unresolved
4298 + ) || $updated;
2484 4299 }
2485 4300 }
2486 4301
2487 4302 if ($updated) {
@@ -2491,11 +4306,15 @@
2491 4306 }
2492 4307 }
2493 4308
2494 4309 $processed = $offset + count($posts);
2495 - $is_complete = $processed >= $total_posts;
4310 + // An empty batch always ends the run. The client loops on !is_complete
4311 + // with no iteration cap, so if the count and the select ever disagreed,
4312 + // a batch returning no rows would leave processed stuck below total and
4313 + // spin forever against the server.
4314 + $is_complete = $processed >= $total_posts || empty($posts);
2496 4315
2497 - return [
4316 + return $this->attach_unresolved_report([
2498 4317 'success' => true,
2499 4318 'imported' => $imported_count,
2500 4319 'skipped' => $skipped_count,
2501 4320 'total' => $total_posts,
@@ -2504,9 +4323,9 @@
2504 4323 'progress_percent' => $total_posts > 0 ? round(($processed / $total_posts) * 100) : 100,
2505 4324 'message' => $is_complete
2506 4325 ? "Import complete! Imported {$imported_count} posts, skipped {$skipped_count} posts."
2507 4326 : "Processing... {$imported_count} imported, {$skipped_count} skipped."
2508 - ];
4327 + ], $unresolved);
2509 4328 }
2510 4329
2511 4330 /**
2512 4331 * Import term-level SEO metadata from a third-party SEO plugin into
@@ -2588,16 +4407,22 @@
2588 4407 'message' => $terms->get_error_message(),
2589 4408 ];
2590 4409 }
2591 4410
4411 + // Title and description are handled separately below: they go to the
4412 + // imported keys so they lose to OTTO, and they need their tokens
4413 + // resolved. The rest keep their own keys.
2592 4414 $field_map = [
2593 - 'wpseo_title' => '_metasync_metatitle',
2594 - 'wpseo_desc' => '_metasync_metadesc',
2595 4415 'wpseo_opengraph-title' => '_metasync_og_title',
2596 4416 'wpseo_opengraph-description' => '_metasync_og_description',
2597 4417 'wpseo_canonical' => '_metasync_canonical_url',
2598 4418 ];
2599 4419
4420 + $imported_map = [
4421 + 'wpseo_title' => Metasync_Seo_Precedence::KEY_IMPORTED_TITLE,
4422 + 'wpseo_desc' => Metasync_Seo_Precedence::KEY_IMPORTED_DESC,
4423 + ];
4424 +
2600 4425 $imported = 0;
2601 4426 $skipped = 0;
2602 4427
2603 4428 foreach ($terms as $term) {
@@ -2608,8 +4433,18 @@
2608 4433 if (!is_array($yoast_meta)) {
2609 4434 $yoast_meta = [];
2610 4435 }
2611 4436
4437 + foreach ($imported_map as $src_key => $dest_key) {
4438 + $term_updated = $this->store_imported_term_value(
4439 + $term,
4440 + isset($yoast_meta[$src_key]) ? (string) $yoast_meta[$src_key] : '',
4441 + 'yoast',
4442 + $dest_key,
4443 + $overwrite
4444 + ) || $term_updated;
4445 + }
4446 +
2612 4447 foreach ($field_map as $src_key => $dest_key) {
2613 4448 $src_value = isset($yoast_meta[$src_key]) ? $yoast_meta[$src_key] : '';
2614 4449 if ($src_value === '' || $src_value === null) {
2615 4450 continue;
@@ -2619,8 +4454,21 @@
2619 4454 if (!empty($existing) && !$overwrite) {
2620 4455 continue;
2621 4456 }
2622 4457
4458 + // Validate canonical: never import a corrupted value.
4459 + if ($dest_key === '_metasync_canonical_url') {
4460 + $src_value = Metasync_Canonical_Sanitizer::sanitize_for_save($src_value);
4461 + if ($src_value === '') {
4462 + continue;
4463 + }
4464 + } else {
4465 + $src_value = $this->resolve_term_placeholders($src_value, $term, 'yoast');
4466 + if (trim($src_value) === '') {
4467 + continue;
4468 + }
4469 + }
4470 +
2623 4471 update_term_meta($term->term_id, $dest_key, $src_value);
2624 4472 $term_updated = true;
2625 4473 }
2626 4474
@@ -2678,16 +4526,21 @@
2678 4526 'message' => $terms->get_error_message(),
2679 4527 ];
2680 4528 }
2681 4529
4530 + // See import_yoast_term_meta(): title and description are routed to the
4531 + // imported keys and token-resolved; the rest keep their own keys.
2682 4532 $field_map = [
2683 - 'rank_math_title' => '_metasync_metatitle',
2684 - 'rank_math_description' => '_metasync_metadesc',
2685 4533 'rank_math_facebook_title' => '_metasync_og_title',
2686 4534 'rank_math_facebook_description' => '_metasync_og_description',
2687 4535 'rank_math_canonical_url' => '_metasync_canonical_url',
2688 4536 ];
2689 4537
4538 + $imported_map = [
4539 + 'rank_math_title' => Metasync_Seo_Precedence::KEY_IMPORTED_TITLE,
4540 + 'rank_math_description' => Metasync_Seo_Precedence::KEY_IMPORTED_DESC,
4541 + ];
4542 +
2690 4543 $imported = 0;
2691 4544 $skipped = 0;
2692 4545
2693 4546 foreach ($terms as $term) {
@@ -2692,8 +4545,18 @@
2692 4545
2693 4546 foreach ($terms as $term) {
2694 4547 $term_updated = false;
2695 4548
4549 + foreach ($imported_map as $src_key => $dest_key) {
4550 + $term_updated = $this->store_imported_term_value(
4551 + $term,
4552 + (string) get_term_meta($term->term_id, $src_key, true),
4553 + 'rankmath',
4554 + $dest_key,
4555 + $overwrite
4556 + ) || $term_updated;
4557 + }
4558 +
2696 4559 foreach ($field_map as $src_key => $dest_key) {
2697 4560 $src_value = get_term_meta($term->term_id, $src_key, true);
2698 4561 if ($src_value === '' || $src_value === null) {
2699 4562 continue;
@@ -2703,8 +4566,21 @@
2703 4566 if (!empty($existing) && !$overwrite) {
2704 4567 continue;
2705 4568 }
2706 4569
4570 + // Validate canonical: never import a corrupted value.
