PluginProbe
Search Atlas SEO – OTTO AI SEO Automation for WordPress / 2.7.2
Search Atlas SEO – OTTO AI SEO Automation for WordPress v2.7.2
2.7.1 2.7.2 2.7.0 2.6.26 2.6.25 2.6.24 2.6.23 2.6.22 2.6.21 2.6.20 2.6.19 2.6.18 2.6.17 2.6.16 2.6.15 2.6.14 2.6.13 2.6.12 2.6.11 2.6.10 2.6.9 2.6.8 2.6.7 2.6.6 2.6.5 All 141 releases
← All changes | includes/class-metasync-external-importer.php +2298 -434 2.6.21 → 2.7.2 View file →
@@ -176,8 +176,9 @@
176 176 $count = 0;
177 177
178 178 switch ($plugin) {
179 179 case 'yoast':
180 + // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- one-shot import tool — bulk reads from third-party SEO plugin storage; no bulk WordPress API exists
180 181 $count = (int) $wpdb->get_var("
181 182 SELECT COUNT(DISTINCT post_id)
182 183 FROM {$wpdb->postmeta}
183 184 WHERE meta_key LIKE '_yoast_wpseo_%'
@@ -185,22 +186,23 @@
185 186 ");
186 187 break;
187 188
188 189 case 'rankmath':
189 - $count = (int) $wpdb->get_var("
190 + // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- one-shot import tool — bulk reads from third-party SEO plugin storage; no bulk WordPress API exists
191 + $count = (int) $wpdb->get_var($wpdb->prepare("
190 192 SELECT COUNT(DISTINCT post_id)
191 193 FROM {$wpdb->postmeta}
192 - WHERE meta_key LIKE 'rank_math_%'
194 + WHERE meta_key LIKE %s
193 195 AND post_id IN (SELECT ID FROM {$wpdb->posts} WHERE post_status = 'publish')
194 - ");
196 + ", 'rank_math_%'));
195 197 break;
196 198
197 199 case 'aioseo':
198 200 $table = $wpdb->prefix . 'aioseo_posts';
199 - if ($wpdb->get_var("SHOW TABLES LIKE '$table'") === $table) {
201 + if ($wpdb->get_var($wpdb->prepare('SHOW TABLES LIKE %s', $wpdb->esc_like($table))) === $table) { // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- one-shot import tool — bulk reads from third-party SEO plugin storage; no bulk WordPress API exists
200 202 $count = (int) $wpdb->get_var("
201 203 SELECT COUNT(post_id)
202 - FROM {$table}
204 + FROM {$wpdb->prefix}aioseo_posts
203 205 WHERE post_id IN (SELECT ID FROM {$wpdb->posts} WHERE post_status = 'publish')
204 206 ");
205 207 }
206 208 break;
@@ -210,59 +212,458 @@
210 212 }
211 213
212 214 /**
213 215 * Check if schema data exists for a plugin
216 + *
217 + * Counts only records the importer would actually write: the source record
218 + * must hold a supported, populated schema, and the post must not already
219 + * carry a MetaSync schema block. The per-record rule is shared with the
220 + * importers (see the *_schema_source_is_supported() helpers and
221 + * post_has_metasync_schema()), so the count the Schema Settings page shows
222 + * is the count an import can deliver — the old detector counted every
223 + * provider row and reported posts that were silently skipped.
214 224 */
215 225 private function check_schema_data($plugin, &$count)
216 226 {
217 - global $wpdb;
218 -
219 227 $count = 0;
228 + $importable_posts = [];
220 229
221 230 switch ($plugin) {
222 231 case 'yoast':
223 - // Check for Yoast schema meta
224 - // Yoast Premium stores schema type in _yoast_wpseo_schema_article_type
225 - // Free version may use _yoast_wpseo_schema (JSON)
226 - $count = (int) $wpdb->get_var("
227 - SELECT COUNT(DISTINCT post_id)
228 - FROM {$wpdb->postmeta}
229 - WHERE (meta_key = '_yoast_wpseo_schema' OR meta_key = '_yoast_wpseo_schema_article_type')
230 - AND post_id IN (SELECT ID FROM {$wpdb->posts} WHERE post_status = 'publish')
231 - ");
232 + foreach ($this->yoast_schema_candidate_rows(true) as $row) {
233 + $post_id = (int) $row->post_id;
234 + if (isset($importable_posts[$post_id])) {
235 + continue;
236 + }
237 + if ($this->yoast_schema_source_is_supported($row->meta_key, $row->meta_value) !== null) {
238 + $importable_posts[$post_id] = true;
239 + }
240 + }
232 241 break;
233 242
234 243 case 'rankmath':
235 - // Check for Rank Math schema meta (any schema type)
236 - // Rank Math uses meta keys like: rank_math_schema_Article, rank_math_schema_BlogPosting, rank_math_schema_Product, etc.
237 - // Exclude shortcode schemas (rank_math_shortcode_schema_*)
238 - $count = (int) $wpdb->get_var("
239 - SELECT COUNT(DISTINCT post_id)
240 - FROM {$wpdb->postmeta}
241 - WHERE meta_key LIKE 'rank_math_schema_%'
242 - AND meta_key NOT LIKE 'rank_math_shortcode_schema_%'
243 - AND post_id IN (SELECT ID FROM {$wpdb->posts} WHERE post_status = 'publish')
244 - ");
244 + foreach ($this->rankmath_schema_candidate_rows(true) as $row) {
245 + $post_id = (int) $row->post_id;
246 + if (isset($importable_posts[$post_id])) {
247 + continue;
248 + }
249 + if ($this->rankmath_schema_source_is_supported($row->meta_key, $row->meta_value) !== null) {
250 + $importable_posts[$post_id] = true;
251 + }
252 + }
245 253 break;
246 254
247 255 case 'aioseo':
248 - // Check for AIOSEO schema in table
249 - $table = $wpdb->prefix . 'aioseo_posts';
250 - if ($wpdb->get_var("SHOW TABLES LIKE '$table'") === $table) {
251 - $count = (int) $wpdb->get_var("
252 - SELECT COUNT(post_id)
253 - FROM {$table}
254 - WHERE (schema_type IS NOT NULL AND schema_type != '')
255 - AND post_id IN (SELECT ID FROM {$wpdb->posts} WHERE post_status = 'publish')
256 - ");
256 + // AIOSEO's `default` rows carry no per-post schema at all, so
257 + // they are filtered out before eligibility is even evaluated.
258 + foreach ($this->aioseo_schema_candidate_rows(true) as $row) {
259 + $post_id = (int) $row->post_id;
260 + if (isset($importable_posts[$post_id])) {
261 + continue;
262 + }
263 + if ($this->aioseo_schema_source_is_supported($row->schema_type, $row->schema_type_options) !== null) {
264 + $importable_posts[$post_id] = true;
265 + }
257 266 }
258 267 break;
259 268 }
260 269
270 + $count = count($importable_posts);
271 +
261 272 return $count > 0;
262 273 }
263 274
264 275 /**
276 + * Yoast source rows that could hold per-post schema, for published posts.
277 + *
278 + * Shared by check_schema_data() and import_yoast_schema() so both look at
279 + * exactly the same candidate set.
280 + *
281 + * @param bool $only_new Skip posts that already hold a MetaSync schema block.
282 + * Only the detector sets this: the importers must see
283 + * every candidate so they can report those posts as
284 + * already imported rather than silently dropping them.
285 + * @return array<object> Rows with post_id, meta_key and meta_value.
286 + */
287 + private function yoast_schema_candidate_rows($only_new = false)
288 + {
289 + global $wpdb;
290 +
291 + $query = "SELECT post_id, meta_key, meta_value
292 + FROM {$wpdb->postmeta}
293 + WHERE (meta_key = '_yoast_wpseo_schema' OR meta_key = '_yoast_wpseo_schema_article_type')
294 + AND meta_value != ''
295 + AND post_id IN (SELECT ID FROM {$wpdb->posts} WHERE post_status = 'publish')
296 + " . ($only_new ? $this->sql_exclude_posts_with_metasync_schema($wpdb->postmeta) : '') . "
297 + ORDER BY post_id ASC";
298 +
299 + // phpcs:ignore WordPress.DB.DirectDatabaseQuery, WordPress.DB.PreparedSQL.NotPrepared -- one-shot import tool — bulk reads from third-party SEO plugin storage; no bulk WordPress API exists; table names come from wpdb, exclusion fragment is class-built SQL
300 + return (array) $wpdb->get_results($query);
301 + }
302 +
303 + /**
304 + * Rank Math source rows that could hold per-post schema, for published
305 + * posts. Shortcode schemas are excluded, as the importer always has.
306 + *
307 + * @param bool $only_new Skip posts that already hold a MetaSync schema block.
308 + * @return array<object> Rows with post_id, meta_key and meta_value.
309 + */
310 + private function rankmath_schema_candidate_rows($only_new = false)
311 + {
312 + global $wpdb;
313 +
314 + $query = "SELECT pm.post_id, pm.meta_key, pm.meta_value
315 + FROM {$wpdb->postmeta} pm
316 + WHERE pm.meta_key LIKE 'rank_math_schema_%'
317 + AND pm.meta_key NOT LIKE 'rank_math_shortcode_schema_%'
318 + AND pm.meta_value != ''
319 + AND pm.meta_value != 'a:0:{}'
320 + AND pm.post_id IN (SELECT ID FROM {$wpdb->posts} WHERE post_status = 'publish')
321 + " . ($only_new ? $this->sql_exclude_posts_with_metasync_schema('pm') : '') . "
322 + ORDER BY pm.post_id ASC";
323 +
324 + // phpcs:ignore WordPress.DB.DirectDatabaseQuery, WordPress.DB.PreparedSQL.NotPrepared -- one-shot import tool — bulk reads from third-party SEO plugin storage; no bulk WordPress API exists; table names come from wpdb, exclusion fragment is class-built SQL
325 + return (array) $wpdb->get_results($query);
326 + }
327 +
328 + /**
329 + * AIOSEO source rows that could hold per-post schema, for published posts.
330 + *
331 + * Returns an empty array when the AIOSEO table is absent (the plugin was
332 + * never installed), matching the previous detector behaviour.
333 + *
334 + * @param bool $only_new Skip posts that already hold a MetaSync schema block.
335 + * @return array<object> Rows with post_id, schema_type and schema_type_options.
336 + */
337 + private function aioseo_schema_candidate_rows($only_new = false)
338 + {
339 + global $wpdb;
340 +
341 + $table = $wpdb->prefix . 'aioseo_posts';
342 + if ($wpdb->get_var($wpdb->prepare('SHOW TABLES LIKE %s', $wpdb->esc_like($table))) !== $table) { // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- one-shot import tool — bulk reads from third-party SEO plugin storage; no bulk WordPress API exists
343 + return [];
344 + }
345 +
346 + // AIOSEO writes a row for every post it tracks, and the overwhelming
347 + // majority carry schema_type 'default' with empty schema_type_options.
348 + // Those rows represent the post-type default, not per-post schema, so
349 + // they are dropped here rather than being reported as "unsupported" —
350 + // counting them is what made the card claim hundreds of ready posts
351 + // that no import could ever produce.
352 + $query = "SELECT post_id, schema_type, schema_type_options
353 + FROM {$table}
354 + WHERE schema_type IS NOT NULL
355 + AND schema_type != ''
356 + AND schema_type != 'default'
357 + AND schema_type_options IS NOT NULL
358 + AND schema_type_options NOT IN ('', '{}', '[]', 'null')
359 + AND post_id IN (SELECT ID FROM {$wpdb->posts} WHERE post_status = 'publish')
360 + " . ($only_new ? $this->sql_exclude_posts_with_metasync_schema($table) : '') . "
361 + ORDER BY post_id ASC";
362 +
363 + // phpcs:ignore WordPress.DB.DirectDatabaseQuery, WordPress.DB.PreparedSQL.NotPrepared -- one-shot import tool — bulk reads from third-party SEO plugin storage; no bulk WordPress API exists; table name comes from wpdb, exclusion fragment is class-built SQL
364 + return (array) $wpdb->get_results($query);
365 + }
366 +
367 + /**
368 + * SQL clause excluding posts that already hold a MetaSync schema block.
369 + *
370 + * Mirrors post_has_metasync_schema() in SQL: a metasync_schema_markup
371 + * value whose "types" array exists and is non-empty. Values without a
372 + * "types" list (an OTTO-deployed otto_jsonld block, for example) are
373 + * deliberately not excluded — the importer does not skip those either.
374 + * post_has_metasync_schema() is still evaluated per record in PHP, so the
375 + * two checks cannot drift apart.
376 + *
377 + * @param string $alias Table name or alias the candidate query exposes post_id under.
378 + * @return string "AND NOT EXISTS (...)" clause.
379 + */
380 + private function sql_exclude_posts_with_metasync_schema($alias)
381 + {
382 + global $wpdb;
383 +
384 + return "AND NOT EXISTS (
385 + SELECT 1
386 + FROM {$wpdb->postmeta} ms
387 + WHERE ms.post_id = {$alias}.post_id
388 + AND ms.meta_key = 'metasync_schema_markup'
389 + AND ms.meta_value LIKE '%s:5:\"types\";a:%'
390 + AND ms.meta_value NOT LIKE '%s:5:\"types\";a:0:{}%'
391 + )";
392 + }
393 +
394 + /**
395 + * Whether a post already holds a MetaSync schema block an import must not
396 + * overwrite.
397 + *
398 + * Same guard the importers have always applied: an existing
399 + * metasync_schema_markup whose "types" list is populated means the schema
400 + * was already migrated or set by hand, so the source record is skipped
401 + * and reported as already imported rather than overwritten.
402 + *
403 + * @param int $post_id Post ID.
404 + * @return bool
405 + */
406 + private function post_has_metasync_schema($post_id)
407 + {
408 + $existing = get_post_meta($post_id, 'metasync_schema_markup', true);
409 +
410 + return is_array($existing) && !empty($existing['types']);
411 + }
412 +
413 + /**
414 + * Normalise a source schema type string to a supported MetaSync type.
415 + *
416 + * Shared by the Yoast and Rank Math eligibility checks and by the
417 + * converters, so "which source types can we actually carry" has a single
418 + * answer per provider.
419 + *
420 + * @param string $raw_type Source @type / schema type, any case.
421 + * @return string|null MetaSync type slug, or null when unsupported.
422 + */
423 + private function supported_schema_type($raw_type)
424 + {
425 + $type = strtolower(trim((string) $raw_type));
426 + if ($type === '') {
427 + return null;
428 + }
429 +
430 + $map = [
431 + 'article' => 'article',
432 + 'newsarticle' => 'article',
433 + 'blogposting' => 'article',
434 + 'faqpage' => 'FAQPage',
435 + 'product' => 'product',
436 + 'recipe' => 'recipe',
437 + ];
438 +
439 + return $map[$type] ?? null;
440 + }
441 +
442 + /**
443 + * Whether a Yoast source row holds schema the importer can convert.
444 + *
445 + * Returns the resolved MetaSync type when the row is supported, or null
446 + * when it must not be counted or imported (unsupported type, empty or
447 + * invalid payload). Used by both check_schema_data() and
448 + * import_yoast_schema() so the two cannot drift.
449 + *
450 + * @param string $meta_key Source meta key.
451 + * @param string $meta_value Raw meta value.
452 + * @return string|null
453 + */
454 + private function yoast_schema_source_is_supported($meta_key, $meta_value)
455 + {
456 + if ($meta_key === '_yoast_wpseo_schema_article_type') {
457 + // Yoast Premium stores a bare type name; the importer builds an
458 + // article skeleton from it.
459 + return $this->supported_schema_type($meta_value);
460 + }
461 +
462 + if ($meta_key !== '_yoast_wpseo_schema') {
463 + return null;
464 + }
465 +
466 + $value = trim((string) $meta_value);
467 + if ($value === '') {
468 + return null;
469 + }
470 +
471 + $decoded = json_decode($value, true);
472 + if (!is_array($decoded) || $decoded === []) {
473 + return null;
474 + }
475 +
476 + foreach ($this->yoast_schema_graph_items($decoded) as $item) {
477 + if (!is_array($item) || !isset($item['@type'])) {
478 + continue;
479 + }
480 +
481 + $raw_type = $item['@type'];
482 + if (is_array($raw_type)) {
483 + $raw_type = reset($raw_type);
484 + }
485 + if (!is_string($raw_type) || $raw_type === '') {
486 + continue;
487 + }
488 +
489 + $supported = $this->supported_schema_type($raw_type);
490 + if ($supported === null) {
491 + continue;
492 + }
493 +
494 + // A FAQPage whose questions cannot be converted produces an empty
495 + // MetaSync block, so it must not be counted as importable either.
496 + if ($supported === 'FAQPage'
497 + && !$this->faq_questions_are_convertible($item['mainEntity'] ?? [], 'yoast')) {
498 + continue;
499 + }
500 +
501 + return $supported;
502 + }
503 +
504 + return null;
505 + }
506 +
507 + /**
508 + * Iterate the schema entries inside a decoded Yoast payload.
509 + *
510 + * Supports the two storage shapes Yoast has used: the current
511 + * `{"@graph": [...]}` wrapper and the legacy root array of entries.
512 + *
513 + * @param array $decoded Decoded `_yoast_wpseo_schema` value.
514 + * @return array Iterable list of schema item arrays.
515 + */
516 + private function yoast_schema_graph_items($decoded)
517 + {
518 + if (isset($decoded['@graph']) && is_array($decoded['@graph'])) {
519 + return $decoded['@graph'];
520 + }
521 +
522 + // A single schema object at the root: {"@type":"Article",...}.
523 + if (isset($decoded['@type'])) {
524 + return [$decoded];
525 + }
526 +
527 + // Legacy payload: a root array of entries, e.g.
528 + // [{"@type":"Article","headline":"..."}, ...]. Only treat it as such
529 + // when every element is an array — otherwise the value is an object
530 + // whose keys are property names, not entries, and no entry carries a
531 + // @type anyway.
532 + $is_entry_list = $decoded !== [];
533 + foreach ($decoded as $entry) {
534 + if (!is_array($entry)) {
535 + $is_entry_list = false;
536 + break;
537 + }
538 + }
539 +
540 + return $is_entry_list ? $decoded : [];
541 + }
542 +
543 + /**
544 + * Whether a Rank Math source row holds schema the importer can convert.
545 + *
546 + * Returns the resolved MetaSync type when supported, null otherwise. The
547 + * type lives in the meta key (rank_math_schema_Article), mirroring
548 + * convert_rankmath_schema_to_metasync().
549 + *
550 + * @param string $meta_key Source meta key.
551 + * @param string $meta_value Raw meta value.
552 + * @return string|null
553 + */
554 + private function rankmath_schema_source_is_supported($meta_key, $meta_value)
555 + {
556 + if (strpos((string) $meta_key, 'rank_math_schema_') !== 0) {
557 + return null;
558 + }
559 +
560 + $schema_type = str_replace('rank_math_schema_', '', (string) $meta_key);
561 + $supported = $this->supported_schema_type($schema_type);
562 +
563 + if ($supported === null) {
564 + return null;
565 + }
566 +
567 + $decoded = maybe_unserialize($meta_value);
568 + if (!is_array($decoded) || $decoded === []) {
569 + return null;
570 + }
571 +
572 + // Keep the check in step with the converter: a FAQPage whose questions
573 + // cannot be converted would yield an empty MetaSync block.
574 + if ($supported === 'FAQPage'
575 + && !$this->faq_questions_are_convertible($decoded['questions'] ?? [], 'rankmath')) {
576 + return null;
577 + }
578 +
579 + return $supported;
580 + }
581 +
582 + /**
583 + * Whether an AIOSEO row holds per-post schema the importer can convert.
584 + *
585 + * Returns the resolved MetaSync type when supported, null otherwise.
586 + * `schema_type = 'default'` rows — the post-type default AIOSEO stamps on
587 + * every tracked post — never reach this check from the candidate queries,
588 + * but it is enforced here as well so the importer cannot regress into
589 + * reporting them as "unsupported" source schemas.
590 + *
591 + * @param string $schema_type Raw schema_type column value.
592 + * @param string $schema_type_options Raw schema_type_options JSON.
593 + * @return string|null
594 + */
595 + private function aioseo_schema_source_is_supported($schema_type, $schema_type_options)
596 + {
597 + $type = strtolower(trim((string) $schema_type));
598 +
599 + if ($type === '' || $type === 'default' || $type === 'none') {
600 + return null;
601 + }
602 +
603 + $supported = $this->supported_schema_type($type);
604 + if ($supported === null) {
605 + return null;
606 + }
607 +
608 + $decoded = json_decode(trim((string) $schema_type_options), true);
609 + if (!is_array($decoded) || $decoded === []) {
610 + return null;
611 + }
612 +
613 + // As above: an unconvertible FAQPage must not be counted as importable.
614 + if ($supported === 'FAQPage'
615 + && !$this->faq_questions_are_convertible($decoded['questions'] ?? [], 'aioseo')) {
616 + return null;
617 + }
618 +
619 + return $supported;
620 + }
621 +
622 + /**
623 + * Whether a FAQ question list holds at least one entry the converter can
624 + * turn into a MetaSync FAQ item, for the given provider's key shape.
625 + *
626 + * Eligibility and conversion must agree: a source counted as importable
627 + * has to produce a non-empty MetaSync block, or the detector over-reports
628 + * again — the very defect this class of fix exists to close.
629 + *
630 + * A scalar `mainEntity`/`questions` value (corrupt or foreign meta) is
631 + * simply not convertible; it must never fatal the eligibility check,
632 + * which runs on every render of the Schema import tab.
633 + *
634 + * @param mixed $questions Question list from the source record.
635 + * @param string $provider 'yoast', 'rankmath' or 'aioseo'.
636 + * @return bool
637 + */
638 + private function faq_questions_are_convertible($questions, $provider)
639 + {
640 + if (!is_array($questions)) {
641 + return false;
642 + }
643 +
644 + foreach ($questions as $question) {
645 + if (!is_array($question)) {
646 + continue;
647 + }
648 +
649 + if ($provider === 'yoast') {
650 + if (isset($question['name'], $question['acceptedAnswer']['text'])) {
651 + return true;
652 + }
653 + } elseif ($provider === 'rankmath') {
654 + if (isset($question['name'], $question['text'])) {
655 + return true;
656 + }
657 + } elseif (isset($question['question'], $question['answer'])) {
658 + return true;
659 + }
660 + }
661 +
662 + return false;
663 + }
664 +
665 + /**
265 666 * Check if SEO metadata (titles and descriptions) exists for a plugin
266 667 */
267 668 private function check_seo_metadata($plugin, &$count)
268 669 {
@@ -272,8 +673,9 @@
272 673
273 674 switch ($plugin) {
274 675 case 'yoast':
275 676 // Check for Yoast SEO title or description
677 + // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- one-shot import tool — bulk reads from third-party SEO plugin storage; no bulk WordPress API exists
276 678 $count = (int) $wpdb->get_var("
277 679 SELECT COUNT(DISTINCT post_id)
278 680 FROM {$wpdb->postmeta}
279 681 WHERE (meta_key = '_yoast_wpseo_title' OR meta_key = '_yoast_wpseo_metadesc')
@@ -283,8 +685,9 @@
283 685 break;
284 686
285 687 case 'rankmath':
286 688 // Check for Rank Math title or description
689 + // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- one-shot import tool — bulk reads from third-party SEO plugin storage; no bulk WordPress API exists
287 690 $count = (int) $wpdb->get_var("
288 691 SELECT COUNT(DISTINCT post_id)
289 692 FROM {$wpdb->postmeta}
290 693 WHERE (meta_key = 'rank_math_title' OR meta_key = 'rank_math_description')
@@ -295,15 +698,42 @@
295 698
296 699 case 'aioseo':
297 700 // Check for AIOSEO title or description in their custom table
298 701 $table = $wpdb->prefix . 'aioseo_posts';
299 - if ($wpdb->get_var("SHOW TABLES LIKE '$table'") === $table) {
702 + if ($wpdb->get_var($wpdb->prepare('SHOW TABLES LIKE %s', $wpdb->esc_like($table))) === $table) { // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- one-shot import tool — bulk reads from third-party SEO plugin storage; no bulk WordPress API exists
300 703 $count = (int) $wpdb->get_var("
301 704 SELECT COUNT(post_id)
302 - FROM {$table}
705 + FROM {$wpdb->prefix}aioseo_posts
303 706 WHERE ((title IS NOT NULL AND title != '') OR (description IS NOT NULL AND description != ''))
304 707 AND post_id IN (SELECT ID FROM {$wpdb->posts} WHERE post_status = 'publish')
305 708 ");
709 +
710 + // Per-post overrides are the exception. AIOSEO also serves a
711 + // title and description for every post from its site-wide
712 + // templates, and those are what the import mainly picks up —
713 + // so a site that never overrode an individual post still has
714 + // plenty to migrate. Counting overrides alone reported zero
715 + // there, which rendered the card "Unavailable" with a disabled
716 + // button and made the import impossible to start.
717 + $templates = $this->get_aioseo_post_type_templates();
718 + if (!empty($templates)) {
719 + $post_types = array_keys($templates);
720 + $type_placeholders = implode(', ', array_fill(0, count($post_types), '%s'));
721 +
722 + $template_count = (int) $wpdb->get_var($wpdb->prepare( // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- one-shot import tool — bulk reads from third-party SEO plugin storage; no bulk WordPress API exists
723 + "SELECT COUNT(*)
724 + FROM {$wpdb->posts}
725 + WHERE post_status = 'publish'
726 + AND post_type IN ({$type_placeholders})",
727 + $post_types
728 + ));
729 +
730 + // Take the larger of the two. Templates configured for a
731 + // post type with no published posts would otherwise report
732 + // zero and disable the card, hiding override rows that do
733 + // exist — the same dead end from the other direction.