4571 + if ($dest_key === '_metasync_canonical_url') {
4572 + $src_value = Metasync_Canonical_Sanitizer::sanitize_for_save($src_value);
4573 + if ($src_value === '') {
4574 + continue;
4575 + }
4576 + } else {
4577 + $src_value = $this->resolve_term_placeholders($src_value, $term, 'rankmath');
4578 + if (trim($src_value) === '') {
4579 + continue;
4580 + }
4581 + }
4582 +
2707 4583 update_term_meta($term->term_id, $dest_key, $src_value);
2708 4584 $term_updated = true;
2709 4585 }
2710 4586
@@ -2752,9 +4628,9 @@
2752 4628 $overwrite = (bool) $options['overwrite_existing'];
2753 4629
2754 4630 $table = $wpdb->prefix . 'aioseo_terms';
2755 4631
2756 - $table_exists = $wpdb->get_var($wpdb->prepare('SHOW TABLES LIKE %s', $table));
4632 + $table_exists = $wpdb->get_var($wpdb->prepare('SHOW TABLES LIKE %s', $table)); // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- one-shot import tool — bulk reads from third-party SEO plugin storage; no bulk WordPress API exists
2757 4633 if ($table_exists !== $table) {
2758 4634 return [
2759 4635 'success' => false,
2760 4636 'message' => 'AIOSEO terms table not found.',
@@ -2760,11 +4636,11 @@
2760 4636 'message' => 'AIOSEO terms table not found.',
2761 4637 ];
2762 4638 }
2763 4639
2764 - $rows = $wpdb->get_results($wpdb->prepare(
4640 + $rows = $wpdb->get_results($wpdb->prepare( // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- one-shot import tool — bulk reads from third-party SEO plugin storage; no bulk WordPress API exists
2765 4641 "SELECT term_id, title, description, og_title, og_description, canonical_url, robots_noindex
2766 - FROM {$table}
4642 + FROM {$wpdb->prefix}aioseo_terms
2767 4643 ORDER BY term_id ASC
2768 4644 LIMIT %d OFFSET %d",
2769 4645 $batch_size,
2770 4646 $offset
@@ -2778,18 +4654,41 @@
2778 4654 if ($term_id <= 0) {
2779 4655 continue;
2780 4656 }
2781 4657
4658 + // The resolver needs the term's own name and description, and a row
4659 + // can outlive the term it points at.
4660 + $term = get_term($term_id);
4661 + if (!$term || is_wp_error($term)) {
4662 + $skipped++;
4663 + continue;
4664 + }
4665 +
2782 4666 $term_updated = false;
2783 4667
4668 + // See import_yoast_term_meta(): title and description are routed to
4669 + // the imported keys and token-resolved; the rest keep their own keys.
2784 4670 $field_map = [
2785 - 'title' => '_metasync_metatitle',
2786 - 'description' => '_metasync_metadesc',
2787 4671 'og_title' => '_metasync_og_title',
2788 4672 'og_description' => '_metasync_og_description',
2789 4673 'canonical_url' => '_metasync_canonical_url',
2790 4674 ];
2791 4675
4676 + $imported_map = [
4677 + 'title' => Metasync_Seo_Precedence::KEY_IMPORTED_TITLE,
4678 + 'description' => Metasync_Seo_Precedence::KEY_IMPORTED_DESC,
4679 + ];
4680 +
4681 + foreach ($imported_map as $column => $dest_key) {
4682 + $term_updated = $this->store_imported_term_value(
4683 + $term,
4684 + isset($row->$column) ? (string) $row->$column : '',
4685 + 'aioseo',
4686 + $dest_key,
4687 + $overwrite
4688 + ) || $term_updated;
4689 + }
4690 +
2792 4691 foreach ($field_map as $column => $dest_key) {
2793 4692 $value = isset($row->$column) ? $row->$column : '';
2794 4693 if ($value === '' || $value === null) {
2795 4694 continue;
@@ -2797,8 +4696,21 @@
2797 4696
2798 4697 $existing = get_term_meta($term_id, $dest_key, true);
2799 4698 if (!empty($existing) && !$overwrite) {
2800 4699 continue;
4700 + }
4701 +
4702 + // Validate canonical: never import a corrupted value.
4703 + if ($dest_key === '_metasync_canonical_url') {
4704 + $value = Metasync_Canonical_Sanitizer::sanitize_for_save($value);
4705 + if ($value === '') {
4706 + continue;
4707 + }
4708 + } else {
4709 + $value = $this->resolve_term_placeholders($value, $term, 'aioseo');
4710 + if (trim($value) === '' || $this->has_unresolved_placeholders($value, 'aioseo')) {
4711 + continue;
4712 + }
2801 4713 }
2802 4714
2803 4715 update_term_meta($term_id, $dest_key, $value);
2804 4716 $term_updated = true;