734 + $count = max($count, $template_count);
735 + }
306 736 }
307 737 break;
308 738 }
309 739
@@ -320,8 +750,9 @@
320 750 $count = 0;
321 751
322 752 switch ($plugin) {
323 753 case 'yoast':
754 + // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- one-shot import tool — bulk reads from third-party SEO plugin storage; no bulk WordPress API exists
324 755 $count = (int) $wpdb->get_var("
325 756 SELECT COUNT(DISTINCT post_id)
326 757 FROM {$wpdb->postmeta}
327 758 WHERE meta_key = '_yoast_wpseo_primary_category'
@@ -330,8 +761,9 @@
330 761 ");
331 762 break;
332 763
333 764 case 'rankmath':
765 + // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- one-shot import tool — bulk reads from third-party SEO plugin storage; no bulk WordPress API exists
334 766 $count = (int) $wpdb->get_var("
335 767 SELECT COUNT(DISTINCT post_id)
336 768 FROM {$wpdb->postmeta}
337 769 WHERE meta_key = 'rank_math_primary_category'
@@ -340,8 +772,9 @@
340 772 ");
341 773 break;
342 774
343 775 case 'aioseo':
776 + // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- one-shot import tool — bulk reads from third-party SEO plugin storage; no bulk WordPress API exists
344 777 $count = (int) $wpdb->get_var("
345 778 SELECT COUNT(DISTINCT post_id)
346 779 FROM {$wpdb->postmeta}
347 780 WHERE meta_key = '_aioseo_primary_category'
@@ -402,8 +835,9 @@
402 835 $batch_size = intval($options['batch_size']);
403 836 $offset = intval($options['offset']);
404 837 $overwrite = (bool) $options['overwrite_existing'];
405 838
839 + // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- one-shot import tool — bulk reads from third-party SEO plugin storage; no bulk WordPress API exists
406 840 $total_posts = (int) $wpdb->get_var("
407 841 SELECT COUNT(DISTINCT post_id)
408 842 FROM {$wpdb->postmeta}
409 843 WHERE meta_key = '_yoast_wpseo_primary_category'
@@ -410,8 +844,9 @@
410 844 AND meta_value != ''
411 845 AND post_id IN (SELECT ID FROM {$wpdb->posts} WHERE post_status = 'publish')
412 846 ");
413 847
848 + // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- one-shot import tool — bulk reads from third-party SEO plugin storage; no bulk WordPress API exists
414 849 $posts = $wpdb->get_results($wpdb->prepare("
415 850 SELECT DISTINCT post_id
416 851 FROM {$wpdb->postmeta}
417 852 WHERE meta_key = '_yoast_wpseo_primary_category'
@@ -465,8 +900,9 @@
465 900 $batch_size = intval($options['batch_size']);
466 901 $offset = intval($options['offset']);
467 902 $overwrite = (bool) $options['overwrite_existing'];
468 903
904 + // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- one-shot import tool — bulk reads from third-party SEO plugin storage; no bulk WordPress API exists
469 905 $total_posts = (int) $wpdb->get_var("
470 906 SELECT COUNT(DISTINCT post_id)
471 907 FROM {$wpdb->postmeta}
472 908 WHERE meta_key = 'rank_math_primary_category'
@@ -473,8 +909,9 @@
473 909 AND meta_value != ''
474 910 AND post_id IN (SELECT ID FROM {$wpdb->posts} WHERE post_status = 'publish')
475 911 ");
476 912
913 + // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- one-shot import tool — bulk reads from third-party SEO plugin storage; no bulk WordPress API exists
477 914 $posts = $wpdb->get_results($wpdb->prepare("
478 915 SELECT DISTINCT post_id
479 916 FROM {$wpdb->postmeta}
480 917 WHERE meta_key = 'rank_math_primary_category'
@@ -528,8 +965,9 @@
528 965 $batch_size = intval($options['batch_size']);
529 966 $offset = intval($options['offset']);
530 967 $overwrite = (bool) $options['overwrite_existing'];
531 968
969 + // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- one-shot import tool — bulk reads from third-party SEO plugin storage; no bulk WordPress API exists
532 970 $total_posts = (int) $wpdb->get_var("
533 971 SELECT COUNT(DISTINCT post_id)
534 972 FROM {$wpdb->postmeta}
535 973 WHERE meta_key = '_aioseo_primary_category'
@@ -536,8 +974,9 @@
536 974 AND meta_value != ''
537 975 AND post_id IN (SELECT ID FROM {$wpdb->posts} WHERE post_status = 'publish')
538 976 ");
539 977
978 + // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- one-shot import tool — bulk reads from third-party SEO plugin storage; no bulk WordPress API exists
540 979 $posts = $wpdb->get_results($wpdb->prepare("
541 980 SELECT DISTINCT post_id
542 981 FROM {$wpdb->postmeta}
543 982 WHERE meta_key = '_aioseo_primary_category'
@@ -735,24 +1174,26 @@
735 1174 $batch_size = intval($options['batch_size']);
736 1175 $offset = intval($options['offset']);
737 1176
738 1177 // Get total count (for progress tracking)
739 - $total = (int) $wpdb->get_var("
1178 + // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- one-shot import tool — bulk reads from third-party SEO plugin storage; no bulk WordPress API exists
1179 + $total = (int) $wpdb->get_var($wpdb->prepare("
740 1180 SELECT COUNT(DISTINCT post_id)
741 1181 FROM {$wpdb->postmeta}
742 - WHERE meta_key LIKE '_yoast_wpseo_%'
1182 + WHERE meta_key LIKE %s
743 1183 AND post_id IN (SELECT ID FROM {$wpdb->posts} WHERE post_status = 'publish')
744 - ");
1184 + ", '_yoast_wpseo_%'));
745 1185
746 1186 // Get batch of posts with Yoast robots meta
1187 + // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- one-shot import tool — bulk reads from third-party SEO plugin storage; no bulk WordPress API exists
747 1188 $posts = $wpdb->get_results($wpdb->prepare("
748 1189 SELECT DISTINCT post_id
749 1190 FROM {$wpdb->postmeta}
750 - WHERE meta_key LIKE '_yoast_wpseo_%'
1191 + WHERE meta_key LIKE %s
751 1192 AND post_id IN (SELECT ID FROM {$wpdb->posts} WHERE post_status = 'publish')
752 1193 ORDER BY post_id ASC
753 1194 LIMIT %d OFFSET %d
754 - ", $batch_size, $offset));
1195 + ", '_yoast_wpseo_%', $batch_size, $offset));
755 1196
756 1197 foreach ($posts as $post_obj) {
757 1198 $post_id = $post_obj->post_id;
758 1199 $has_changes = false;
@@ -876,24 +1317,26 @@
876 1317 $batch_size = intval($options['batch_size']);
877 1318 $offset = intval($options['offset']);
878 1319
879 1320 // Get total count (for progress tracking)
880 - $total = (int) $wpdb->get_var("
1321 + // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- one-shot import tool — bulk reads from third-party SEO plugin storage; no bulk WordPress API exists
1322 + $total = (int) $wpdb->get_var($wpdb->prepare("
881 1323 SELECT COUNT(DISTINCT post_id)
882 1324 FROM {$wpdb->postmeta}
883 - WHERE meta_key LIKE 'rank_math_%'
1325 + WHERE meta_key LIKE %s
884 1326 AND post_id IN (SELECT ID FROM {$wpdb->posts} WHERE post_status = 'publish')
885 - ");
1327 + ", 'rank_math_%'));
886 1328
887 1329 // Get batch of posts with Rank Math robots meta
1330 + // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- one-shot import tool — bulk reads from third-party SEO plugin storage; no bulk WordPress API exists
888 1331 $posts = $wpdb->get_results($wpdb->prepare("
889 1332 SELECT DISTINCT post_id
890 1333 FROM {$wpdb->postmeta}
891 - WHERE meta_key LIKE 'rank_math_%'
1334 + WHERE meta_key LIKE %s
892 1335 AND post_id IN (SELECT ID FROM {$wpdb->posts} WHERE post_status = 'publish')
893 1336 ORDER BY post_id ASC
894 1337 LIMIT %d OFFSET %d
895 - ", $batch_size, $offset));
1338 + ", 'rank_math_%', $batch_size, $offset));
896 1339
897 1340 foreach ($posts as $post_obj) {
898 1341 $post_id = $post_obj->post_id;
899 1342 $has_changes = false;
@@ -1016,9 +1459,9 @@
1016 1459 // AIOSEO stores data in a custom table
1017 1460 $aioseo_table = $wpdb->prefix . 'aioseo_posts';
1018 1461
1019 1462 // Check if table exists
1020 - $table_exists = $wpdb->get_var("SHOW TABLES LIKE '$aioseo_table'") === $aioseo_table;
1463 + $table_exists = $wpdb->get_var($wpdb->prepare('SHOW TABLES LIKE %s', $wpdb->esc_like($aioseo_table))) === $aioseo_table; // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- one-shot import tool — bulk reads from third-party SEO plugin storage; no bulk WordPress API exists
1021 1464
1022 1465 if (!$table_exists) {
1023 1466 return ['success' => false, 'message' => 'AIOSEO table not found.'];
1024 1467 }
@@ -1023,21 +1466,23 @@
1023 1466 return ['success' => false, 'message' => 'AIOSEO table not found.'];
1024 1467 }
1025 1468
1026 1469 // Get total count (for progress tracking)
1470 + // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- one-shot import tool — bulk reads from third-party SEO plugin storage; no bulk WordPress API exists
1027 1471 $total = (int) $wpdb->get_var("
1028 1472 SELECT COUNT(*)
1029 - FROM {$aioseo_table}
1473 + FROM {$wpdb->prefix}aioseo_posts
1030 1474 WHERE post_id IN (SELECT ID FROM {$wpdb->posts} WHERE post_status = 'publish')
1031 1475 ");
1032 1476
1033 1477 // Get batch of posts with AIOSEO settings
1478 + // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- one-shot import tool — bulk reads from third-party SEO plugin storage; no bulk WordPress API exists
1034 1479 $posts = $wpdb->get_results($wpdb->prepare("
1035 1480 SELECT post_id, robots_default, robots_noindex, robots_nofollow,
1036 1481 robots_noarchive, robots_nosnippet, robots_noimageindex,
1037 1482 robots_max_snippet, robots_max_imagepreview, robots_max_videopreview,
1038 1483 canonical_url
1039 - FROM {$aioseo_table}
1484 + FROM {$wpdb->prefix}aioseo_posts
1040 1485 WHERE post_id IN (SELECT ID FROM {$wpdb->posts} WHERE post_status = 'publish')
1041 1486 ORDER BY post_id ASC
1042 1487 LIMIT %d OFFSET %d
1043 1488 ", $batch_size, $offset));
@@ -1151,24 +1596,27 @@
1151 1596 }
1152 1597
1153 1598 /**
1154 1599 * Import Schema Settings (Per-Post Schema)
1600 + *
1601 + * Composes the user-facing result from the importer's breakdown so the
1602 + * message states what actually happened: no source schema, everything
1603 + * already migrated, everything unsupported/empty, or an import — including
1604 + * the partial case where some posts were skipped alongside the imports.
1155 1605 */
1156 1606 public function import_schema($plugin)
1157 1607 {
1158 - $imported_count = 0;
1159 -
1160 1608 switch ($plugin) {
1161 1609 case 'yoast':
1162 - $imported_count = $this->import_yoast_schema();
1610 + $breakdown = $this->import_yoast_schema();
1163 1611 break;
1164 1612
1165 1613 case 'rankmath':
1166 - $imported_count = $this->import_rankmath_schema();
1614 + $breakdown = $this->import_rankmath_schema();
1167 1615 break;
1168 1616
1169 1617 case 'aioseo':
1170 - $imported_count = $this->import_aioseo_schema();
1618 + $breakdown = $this->import_aioseo_schema();
1171 1619 break;
1172 1620
1173 1621 default:
1174 1622 return ['success' => false, 'message' => 'Invalid plugin specified.'];
@@ -1173,77 +1621,147 @@
1173 1621 default:
1174 1622 return ['success' => false, 'message' => 'Invalid plugin specified.'];
1175 1623 }
1176 1624
1177 - if ($imported_count > 0) {
1178 - return ['success' => true, 'message' => "Successfully imported schema settings for $imported_count posts."];
1625 + $imported = (int) $breakdown['imported'];
1626 + $already_imported = (int) $breakdown['already_imported'];
1627 + $unsupported = (int) $breakdown['unsupported'];
1628 + $candidates = (int) $breakdown['total_candidates'];
1629 +
1630 + // No source rows at all — nothing was ever detected to begin with.
1631 + if ($candidates === 0) {
1632 + return [
1633 + 'success' => false,
1634 + 'message' => 'No post-level schema settings found to import.',
1635 + 'breakdown' => $breakdown,
1636 + ];
1179 1637 }
1180 1638
1181 - return ['success' => false, 'message' => 'No post-level schema settings found to import.'];
1639 + if ($imported === 0) {
1640 + // Every eligible source record is already in MetaSync.
1641 + if ($already_imported > 0 && $unsupported === 0) {
1642 + return [
1643 + 'success' => false,
1644 + 'message' => sprintf(
1645 + 'All %d eligible post(s) already have MetaSync schema — nothing left to import.',
1646 + $already_imported
1647 + ),
1648 + 'breakdown' => $breakdown,
1649 + ];
1650 + }
1651 +
1652 + // Source schema exists, but none of it maps to a supported type.
1653 + if ($unsupported > 0 && $already_imported === 0) {
1654 + return [
1655 + 'success' => false,
1656 + 'message' => sprintf(
1657 + 'Found %d post(s) with schema settings, but none use a supported schema type '
1658 + . '(Article, FAQPage, Product, Recipe) or their contents were empty.',
1659 + $unsupported
1660 + ),
1661 + 'breakdown' => $breakdown,
1662 + ];
1663 + }
1664 +
1665 + // Both skip reasons applied, nothing imported.
1666 + return [
1667 + 'success' => false,
1668 + 'message' => sprintf(
1669 + 'No schema settings imported: %d post(s) already had MetaSync schema and %d post(s) had unsupported or empty schema settings.',
1670 + $already_imported,
1671 + $unsupported
1672 + ),
1673 + 'breakdown' => $breakdown,
1674 + ];
1675 + }
1676 +
1677 + $message = sprintf('Successfully imported schema settings for %d post(s).', $imported);
1678 +
1679 + if ($already_imported > 0) {
1680 + $message .= sprintf(' Skipped %d post(s) that already had MetaSync schema.', $already_imported);
1681 + }
1682 + if ($unsupported > 0) {
1683 + $message .= sprintf(' Skipped %d post(s) with unsupported or empty schema settings.', $unsupported);
1684 + }
1685 +
1686 + return ['success' => true, 'message' => $message, 'breakdown' => $breakdown];
1182 1687 }
1183 1688
1184 1689 /**
1690 + * Fresh per-import counters shared by the three schema importers.
1691 + *
1692 + * `total_candidates` counts distinct posts the importer looked at, so a
1693 + * post with several source rows is one candidate. Posts already holding a
1694 + * MetaSync schema count as `already_imported`; source rows that carry no
1695 + * supported, populated schema count as `unsupported`.
1696 + *
1697 + * @return array{imported:int, already_imported:int, unsupported:int, total_candidates:int}
1698 + */
1699 + private function empty_schema_breakdown()
1700 + {
1701 + return [
1702 + 'imported' => 0,
1703 + 'already_imported' => 0,
1704 + 'unsupported' => 0,
1705 + 'total_candidates' => 0,
1706 + ];
1707 + }
1708 +
1709 + /**
1185 1710 * Import per-post schema from Yoast SEO
1711 + *
1712 + * Rows are grouped per post first, because a post can carry both source
1713 + * keys and the outcome must be decided once per post: a MetaSync schema
1714 + * that already exists wins outright; otherwise the full JSON payload under
1715 + * `_yoast_wpseo_schema` is preferred, and only when it yields nothing does
1716 + * the bare Premium article type under `_yoast_wpseo_schema_article_type`
1717 + * produce a placeholder article schema. Every other combination is
1718 + * unsupported.
1719 + *
1720 + * @return array{imported:int, already_imported:int, unsupported:int, total_candidates:int}
1186 1721 */
1187 1722 private function import_yoast_schema()
1188 1723 {
1189 - global $wpdb;
1190 - $imported_count = 0;
1724 + $breakdown = $this->empty_schema_breakdown();
1191 1725
1192 - // First, try to import from full schema JSON (free version or old approach)
1193 - $posts = $wpdb->get_results("
1194 - SELECT post_id, meta_value
1195 - FROM {$wpdb->postmeta}
1196 - WHERE meta_key = '_yoast_wpseo_schema'
1197 - AND post_id IN (SELECT ID FROM {$wpdb->posts} WHERE post_status = 'publish')
1198 - ");
1726 + // post_id => [meta_key => row]
1727 + $rows_by_post = [];
1728 + foreach ($this->yoast_schema_candidate_rows() as $row) {
1729 + $rows_by_post[(int) $row->post_id][$row->meta_key] = $row;
1730 + }
1199 1731
1200 - foreach ($posts as $post_obj) {
1201 - $post_id = $post_obj->post_id;
1202 -
1203 - // Check if Metasync schema already exists
1732 + foreach ($rows_by_post as $post_id => $rows) {
1733 + // A MetaSync schema that is already there outranks whatever the
1734 + // source plugin holds — the schema migration ran before (or an
1735 + // editor set it by hand) and overwriting it is not this tool's job.
1204 1736 $existing_schema = get_post_meta($post_id, 'metasync_schema_markup', true);
1205 - if (!empty($existing_schema) && !empty($existing_schema['types'])) {
1206 - continue; // Skip if already has Metasync schema
1207 - }
1208 -
1209 - // Decode Yoast schema JSON
1210 - $yoast_schema = json_decode((string)($post_obj->meta_value ?? ''), true);
1211 - if (empty($yoast_schema) || !is_array($yoast_schema)) {
1737 + if ($this->post_has_metasync_schema($post_id)) {
1738 + $breakdown['already_imported']++;
1212 1739 continue;
1213 1740 }
1214 1741
1215 - // Convert Yoast schema to Metasync format
1216 - $metasync_schema = $this->convert_yoast_schema_to_metasync($yoast_schema, $post_id);
1742 + $schema_row = $rows['_yoast_wpseo_schema'] ?? null;
1743 + $article_type_row = $rows['_yoast_wpseo_schema_article_type'] ?? null;
1217 1744
1218 - if (!empty($metasync_schema['types'])) {
1219 - update_post_meta($post_id, 'metasync_schema_markup', $metasync_schema);
1220 - $imported_count++;
1221 - }
1222 - }
1745 + // Full JSON payload first (free version, or the legacy root array).
1746 + if ($schema_row !== null
1747 + && $this->yoast_schema_source_is_supported($schema_row->meta_key, $schema_row->meta_value) !== null) {
1748 + $yoast_schema = json_decode((string) ($schema_row->meta_value ?? ''), true);
1749 + $metasync_schema = is_array($yoast_schema)
1750 + ? $this->convert_yoast_schema_to_metasync($yoast_schema, $post_id)
1751 + : ['types' => []];
1223 1752
1224 - // Second, try to import from schema type (Premium version)
1225 - $posts = $wpdb->get_results("
1226 - SELECT post_id, meta_value
1227 - FROM {$wpdb->postmeta}
1228 - WHERE meta_key = '_yoast_wpseo_schema_article_type'
1229 - AND post_id IN (SELECT ID FROM {$wpdb->posts} WHERE post_status = 'publish')
1230 - ");
1231 -
1232 - foreach ($posts as $post_obj) {
1233 - $post_id = $post_obj->post_id;
1234 -
1235 - // Check if Metasync schema already exists
1236 - $existing_schema = get_post_meta($post_id, 'metasync_schema_markup', true);
1237 - if (!empty($existing_schema) && !empty($existing_schema['types'])) {
1238 - continue; // Skip if already has Metasync schema
1753 + if (!empty($metasync_schema['types'])) {
1754 + update_post_meta($post_id, 'metasync_schema_markup', wp_slash(array_merge(is_array($existing_schema) ? $existing_schema : [], $metasync_schema)));
1755 + $breakdown['imported']++;
1756 + continue;
1757 + }
1239 1758 }
1240 1759
1241 - $schema_type = strtolower($post_obj->meta_value);
1242 -
1243 - // Create basic article schema with placeholders
1244 - // Yoast Premium generates schema dynamically, so we create a minimal version
1245 - if ($schema_type === 'article' || $schema_type === 'newsarticle' || $schema_type === 'blogposting') {
1760 + // Bare Premium article type: build a minimal article schema with
1761 + // placeholders, since Yoast Premium generates schema dynamically.
1762 + if ($article_type_row !== null
1763 + && $this->yoast_schema_source_is_supported($article_type_row->meta_key, $article_type_row->meta_value) !== null) {
1246 1764 $metasync_schema = [
1247 1765 'enabled' => true,
1248 1766 'types' => [
1249 1767 [
@@ -1258,102 +1776,115 @@
1258 1776 ]
1259 1777 ]
1260 1778 ];
1261 1779
1262 - update_post_meta($post_id, 'metasync_schema_markup', $metasync_schema);
1263 - $imported_count++;
1780 + update_post_meta($post_id, 'metasync_schema_markup', wp_slash(array_merge(is_array($existing_schema) ? $existing_schema : [], $metasync_schema)));
1781 + $breakdown['imported']++;
1782 + continue;
1264 1783 }
1784 +
1785 + $breakdown['unsupported']++;
1265 1786 }
1266 1787
1267 - return $imported_count;
1788 + $breakdown['total_candidates'] = count($rows_by_post);
1789 +
1790 + return $breakdown;
1268 1791 }
1269 1792
1270 1793 /**
1271 1794 * Import per-post schema from Rank Math
1795 + *
1796 + * Rows are grouped per post, mirroring check_schema_data(): a post with
1797 + * several `rank_math_schema_*` rows is a single candidate, imported from
1798 + * the first row that carries a supported, populated schema.
1799 + *
1800 + * @return array{imported:int, already_imported:int, unsupported:int, total_candidates:int}
1272 1801 */
1273 1802 private function import_rankmath_schema()
1274 1803 {
1275 - global $wpdb;
1276 - $imported_count = 0;
1804 + $breakdown = $this->empty_schema_breakdown();
1277 1805
1278 - // Get all posts with any Rank Math schema (dynamically detect schema types)
1279 - // Exclude shortcode schemas
1280 - $posts = $wpdb->get_results("
1281 - SELECT DISTINCT pm.post_id, pm.meta_key, pm.meta_value
1282 - FROM {$wpdb->postmeta} pm
1283 - WHERE pm.meta_key LIKE 'rank_math_schema_%'
1284 - AND pm.meta_key NOT LIKE 'rank_math_shortcode_schema_%'
1285 - AND pm.post_id IN (SELECT ID FROM {$wpdb->posts} WHERE post_status = 'publish')
1286 - ORDER BY pm.post_id
1287 - ");
1806 + $rows_by_post = [];
1807 + foreach ($this->rankmath_schema_candidate_rows() as $row) {
1808 + $rows_by_post[(int) $row->post_id][] = $row;
1809 + }
1288 1810
1289 - $processed_posts = [];
1811 + foreach ($rows_by_post as $post_id => $rows) {
1812 + $existing_schema = get_post_meta($post_id, 'metasync_schema_markup', true);
1813 + if ($this->post_has_metasync_schema($post_id)) {
1814 + $breakdown['already_imported']++;
1815 + continue;
1816 + }
1290 1817
1291 - foreach ($posts as $post_obj) {
1292 - $post_id = $post_obj->post_id;
1818 + $imported = false;
1293 1819
1294 - // Skip if we already processed this post
1295 - if (in_array($post_id, $processed_posts)) {
1296 - continue;
1297 - }
1820 + foreach ($rows as $row) {
1821 + if ($this->rankmath_schema_source_is_supported($row->meta_key, $row->meta_value) === null) {
1822 + continue;
1823 + }
1298 1824
1299 - // Check if Metasync schema already exists for this post
1300 - $existing_schema = get_post_meta($post_id, 'metasync_schema_markup', true);
1301 - if (!empty($existing_schema) && !empty($existing_schema['types'])) {
1302 - continue; // Skip if already has Metasync schema
1303 - }
1825 + // Extract schema type from meta key (e.g., rank_math_schema_BlogPosting -> BlogPosting)
1826 + $schema_type = str_replace('rank_math_schema_', '', $row->meta_key);
1304 1827
1305 - // Extract schema type from meta key (e.g., rank_math_schema_BlogPosting -> BlogPosting)
1306 - $schema_type = str_replace('rank_math_schema_', '', $post_obj->meta_key);
1828 + // Decode Rank Math schema
1829 + $rm_schema = maybe_unserialize($row->meta_value);
1830 + if (empty($rm_schema) || !is_array($rm_schema)) {
1831 + continue;
1832 + }
1307 1833
1308 - // Decode Rank Math schema
1309 - $rm_schema = maybe_unserialize($post_obj->meta_value);
1310 - if (empty($rm_schema) || !is_array($rm_schema)) {
1311 - continue;
1834 + // Convert Rank Math schema to Metasync format
1835 + $metasync_schema = $this->convert_rankmath_schema_to_metasync($rm_schema, $schema_type, $post_id);
1836 +
1837 + if (!empty($metasync_schema['types'])) {
1838 + update_post_meta($post_id, 'metasync_schema_markup', wp_slash(array_merge(is_array($existing_schema) ? $existing_schema : [], $metasync_schema)));
1839 + $breakdown['imported']++;
1840 + $imported = true;
1841 + break; // One schema block per post.
1842 + }
1312 1843 }
1313 1844
1314 - // Convert Rank Math schema to Metasync format
1315 - $metasync_schema = $this->convert_rankmath_schema_to_metasync($rm_schema, $schema_type, $post_id);
1316 -
1317 - if (!empty($metasync_schema['types'])) {
1318 - update_post_meta($post_id, 'metasync_schema_markup', $metasync_schema);
1319 - $imported_count++;
1320 - $processed_posts[] = $post_id; // Mark post as processed
1845 + if (!$imported) {
1846 + $breakdown['unsupported']++;
1321 1847 }
1322 1848 }
1323 1849
1324 - return $imported_count;
1850 + $breakdown['total_candidates'] = count($rows_by_post);
1851 +
1852 + return $breakdown;
1325 1853 }
1326 1854
1327 1855 /**
1328 1856 * Import per-post schema from AIOSEO
1857 + *
1858 + * `schema_type = 'default'` rows and rows whose schema options are empty
1859 + * never reach this loop — they are excluded by aioseo_schema_candidate_rows()
1860 + * for the detector and the importer alike, so the two can never disagree
1861 + * about what counts as a candidate.
1862 + *
1863 + * @return array{imported:int, already_imported:int, unsupported:int, total_candidates:int}
1329 1864 */
1330 1865 private function import_aioseo_schema()
1331 1866 {
1332 - global $wpdb;
1333 - $imported_count = 0;
1867 + $breakdown = $this->empty_schema_breakdown();
1334 1868
1335 - // Check if AIOSEO table exists
1336 - $table = $wpdb->prefix . 'aioseo_posts';
1337 - if ($wpdb->get_var("SHOW TABLES LIKE '$table'") !== $table) {
1338 - return 0;
1869 + // An absent AIOSEO table means there is nothing to import at all.
1870 + // Rows are keyed per post so the count matches check_schema_data(),
1871 + // which also counts distinct posts.
1872 + $rows_by_post = [];
1873 + foreach ($this->aioseo_schema_candidate_rows() as $aioseo_data) {
1874 + $rows_by_post[(int) $aioseo_data->post_id] = $aioseo_data;
1339 1875 }
1340 1876
1341 - // Get all posts with AIOSEO schema
1342 - $posts = $wpdb->get_results("
1343 - SELECT post_id, schema_type, schema_type_options
1344 - FROM {$table}
1345 - WHERE (schema_type IS NOT NULL AND schema_type != '')
1346 - AND post_id IN (SELECT ID FROM {$wpdb->posts} WHERE post_status = 'publish')
1347 - ");
1877 + foreach ($rows_by_post as $post_id => $aioseo_data) {
1878 + $existing_schema = get_post_meta($post_id, 'metasync_schema_markup', true);
1879 + if ($this->post_has_metasync_schema($post_id)) {
1880 + $breakdown['already_imported']++;
1881 + continue;
1882 + }
1348 1883
1349 - foreach ($posts as $aioseo_data) {
1350 - $post_id = $aioseo_data->post_id;
1351 -
1352 - // Check if Metasync schema already exists
1353 - $existing_schema = get_post_meta($post_id, 'metasync_schema_markup', true);
1354 - if (!empty($existing_schema) && !empty($existing_schema['types'])) {
1355 - continue; // Skip if already has Metasync schema
1884 + if ($this->aioseo_schema_source_is_supported($aioseo_data->schema_type, $aioseo_data->schema_type_options) === null) {
1885 + $breakdown['unsupported']++;
1886 + continue;
1356 1887 }
1357 1888
1358 1889 // Decode AIOSEO schema options
1359 1890 $schema_options = json_decode((string)($aioseo_data->schema_type_options ?? ''), true);
@@ -1368,18 +1899,28 @@
1368 1899 $post_id
1369 1900 );
1370 1901
1371 1902 if (!empty($metasync_schema['types'])) {
1372 - update_post_meta($post_id, 'metasync_schema_markup', $metasync_schema);
1373 - $imported_count++;
1903 + update_post_meta($post_id, 'metasync_schema_markup', wp_slash(array_merge(is_array($existing_schema) ? $existing_schema : [], $metasync_schema)));
1904 + $breakdown['imported']++;
1905 + } else {
1906 + $breakdown['unsupported']++;
1374 1907 }
1375 1908 }
1376 1909
1377 - return $imported_count;
1910 + $breakdown['total_candidates'] = count($rows_by_post);
1911 +
1912 + return $breakdown;
1378 1913 }
1379 1914
1380 1915 /**
1381 1916 * Convert Yoast schema to Metasync format
1917 + *
1918 + * Handles both storage shapes Yoast has used: the current `@graph`
1919 + * wrapper and the legacy root array of entries. Both are iterated through
1920 + * yoast_schema_graph_items(), which is also what the eligibility check
1921 + * walks — so a payload the detector counts is a payload the importer can
1922 + * convert.
1382 1923 */
1383 1924 private function convert_yoast_schema_to_metasync($yoast_schema, $post_id)
1384 1925 {
1385 1926 $metasync_schema = [
@@ -1386,12 +1927,14 @@
1386 1927 'enabled' => true,
1387 1928 'types' => []
1388 1929 ];
1389 1930
1390 - // Yoast stores schema as a graph array
1391 - if (isset($yoast_schema['@graph']) && is_array($yoast_schema['@graph'])) {
1392 - foreach ($yoast_schema['@graph'] as $item) {
1393 - if (!isset($item['@type'])) {
1931 + // Yoast stores schema as a graph array (legacy installs: a root array
1932 + // of entries, or a single root object, instead of an @graph wrapper).
1933 + $graph_items = $this->yoast_schema_graph_items($yoast_schema);
1934 + if ($graph_items !== []) {
1935 + foreach ($graph_items as $item) {
1936 + if (!is_array($item) || !isset($item['@type'])) {
1394 1937 continue;
1395 1938 }
1396 1939
1397 1940 $raw_type = $item['@type'];
@@ -1578,9 +2121,13 @@
1578 2121 'enabled' => true,
1579 2122 'types' => []
1580 2123 ];
1581 2124
1582 - $type = strtolower($schema_type);
2125 + // Normalise through the shared map so the article family
2126 + // (NewsArticle, BlogPosting) imports the same way the Yoast and Rank
2127 + // Math converters handle it — eligibility resolves them to 'article'
2128 + // too, and the two must agree on every type they let through.
2129 + $type = $this->supported_schema_type($schema_type);
1583 2130
1584 2131 if ($type === 'article') {
1585 2132 $metasync_schema['types'][] = [
1586 2133 'type' => 'article',
@@ -1591,9 +2138,9 @@
1591 2138 'organization_name' => isset($schema_options['organizationName']) ? $schema_options['organizationName'] : '',
1592 2139 'organization_logo' => isset($schema_options['organizationLogo']) ? $schema_options['organizationLogo'] : ''
1593 2140 ]
1594 2141 ];
1595 - } elseif ($type === 'faqpage') {
2142 + } elseif ($type === 'FAQPage') {
1596 2143 $faq_items = [];
1597 2144 if (isset($schema_options['questions']) && is_array($schema_options['questions'])) {
1598 2145 foreach ($schema_options['questions'] as $question) {
1599 2146 if (isset($question['question']) && isset($question['answer'])) {
@@ -1745,8 +2292,67 @@
1745 2292 return is_string($text) ? $text : $default;
1746 2293 }
1747 2294
1748 2295 /**
2296 + * Tokens whose value is the post's own body or excerpt.
2297 + *
2298 + * Keyed by source plugin. These are the only tokens that can carry the text
2299 + * a password withholds; everything else (title, author, dates, taxonomy) is
2300 + * already public on a protected post.
2301 + *
2302 + * @param string $plugin 'yoast', 'rankmath', or 'aioseo'.
2303 + * @return string[]
2304 + */
2305 + private function content_derived_tokens($plugin) {
2306 + switch ($plugin) {
2307 + case 'yoast':
2308 + return ['%%excerpt%%', '%%excerpt_only%%'];
2309 +
2310 + case 'rankmath':
2311 + return ['%excerpt%', '%excerpt_only%'];
2312 +
2313 + case 'aioseo':
2314 + return [
2315 + '#post_content',
2316 + '#post_excerpt',
2317 + '#post_excerpt_only',
2318 + '#attachment_description',
2319 + '#attachment_caption',
2320 + ];
2321 + }
2322 +
2323 + return [];
2324 + }
2325 +
2326 + /**
2327 + * Whether a raw template would publish text that a post password withholds.
2328 + *
2329 + * WordPress keeps a protected post's body and excerpt behind the password
2330 + * but leaves the post itself published, so an import walks straight past the
2331 + * usual visibility checks: the source plugin stores a template, we resolve it
2332 + * against the raw row, and the body ends up in a meta description that every
2333 + * visitor and crawler can read without ever entering the password.
2334 + *
2335 + * @param string $text Raw value from the source plugin.
2336 + * @param WP_Post $post Post the value belongs to.
2337 + * @param string $plugin Source plugin.
2338 + * @return bool
2339 + */
2340 + private function references_protected_content($text, $post, $plugin) {
2341 + if (empty($post->post_password)) {
2342 + return false;
2343 + }
2344 +
2345 + foreach ($this->content_derived_tokens($plugin) as $token) {
2346 + if (strpos($text, $token) !== false) {
2347 + return true;
2348 + }
2349 + }
2350 +
2351 + return false;
2352 + }
2353 +
2354 + /**
1749 2355 * Resolve SEO placeholder tokens to their actual values.
1750 2356 *
1751 2357 * Tries each source plugin's own replacement engine first so the result
1752 2358 * matches exactly what Yoast / Rank Math / AIOSEO would render. Falls back
@@ -1766,8 +2372,17 @@
1766 2372 if (!$post) {
1767 2373 return $text;
1768 2374 }
1769 2375
2376 + // Drop the whole value rather than resolve the content token to nothing
2377 + // and keep the rest. A half-template ("Title |") is worse than no import:
2378 + // it still occupies the meta key, and it still outranks whatever OTTO
2379 + // would have recommended for a page we know nothing publishable about.
2380 + // Callers skip empty values, so nothing is persisted.
2381 + if ($this->references_protected_content($text, $post, $plugin)) {
2382 + return '';
2383 + }
2384 +
1770 2385 // Yoast SEO — %%var%% tokens
1771 2386 if ($plugin === 'yoast' && class_exists('WPSEO_Replace_Vars')) {
1772 2387 try {
1773 2388 $replacer = new WPSEO_Replace_Vars();
@@ -1791,9 +2406,9 @@
1791 2406 // fall through to manual replacement
1792 2407 }
1793 2408 }
1794 2409
1795 - // All in One SEO — #var# tokens
2410 + // All in One SEO — #var tokens
1796 2411 if ($plugin === 'aioseo') {
1797 2412 try {
1798 2413 if (function_exists('aioseo') && isset(aioseo()->tags) && method_exists(aioseo()->tags, 'replaceTags')) {
1799 2414 $resolved = aioseo()->tags->replaceTags($text, $post_id);
@@ -1805,20 +2420,27 @@
1805 2420 // fall through to manual replacement
1806 2421 }
1807 2422 }
1808 2423
1809 - return $this->manually_replace_seo_placeholders($text, $post_id);
2424 + return $this->manually_replace_seo_placeholders($text, $post_id, $plugin);
1810 2425 }
1811 2426
1812 2427 /**
1813 2428 * Manual fallback: replace the most common SEO placeholder tokens from
1814 - * Yoast (%%var%%), Rank Math (%var%), and AIOSEO (#var#) formats.
2429 + * Yoast (%%var%%), Rank Math (%var%), and AIOSEO (#var) formats.
1815 2430 *
2431 + * AIOSEO tags are handled by resolve_aioseo_placeholders() because they
2432 + * need pattern matching rather than plain string replacement — see the
2433 + * docblock there.
2434 + *
1816 2435 * @param string $text Text that may contain placeholder tokens.
1817 2436 * @param int $post_id Post ID used for context.
2437 + * @param string $plugin Optional source plugin ('yoast', 'rankmath',
2438 + * 'aioseo') so the separator is read from the
2439 + * plugin the data actually came from.
1818 2440 * @return string Text with tokens replaced.
1819 2441 */
1820 - private function manually_replace_seo_placeholders($text, $post_id) {
2442 + private function manually_replace_seo_placeholders($text, $post_id, $plugin = '') {
1821 2443 $post = get_post($post_id);
1822 2444 if (!$post) {
1823 2445 return $text;
1824 2446 }
@@ -1825,9 +2447,9 @@
1825 2447
1826 2448 $site_name = get_bloginfo('name');
1827 2449 $post_title = get_the_title($post_id);
1828 2450 $post_excerpt = has_excerpt($post_id) ? wp_strip_all_tags(get_the_excerpt($post)) : '';
1829 - $author = get_the_author_meta('display_name', $post->post_author);
2451 + $author = get_the_author_meta('display_name', (int) $post->post_author);
1830 2452 $date = get_the_date('', $post_id);
1831 2453 $modified = get_the_modified_date('', $post_id);
1832 2454
1833 2455 $categories = get_the_category($post_id);
@@ -1835,30 +2457,9 @@
1835 2457
1836 2458 $tags = get_the_tags($post_id);
1837 2459 $first_tag = !empty($tags) ? $tags[0]->name : '';
1838 2460
1839 - // Try to read the separator from whichever plugin is active
1840 - $sep = '-';
1841 - if (defined('WPSEO_VERSION') && class_exists('WPSEO_Options')) {
1842 - try {
1843 - $raw = WPSEO_Options::get('separator', 'sc-dash');
1844 - // Yoast stores separator keys like 'sc-dash'; convert to glyph
1845 - // via the public get_separator_options() lookup table.
1846 - if (class_exists('WPSEO_Option_Titles')) {
1847 - $options = WPSEO_Option_Titles::get_instance()->get_separator_options();
1848 - if (isset($options[$raw])) {
1849 - $sep = html_entity_decode($options[$raw], ENT_QUOTES, 'UTF-8');
1850 - }
1851 - }
1852 - } catch (Exception $e) {
1853 - $sep = '-';
1854 - }
1855 - } elseif (defined('RANK_MATH_VERSION')) {
1856 - $rm_settings = get_option('rank_math_general_settings', []);
1857 - if (!empty($rm_settings['title_separator'])) {
1858 - $sep = html_entity_decode($rm_settings['title_separator'], ENT_QUOTES, 'UTF-8');
1859 - }
1860 - }
2461 + $sep = $this->resolve_source_separator($plugin);
1861 2462
1862 2463 $map = [
1863 2464 // ── Yoast (%%var%%) ──────────────────────────────────────────────
1864 2465 '%%title%%' => $post_title,
@@ -1889,19 +2490,8 @@
1889 2490 '%page%' => '',
1890 2491 '%category%' => $primary_category,
1891 2492 '%tag%' => $first_tag,
1892 2493 '%focus_keyword%' => (string) get_post_meta($post_id, 'rank_math_focus_keyword', true),
1893 - // ── AIOSEO (#var#) ───────────────────────────────────────────────
1894 - '#site_title#' => $site_name,
1895 - '#post_title#' => $post_title,
1896 - '#post_excerpt#' => $post_excerpt,
1897 - '#separator_sa#' => $sep,
1898 - '#author_name#' => $author,
1899 - '#current_date#' => $date,
1900 - '#post_date#' => $date,
1901 - '#category_title#' => $primary_category,
1902 - '#tag_title#' => $first_tag,
1903 - '#id#' => (string) $post_id,
1904 2494 ];
1905 2495
1906 2496 // Sort longest token first to avoid partial matches
1907 2497 // e.g. %%primary_category%% must replace before %%category%%
@@ -1908,12 +2498,1047 @@
1908 2498 uksort($map, function ($a, $b) {
1909 2499 return strlen($b) - strlen($a);
1910 2500 });
1911 2501
1912 - return str_replace(array_keys($map), array_values($map), $text);
2502 + $text = str_replace(array_keys($map), array_values($map), $text);
2503 +
2504 + // ── AIOSEO (#var) ────────────────────────────────────────────────────
2505 + // Only for AIOSEO data, or when the caller did not name a source. Yoast
2506 + // and Rank Math leave a literal '#categories' alone, so running this on
2507 + // their imports would rewrite text they would have preserved.
2508 + if ($plugin === 'aioseo' || $plugin === '') {
2509 + $text = $this->resolve_aioseo_placeholders($text, $post_id, $sep);
2510 + }
2511 +
2512 + return $text;
1913 2513 }
1914 2514
1915 2515 /**
2516 + * Resolve the title separator for the plugin the data came from.
2517 + *
2518 + * Each plugin stores its separator in its own option, so an AIOSEO import
2519 + * must not inherit Rank Math's separator just because Rank Math happens to
2520 + * still be active on the site. When the source is known we read only that
2521 + * plugin's setting and otherwise fall back to '-', which is the default
2522 + * every one of the three ships anyway.
2523 + *
2524 + * With no source named, keep the original precedence — whichever plugin is
2525 + * active, Yoast first — so callers that predate the $plugin argument see no
2526 + * behaviour change.
2527 + *
2528 + * @param string $plugin Source plugin ('yoast', 'rankmath', 'aioseo') or ''.
2529 + * @return string Separator glyph, defaulting to '-'.
2530 + */
2531 + private function resolve_source_separator($plugin = '') {
2532 + switch ($plugin) {
2533 + case 'yoast':
2534 + $sep = $this->get_yoast_separator();
2535 + return $sep !== '' ? $sep : '-';
2536 + case 'rankmath':
2537 + $sep = $this->get_rankmath_separator();
2538 + return $sep !== '' ? $sep : '-';
2539 + case 'aioseo':
2540 + $sep = $this->get_aioseo_separator();
2541 + return $sep !== '' ? $sep : '-';
2542 + }
2543 +
2544 + // Source unknown: original active-plugin precedence, including the
2545 + // class_exists() guard the old code used, so a site with WPSEO_VERSION
2546 + // defined but Yoast's classes unloaded still falls through to Rank Math
2547 + // exactly as before.
2548 + if (defined('WPSEO_VERSION') && class_exists('WPSEO_Options')) {
2549 + $sep = $this->get_yoast_separator();
2550 + return $sep !== '' ? $sep : '-';
2551 + }
2552 + if (defined('RANK_MATH_VERSION')) {
2553 + $sep = $this->get_rankmath_separator();
2554 + return $sep !== '' ? $sep : '-';
2555 + }
2556 +
2557 + return '-';
2558 + }
2559 +
2560 + /**
2561 + * Read Yoast's separator. Yoast stores separator keys like 'sc-dash';
2562 + * convert to a glyph via the public get_separator_options() lookup table.
2563 + *
2564 + * @return string Separator glyph, or '' when unavailable.
2565 + */
2566 + private function get_yoast_separator() {
2567 + if (!defined('WPSEO_VERSION') || !class_exists('WPSEO_Options') || !class_exists('WPSEO_Option_Titles')) {
2568 + return '';
2569 + }
2570 +
2571 + try {
2572 + $raw = WPSEO_Options::get('separator', 'sc-dash');
2573 + $options = WPSEO_Option_Titles::get_instance()->get_separator_options();
2574 + if (isset($options[$raw])) {
2575 + return html_entity_decode($options[$raw], ENT_QUOTES, 'UTF-8');
2576 + }
2577 + } catch (Exception $e) {
2578 + return '';
2579 + }
2580 +
2581 + return '';
2582 + }
2583 +
2584 + /**
2585 + * Read Rank Math's separator from its general settings option.
2586 + *
2587 + * @return string Separator glyph, or '' when unavailable.
2588 + */
2589 + private function get_rankmath_separator() {
2590 + if (!defined('RANK_MATH_VERSION')) {
2591 + return '';
2592 + }
2593 +
2594 + $settings = get_option('rank_math_general_settings', []);
2595 + if (is_array($settings) && !empty($settings['title_separator'])) {
2596 + return html_entity_decode($settings['title_separator'], ENT_QUOTES, 'UTF-8');
2597 + }
2598 +
2599 + return '';
2600 + }
2601 +
2602 + /**
2603 + * Read AIOSEO's separator from aioseo_options.
2604 + *
2605 + * Lives at searchAppearance.global.separator (NOT breadcrumbs.separator)
2606 + * and is stored HTML-entity encoded, e.g. '&#45;'. The option itself may
2607 + * be a JSON string or an already-decoded array depending on how it was
2608 + * written, so handle both. Read straight from the option rather than
2609 + * through aioseo() so it still works once AIOSEO is deactivated.
2610 + *
2611 + * @return string Separator glyph, or '' when unavailable.
2612 + */
2613 + private function get_aioseo_separator() {
2614 + $options = get_option('aioseo_options', '');
2615 + if (is_string($options) && $options !== '') {
2616 + $options = json_decode($options, true);
2617 + }
2618 + if (!is_array($options)) {
2619 + return '';
2620 + }
2621 +
2622 + $raw = $options['searchAppearance']['global']['separator'] ?? '';
2623 + if (!is_string($raw) || $raw === '') {
2624 + return '';
2625 + }
2626 +
2627 + return html_entity_decode($raw, ENT_QUOTES, 'UTF-8');
2628 + }
2629 +
2630 + /**
2631 + * AIOSEO's site-wide title / meta description templates, per post type.
2632 + *
2633 + * A post with no per-post override still gets a title and description from
2634 + * these — AIOSEO's own getPostDescription() falls back to the post type
2635 + * template before anything else. Reading only the per-post columns therefore
2636 + * imports nothing at all on a site that never overrode individual posts,
2637 + * which is the common case: templates are the default, overrides are the
2638 + * exception.
2639 + *
2640 + * Stored in the 'aioseo_options_dynamic' option, which may be a JSON string
2641 + * or an already-decoded array depending on how it was written — same as
2642 + * get_aioseo_separator() above, and read straight from the option so it keeps
2643 + * working once AIOSEO is deactivated.
2644 + *
2645 + * A post type is included only when AIOSEO is set to show SEO for it AND
2646 + * WordPress registers it as public. The public test is deliberately
2647 + * $obj->public rather than is_post_type_viewable(): a logging CPT registered
2648 + * public=false, publicly_queryable=true is "viewable" by that helper, and
2649 + * would drag hundreds of internal records into the import.
2650 + *
2651 + * @return array<string,array{title:string,description:string}> Keyed by post type.
2652 + */
2653 + private function get_aioseo_post_type_templates() {
2654 + $options = get_option('aioseo_options_dynamic', '');
2655 + if (is_string($options) && $options !== '') {
2656 + $options = json_decode($options, true);
2657 + }
2658 + if (!is_array($options)) {
2659 + return [];
2660 + }
2661 +
2662 + $post_types = $options['searchAppearance']['postTypes'] ?? [];
2663 + if (!is_array($post_types)) {
2664 + return [];
2665 + }
2666 +
2667 + $templates = [];
2668 +
2669 + foreach ($post_types as $post_type => $config) {
2670 + if (!is_array($config)) {
2671 + continue;
2672 + }
2673 +
2674 + // 'show' false means AIOSEO emits no SEO for the post type at all.
2675 + if (isset($config['show']) && !$config['show']) {
2676 + continue;
2677 + }
2678 +
2679 + $object = get_post_type_object($post_type);
2680 + if (!$object || empty($object->public)) {
2681 + continue;
2682 + }
2683 +
2684 + $title = isset($config['title']) && is_string($config['title']) ? $config['title'] : '';
2685 + $description = isset($config['metaDescription']) && is_string($config['metaDescription'])
2686 + ? $config['metaDescription']
2687 + : '';
2688 +
2689 + if ($title === '' && $description === '') {
2690 + continue;
2691 + }
2692 +
2693 + $templates[$post_type] = [
2694 + 'title' => $title,
2695 + 'description' => $description,
2696 + ];
2697 + }
2698 +
2699 + return $templates;
2700 + }
2701 +
2702 + /**
2703 + * Trim a template-derived meta description to a sane length.
2704 + *
2705 + * AIOSEO does not truncate — its sanitize() only collapses whitespace — so a
2706 + * post type whose template is '#post_content' renders the entire body as the
2707 + * description. Copying that verbatim into post meta would hand every page a
2708 + * multi-thousand-character description, so template-derived values are cut at
2709 + * a word boundary instead. Values the customer typed on the post itself are
2710 + * never passed through here.
2711 + *
2712 + * @param string $text Resolved description.
2713 + * @param int $limit Maximum length in characters.
2714 + * @return string Trimmed description.
2715 + */
2716 + private function truncate_meta_description($text, $limit = 160) {
2717 + $text = trim(preg_replace('/\s+/u', ' ', (string) $text));
2718 +
2719 + if ($text === '' || mb_strlen($text) <= $limit) {
2720 + return $text;
2721 + }
2722 +
2723 + // Leave room for the ellipsis so the result never exceeds $limit.
2724 + $clipped = mb_substr($text, 0, $limit - 1);
2725 +
2726 + // Cut back to the last whole word so the value never ends mid-word.
2727 + $last_space = mb_strrpos($clipped, ' ');
2728 + if ($last_space !== false && $last_space > 0) {
2729 + $clipped = mb_substr($clipped, 0, $last_space);
2730 + }
2731 +
2732 + $trimmed = rtrim($clipped, " \t\n\r\0\x0B.,;:!?-");
2733 +
2734 + // Punctuation-only input would otherwise collapse to a bare ellipsis.
2735 + return ($trimmed === '' ? $clipped : $trimmed) . '…';
2736 + }
2737 +
2738 + /**
2739 + * Every smart-tag id AIOSEO defines, taken from its own Tags class
2740 + * (all-in-one-seo-pack/app/Common/Utils/Tags.php) plus the ids the Pro
2741 + * build adds for WooCommerce.
2742 + *
2743 + * Used for detection as well as replacement: a tag missing from this list
2744 + * is neither resolved nor flagged, so it would be written to post meta as
2745 + * literal text. Restricting detection to AIOSEO's real vocabulary means
2746 + * ordinary text containing a hash — "#1 Rated Clinic", "#hashtag" — is
2747 + * never mistaken for a tag, and tokens AIOSEO does not define (#category_title,
2748 + * #tag_title) stay literal exactly as AIOSEO itself renders them.
2749 + *
2750 + * Supersets are safe in any order thanks to the negative lookahead used
2751 + * for matching: #post_date cannot consume the start of #post_date_w3c,
2752 + * nor #featured_image the start of #featured_image_url.
2753 + *
2754 + * @return string[]
2755 + */
2756 + private function get_aioseo_tag_ids() {
2757 + return [
2758 + 'alt_tag', 'archive_date', 'archive_title', 'attachment_caption',
2759 + 'attachment_description', 'author_bio', 'author_first_name',
2760 + 'author_last_name', 'author_link', 'author_link_alt', 'author_name',
2761 + 'author_url', 'blog_link', 'blog_title', 'categories', 'category',
2762 + 'category_link', 'category_link_alt', 'current_date', 'current_day',
2763 + 'current_month', 'current_year', 'custom_field', 'description',
2764 + 'event_end_date', 'event_start_date', 'featured_image',
2765 + 'featured_image_url', 'page_number', 'parent_title', 'permalink',
2766 + 'post_content', 'post_date', 'post_date_w3c', 'post_day',
2767 + 'post_excerpt', 'post_excerpt_only', 'post_link', 'post_link_alt',
2768 + 'post_modified_date', 'post_modified_date_w3c', 'post_month',
2769 + 'post_title', 'post_year', 'search_term', 'separator_sa',
2770 + 'site_description', 'site_link', 'site_link_alt', 'site_title',
2771 + 'tagline', 'tax_name', 'tax_parent_name', 'taxonomy_description',
2772 + 'taxonomy_title', 'woocommerce_brand', 'woocommerce_price',
2773 + 'woocommerce_sku',
2774 + ];
2775 + }
2776 +
2777 + /**
2778 + * Resolve AIOSEO smart tags to their values.
2779 + *
2780 + * AIOSEO denotes a tag with a single leading '#' and no closing delimiter
2781 + * (Tags::$denotationChar), ending the match with a negative lookahead so
2782 + * supersets do not collide — #post_excerpt must not consume the start of
2783 + * #post_excerpt_only, nor #post_link the start of #post_link_alt. We use
2784 + * the same rule here so results match what AIOSEO itself would render,
2785 + * and so replacement order is irrelevant.
2786 + *
2787 + * @param string $text Text that may contain AIOSEO tags.
2788 + * @param int $post_id Post ID used for context.
2789 + * @param string $sep Separator glyph for #separator_sa.
2790 + * @return string Text with AIOSEO tags replaced.
2791 + */
2792 + private function resolve_aioseo_placeholders($text, $post_id, $sep = '-') {
2793 + if (!is_string($text) || strpos($text, '#') === false) {
2794 + return (string) $text;
2795 + }
2796 +
2797 + $post = get_post($post_id);
2798 + if (!$post) {
2799 + return $text;
2800 + }
2801 +
2802 + // Tags that carry an argument have to be handled before the plain ones.
2803 + // The plain pattern's lookahead permits '-', so '#custom_field-price'
2804 + // would otherwise match bare '#custom_field' and leave an orphan
2805 + // '-price' glued to the resolved value. AIOSEO splits these out for the
2806 + // same reason (Tags::replaceTags() skips them, then parseCustomFields()
2807 + // and parseTaxonomyNames() run afterwards).
2808 + $text = $this->resolve_aioseo_parameterised_tags($text, $post_id);
2809 +
2810 + // Resolve only the tags the text actually references. Building every
2811 + // value up front meant generating an excerpt for every imported post,
2812 + // and excerpt generation runs the whole the_content filter chain — ~8x
2813 + // the cost per post on real (page-builder) content, for a value the
2814 + // template usually never mentions.
2815 + foreach ($this->get_aioseo_tag_ids() as $tag) {
2816 + $pattern = '/#' . preg_quote($tag, '/') . '(?![a-zA-Z0-9_])/i';
2817 + if (!preg_match($pattern, $text)) {
2818 + continue;
2819 + }
2820 +
2821 + $value = $this->resolve_aioseo_tag($tag, $post_id, $post, $sep);
2822 + if ($value === null) {
2823 + // Not resolvable outside AIOSEO. Leave it in place so
2824 + // has_unresolved_placeholders() can stop the write.
2825 + continue;
2826 + }
2827 +
2828 + // Escape backslashes first, then '$', so a value containing "$1"
2829 + // is not treated as a backreference by preg_replace().
2830 + $replacement = str_replace(['\\', '$'], ['\\\\', '\\$'], (string) $value);
2831 + $result = preg_replace($pattern, $replacement, $text);
2832 + if (is_string($result)) {
2833 + $text = $result;
2834 + }
2835 + }
2836 +
2837 + return $text;
2838 + }
2839 +
2840 + /**
2841 + * Resolve the two AIOSEO tags that take an argument after a hyphen:
2842 + * '#custom_field-{meta_key}' and '#tax_name-{taxonomy}'.
2843 + *
2844 + * Patterns and fallback order mirror AIOSEO's parseCustomFields() and
2845 + * parseTaxonomyNames(), including the detail that a bare '#custom_field' or
2846 + * '#tax_name' with no argument resolves to an empty string rather than
2847 + * being left in place.
2848 + *
2849 + * @param string $text Text that may contain parameterised tags.
2850 + * @param int $post_id Post ID used for context.
2851 + * @return string Text with parameterised tags replaced.
2852 + */
2853 + private function resolve_aioseo_parameterised_tags($text, $post_id) {
2854 + $text = preg_replace_callback(
2855 + '/#custom_field-([a-zA-Z0-9_-]+)/i',
2856 + function ($m) use ($post_id) {
2857 + return $this->resolve_aioseo_custom_field($m[1], $post_id);
2858 + },
2859 + $text
2860 + );
2861 +
2862 + $text = preg_replace_callback(
2863 + '/#tax_name-([a-zA-Z0-9_-]+)/i',
2864 + function ($m) use ($post_id) {
2865 + return $this->resolve_aioseo_taxonomy_name($m[1], $post_id);
2866 + },
2867 + $text
2868 + );
2869 +
2870 + // With no argument AIOSEO drops the token entirely.
2871 + $text = preg_replace('/#custom_field(?![a-zA-Z0-9_-])/i', '', (string) $text);
2872 + $text = preg_replace('/#tax_name(?![a-zA-Z0-9_-])/i', '', (string) $text);
2873 +
2874 + return (string) $text;
2875 + }
2876 +
2877 + /**
2878 + * Value of a custom field referenced by '#custom_field-{key}'.
2879 + *
2880 + * ACF is consulted first when present, matching AIOSEO's own order, so a
2881 + * field with both an ACF definition and raw post meta resolves the way the
2882 + * live site rendered it. Non-scalar values (arrays, objects) have no textual
2883 + * form and become an empty string.
2884 + *
2885 + * @param string $field_key Meta key captured from the tag.
2886 + * @param int $post_id Post ID.
2887 + * @return string Field value as text.
2888 + */
2889 + private function resolve_aioseo_custom_field($field_key, $post_id) {
2890 + $value = '';
2891 +
2892 + if (function_exists('get_field')) {
2893 + $value = get_field($field_key, $post_id);
2894 + }
2895 +
2896 + if (empty($value)) {
2897 + $value = get_post_meta($post_id, $field_key, true);
2898 + }
2899 +
2900 + return is_scalar($value) ? wp_strip_all_tags((string) $value) : '';
2901 + }
2902 +
2903 + /**
2904 + * Term name for the taxonomy referenced by '#tax_name-{taxonomy}'.
2905 + *
2906 + * AIOSEO prefers its own "primary term" for the taxonomy and falls back to
2907 + * the first assigned term. We have no primary-term store to read once
2908 + * AIOSEO is gone, so the first assigned term is used directly.
2909 + *
2910 + * @param string $taxonomy Taxonomy slug captured from the tag.
2911 + * @param int $post_id Post ID.
2912 + * @return string Term name, or '' when unavailable.
2913 + */
2914 + private function resolve_aioseo_taxonomy_name($taxonomy, $post_id) {
2915 + if (!taxonomy_exists($taxonomy)) {
2916 + return '';
2917 + }
2918 +
2919 + $terms = get_the_terms($post_id, $taxonomy);
2920 + if (empty($terms) || is_wp_error($terms)) {
2921 + return '';
2922 + }
2923 +
2924 + $term = reset($terms);
2925 +
2926 + return (string) $term->name;
2927 + }
2928 +
2929 + /**
2930 + * Value for a single AIOSEO tag in the context of one post.
2931 + *
2932 + * Every tag AIOSEO can render for a post is resolved here. The two that take
2933 + * an argument (#custom_field, #tax_name) are handled before this switch and
2934 + * so return null, which callers treat as "leave in place" — a leftover then
2935 + * gets reported and the write skipped rather than saved half-resolved.
2936 + *
2937 + * @param string $tag AIOSEO tag id, without the leading '#'.
2938 + * @param int $post_id Post ID.
2939 + * @param WP_Post $post Post object.
2940 + * @param string $sep Separator glyph.
2941 + * @return string|null Replacement value, or null if unresolvable.
2942 + */
2943 + private function resolve_aioseo_tag($tag, $post_id, $post, $sep) {
2944 + // Second line of defence behind the whole-value check in
2945 + // resolve_seo_placeholders(). Any future caller that reaches a single
2946 + // tag directly still cannot read out a protected post's body.
2947 + if (!empty($post->post_password)
2948 + && in_array('#' . $tag, $this->content_derived_tokens('aioseo'), true)) {
2949 + return '';
2950 + }
2951 +
2952 + switch ($tag) {
2953 + case 'site_title':
2954 + case 'blog_title':
2955 + return (string) get_bloginfo('name');
2956 +
2957 + case 'tagline':
2958 + case 'site_description':
2959 + return (string) get_bloginfo('description');
2960 +
2961 + case 'post_title':
2962 + return (string) get_the_title($post_id);
2963 +
2964 + case 'parent_title':
2965 + $parent = isset($post->post_parent) ? (int) $post->post_parent : 0;
2966 + return $parent ? (string) get_the_title($parent) : '';
2967 +
2968 + case 'post_excerpt_only':
2969 + // Manual excerpt only — AIOSEO never falls back for this one.
2970 + return isset($post->post_excerpt)
2971 + ? $this->strip_builder_markup((string) $post->post_excerpt)
2972 + : '';
2973 +
2974 + case 'post_excerpt':
2975 + // Manual excerpt if set, otherwise a content-derived one, which
2976 + // is what AIOSEO does. This is the expensive branch, so it only
2977 + // runs when the template actually references the tag.
2978 + $manual = isset($post->post_excerpt) ? (string) $post->post_excerpt : '';
2979 + return $this->strip_builder_markup(
2980 + $manual !== '' ? $manual : (string) get_the_excerpt($post)
2981 + );
2982 +
2983 + case 'post_content':
2984 + return $this->strip_builder_markup((string) $post->post_content);
2985 +
2986 + case 'separator_sa':
2987 + return (string) $sep;
2988 +
2989 + case 'author_name':
2990 + return (string) get_the_author_meta('display_name', (int) $post->post_author);
2991 + case 'author_first_name':
2992 + return (string) get_the_author_meta('first_name', (int) $post->post_author);
2993 + case 'author_last_name':
2994 + return (string) get_the_author_meta('last_name', (int) $post->post_author);
2995 + case 'author_bio':
2996 + return (string) get_the_author_meta('description', (int) $post->post_author);
2997 +
2998 + case 'author_link':
2999 + case 'author_link_alt':
3000 + case 'author_url':
3001 + $author = isset($post->post_author) ? (int) $post->post_author : 0;
3002 + return $author ? (string) get_author_posts_url($author) : '';
3003 +
3004 + case 'current_date':
3005 + $format = get_option('date_format');
3006 + $format = (is_string($format) && $format !== '') ? $format : 'F j, Y';
3007 + return (string) date_i18n($format);
3008 + case 'current_day':
3009 + return (string) date_i18n('d');
3010 + case 'current_month':
3011 + return (string) date_i18n('F');
3012 + case 'current_year':
3013 + return (string) date_i18n('Y');
3014 +
3015 + case 'post_date':
3016 + return (string) get_the_date('', $post_id);
3017 + case 'post_day':
3018 + return (string) get_the_date('d', $post_id);
3019 + case 'post_month':
3020 + return (string) get_the_date('F', $post_id);
3021 + case 'post_year':
3022 + return (string) get_the_date('Y', $post_id);
3023 +
3024 + case 'permalink':
3025 + case 'post_link':
3026 + case 'post_link_alt':
3027 + return (string) get_permalink($post_id);
3028 +
3029 + case 'site_link':
3030 + case 'site_link_alt':
3031 + case 'blog_link':
3032 + return (string) home_url();
3033 +
3034 + case 'categories':
3035 + $names = [];
3036 + foreach ($this->get_post_categories($post_id) as $category) {
3037 + if (isset($category->name)) {
3038 + $names[] = $category->name;
3039 + }
3040 + }
3041 + return implode(', ', $names);
3042 +
3043 + case 'category':
3044 + case 'taxonomy_title':
3045 + $categories = $this->get_post_categories($post_id);
3046 + return !empty($categories) && isset($categories[0]->name) ? (string) $categories[0]->name : '';
3047 +
3048 + case 'taxonomy_description':
3049 + $categories = $this->get_post_categories($post_id);
3050 + return !empty($categories) && isset($categories[0]->description) ? (string) $categories[0]->description : '';
3051 +
3052 + case 'category_link':
3053 + case 'category_link_alt':
3054 + $categories = $this->get_post_categories($post_id);
3055 + return !empty($categories) && isset($categories[0]->term_id)
3056 + ? (string) get_category_link($categories[0]->term_id)
3057 + : '';
3058 +
3059 + case 'featured_image':
3060 + return (string) get_the_post_thumbnail_url($post_id, 'full');
3061 +
3062 + case 'featured_image_url':
3063 + $thumbnail_id = get_post_thumbnail_id($post_id);
3064 + if (!$thumbnail_id) {
3065 + return '';
3066 + }
3067 + $src = wp_get_attachment_image_src($thumbnail_id, 'full');
3068 + return (is_array($src) && !empty($src[0])) ? (string) $src[0] : '';
3069 +
3070 + case 'alt_tag':
3071 + // AIOSEO reads the alt off the post id itself, not off the
3072 + // featured image's attachment. Mirror that: on an ordinary post
3073 + // this is empty, which is what the live site rendered.
3074 + return (string) get_post_meta($post_id, '_wp_attachment_image_alt', true);
3075 +
3076 + case 'attachment_caption':
3077 + return (string) wp_get_attachment_caption($post_id);
3078 +
3079 + case 'attachment_description':
3080 + return $this->strip_builder_markup((string) $post->post_content);
3081 +
3082 + case 'post_modified_date':
3083 + return (string) get_the_modified_date('', $post_id);
3084 +
3085 + case 'post_date_w3c':
3086 + return (string) mysql2date(DATE_W3C, $post->post_date, false);
3087 +
3088 + case 'post_modified_date_w3c':
3089 + return (string) mysql2date(DATE_W3C, $post->post_modified, false);
3090 +
3091 + case 'woocommerce_sku':
3092 + return (string) get_post_meta($post_id, '_sku', true);
3093 +
3094 + case 'woocommerce_price':
3095 + return (string) get_post_meta($post_id, '_price', true);
3096 +
3097 + // AIOSEO renders these empty in a single-post context.
3098 + case 'description':
3099 + case 'page_number':
3100 + case 'search_term':
3101 + case 'archive_date':
3102 + case 'archive_title':
3103 + // Term-context only. AIOSEO resolves #tax_parent_name off a term id,
3104 + // so it is empty for a post.
3105 + case 'tax_parent_name':
3106 + // Supplied by AIOSEO's event add-on, which has no data to read here.
3107 + case 'event_start_date':
3108 + case 'event_end_date':
3109 + case 'woocommerce_brand':
3110 + return '';
3111 + }
3112 +
3113 + // #custom_field and #tax_name take an argument and are resolved ahead of
3114 + // this switch, in resolve_aioseo_parameterised_tags().
3115 + return null;
3116 + }
3117 +
3118 + /**
3119 + * Reduce raw post content to plain prose.
3120 + *
3121 + * Page-builder pages are almost entirely shortcode markup, so a description
3122 + * template built on the content imports as '[et_pb_section][et_pb_row]…'
3123 + * without this. AIOSEO strips shortcodes too, but strip_shortcodes() only
3124 + * removes tags that are *registered* at the time it runs, and a builder
3125 + * registers its own only in the contexts it renders in — not necessarily
3126 + * during an import request. So sweep any remaining shortcode-shaped tokens
3127 + * as well, which also covers content left behind by a builder that is no
3128 + * longer installed.
3129 + *
3130 + * @param string $content Raw post content.
3131 + * @return string Plain text.
3132 + */
3133 + private function strip_builder_markup($content) {
3134 + $content = strip_shortcodes($content);
3135 +
3136 + // Opening/closing shortcode-shaped tokens: [tag], [tag a="b"], [/tag].
3137 + $content = preg_replace('/\[\/?[a-z][a-z0-9_-]*(?:\s[^\]]*)?\]/i', ' ', (string) $content);
3138 +
3139 + return trim(preg_replace('/\s+/u', ' ', wp_strip_all_tags((string) $content)));
3140 + }
3141 +
3142 + /**
3143 + * Categories for a post, normalised to an array.
3144 + *
3145 + * @param int $post_id Post ID.
3146 + * @return array
3147 + */
3148 + private function get_post_categories($post_id) {
3149 + $categories = get_the_category($post_id);
3150 + return is_array($categories) ? $categories : [];
3151 + }
3152 +
3153 + /**
3154 + * Whether a value still contains AIOSEO tags after resolution.
3155 + *
3156 + * Callers use this to skip the write instead of persisting a literal
3157 + * token such as '#post_title' as a page title. A tag that legitimately
3158 + * resolves to an empty string is gone from the text and so is not
3159 + * reported here.
3160 + *
3161 + * Only AIOSEO is checked — see the fall-through comment at the end for why
3162 + * Yoast and Rank Math are excluded.
3163 + *
3164 + * @param string $text Resolved text.
3165 + * @param string $plugin Source plugin; only 'aioseo' is checked.
3166 + * @return bool True when at least one tag survived.
3167 + */
3168 + private function has_unresolved_placeholders($text, $plugin) {
3169 + if (!is_string($text) || $text === '') {
3170 + return false;
3171 + }
3172 +
3173 + switch ($plugin) {
3174 + case 'aioseo':
3175 + if (strpos($text, '#') === false) {
3176 + return false;
3177 + }
3178 + foreach ($this->get_aioseo_tag_ids() as $tag) {
3179 + if (preg_match('/#' . preg_quote($tag, '/') . '(?![a-zA-Z0-9_])/i', $text)) {
3180 + return true;
3181 + }
3182 + }
3183 + return false;
3184 + }
3185 +
3186 + // Yoast and Rank Math deliberately fall through. Their manual fallback
3187 + // maps cover only a fraction of the variables those plugins define
3188 + // (16 of ~60 for Yoast, 12 of 49 for Rank Math), so treating a leftover
3189 + // token as a reason to skip would drop common real-world titles
3190 + // wholesale — "Best Dentist in %currentyear% %sep% %sitename%" resolves
3191 + // only partly and would import as nothing at all. Until those maps are
3192 + // filled in, their existing behaviour (save the partly-resolved value)
3193 + // is the lesser evil and is left untouched.
3194 + return false;
3195 + }
3196 +
3197 + /**
3198 + * Resolve an imported value and decide whether it is safe to persist.
3199 + *
3200 + * Returns null when a placeholder survived resolution, so the caller skips
3201 + * the write rather than saving a literal '#post_title' that would then
3202 + * render as the page title and outrank OTTO's recommendation. Skipped
3203 + * values are collected in $unresolved so the import report can surface
3204 + * them.
3205 + *
3206 + * @param string $raw Raw value from the source plugin.
3207 + * @param int $post_id Post ID used for context.
3208 + * @param string $plugin Source plugin ('yoast', 'rankmath', 'aioseo').
3209 + * @param string $meta_key Destination meta key, for the report.
3210 + * @param array $unresolved Collected failures, appended to by reference.
3211 + * @return string|null Resolved value, or null when it must be skipped.
3212 + */
3213 + private function resolve_import_value($raw, $post_id, $plugin, $meta_key, array &$unresolved) {
3214 + $resolved = $this->resolve_seo_placeholders($raw, $post_id, $plugin);
3215 +
3216 + if ($this->has_unresolved_placeholders($resolved, $plugin)) {
3217 + $unresolved[] = [
3218 + 'post_id' => (int) $post_id,
3219 + 'meta_key' => $meta_key,
3220 + 'raw' => (string) $raw,
3221 + 'resolved' => (string) $resolved,
3222 + ];
3223 +
3224 + if (defined('WP_DEBUG') && WP_DEBUG) {
3225 + error_log(sprintf( // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_error_log -- debug-gated, no secrets
3226 + 'MetaSync importer: unresolved %s placeholder for post %d (%s) — %s',
3227 + $plugin,
3228 + (int) $post_id,
3229 + $meta_key,
3230 + (string) $raw
3231 + ));
3232 + }
3233 +
3234 + return null;
3235 + }
3236 +
3237 + return $resolved;
3238 + }
3239 +
3240 + /**
3241 + * Sanitize an imported value according to what its destination key holds.
3242 + *
3243 + * Kept in one place because the post and term writers must agree: they are
3244 + * two copies of the same rule, and the pair has already had to be patched in
3245 + * lockstep once (image keys were reaching the free-text sanitizer).
3246 + *
3247 + * An image key goes through esc_url_raw(), which returns '' for anything it
3248 + * will not vouch for — a bare word, a javascript: scheme, a mangled host.
3249 + * Callers must treat that '' as "could not sanitize", not as "empty value";
3250 + * the two mean different things to an overwrite run.
3251 + *
3252 + * @param string $value Resolved value from the source plugin.
3253 + * @param string $meta_key Imported destination key.
3254 + * @return string Sanitized value, or '' if it did not survive.
3255 + */
3256 + private function sanitize_imported_value($value, $meta_key) {
3257 + if ($meta_key === Metasync_Seo_Precedence::KEY_IMPORTED_TITLE) {
3258 + return sanitize_text_field($value);
3259 + }
3260 +
3261 + if (in_array($meta_key, array(
3262 + Metasync_Seo_Precedence::KEY_IMPORTED_OG_IMAGE,
3263 + Metasync_Seo_Precedence::KEY_IMPORTED_TWITTER_IMAGE,
3264 + ), true)) {
3265 + return esc_url_raw($value);
3266 + }
3267 +
3268 + return sanitize_textarea_field($value);
3269 + }
3270 +
3271 + /**
3272 + * Persist an imported title or description on its low-priority key.
3273 + *
3274 + * Every importer routes through here so the three source plugins cannot
3275 + * drift apart on the rules that matter: imported values never land on the
3276 + * customer-override keys, a value that resolves to nothing is not written,
3277 + * and an overwrite run clears a now-stale value instead of preserving it.
3278 + *
3279 + * @param int $post_id Post being imported.
3280 + * @param string $raw Raw value from the source plugin.
3281 + * @param string $plugin 'yoast', 'rankmath', or 'aioseo'.
3282 + * @param string $meta_key Imported destination key.
3283 + * @param bool $overwrite Whether the run replaces existing values.
3284 + * @param array $unresolved Collected failures, appended to by reference.
3285 + * @param bool $truncate Trim to meta-description length first.
3286 + * @return bool Whether the post's meta changed.
3287 + */
3288 + private function store_imported_post_value($post_id, $raw, $plugin, $meta_key, $overwrite, array &$unresolved, $truncate = false) {
3289 + if ($raw === '') {
3290 + return false;
3291 + }
3292 +
3293 + $existing = get_post_meta($post_id, $meta_key, true);
3294 + if (!empty($existing) && !$overwrite) {
3295 + return false;
3296 + }
3297 +
3298 + $resolved = $this->resolve_import_value($raw, $post_id, $plugin, $meta_key, $unresolved);
3299 +
3300 + if ($resolved !== null && $truncate) {
3301 + $resolved = $this->truncate_meta_description($resolved);
3302 + }
3303 +
3304 + if ($resolved !== null && trim($resolved) !== '') {
3305 + $sanitized = $this->sanitize_imported_value($resolved, $meta_key);
3306 +
3307 + // The source gave us something, but it could not survive
3308 + // sanitization — an og:image/twitter:image URL rejected by
3309 + // esc_url_raw() is the case this guards. Writing the resulting ''
3310 + // would blank a good stored image and still report the import as a
3311 + // success. Skip instead: no write, no success, and whatever is
3312 + // already stored stays. A genuinely empty source is a different
3313 + // thing and is handled by the overwrite branch below.
3314 + if ($sanitized === '') {
3315 + return false;
3316 + }
3317 +
3318 + // update_post_meta() unslashes what it is given, so a value holding
3319 + // a backslash ("AC\DC") would be stored stripped ("ACDC"). Slash it
3320 + // here so the round trip through meta storage is lossless.
3321 + update_post_meta($post_id, $meta_key, wp_slash($sanitized));
3322 + return true;
3323 + }
3324 +
3325 + // Overwrite means "make this match the source". The source now yields
3326 + // nothing, so a value left from an earlier run is stale — clear it so
3327 + // re-importing repairs rather than preserves. Only ever touches the
3328 + // imported key, never anything the customer typed.
3329 + if ($overwrite && !empty($existing)) {
3330 + delete_post_meta($post_id, $meta_key);
3331 + return true;
3332 + }
3333 +
3334 + return false;
3335 + }
3336 +
3337 + /**
3338 + * Resolve placeholder tokens in a value imported for a taxonomy term.
3339 + *
3340 + * The post resolver cannot be reused. Every token it answers comes off a
3341 + * WP_Post, and a term has no post to answer from — asking it would either
3342 + * blank the value or, worse, resolve it against whatever post happens to
3343 + * share the term's ID. The vocabularies barely overlap anyway: a term
3344 + * template is built from the term's own name and description, so this is a
3345 + * deliberately small, separate map.
3346 + *
3347 + * @param string $text Raw value from the source plugin.
3348 + * @param WP_Term $term Term the value belongs to.
3349 + * @param string $plugin 'yoast', 'rankmath', or 'aioseo'.
3350 + * @return string Resolved string.
3351 + */
3352 + private function resolve_term_placeholders($text, $term, $plugin) {
3353 + if (empty($text) || empty($term->term_id)) {
3354 + return (string) $text;
3355 + }
3356 +
3357 + // Yoast and Rank Math both accept a term in place of a post, so their
3358 + // own engines still give the exact string the source site rendered.
3359 + if ($plugin === 'yoast' && class_exists('WPSEO_Replace_Vars')) {
3360 + try {
3361 + $replacer = new WPSEO_Replace_Vars();
3362 + $resolved = $replacer->replace($text, $term);
3363 + if (is_string($resolved) && $resolved !== '') {
3364 + return $resolved;
3365 + }
3366 + } catch (Exception $e) {
3367 + // fall through to manual replacement
3368 + }
3369 + }
3370 +
3371 + if ($plugin === 'rankmath' && function_exists('rank_math_replace_vars')) {
3372 + try {
3373 + $resolved = rank_math_replace_vars($text, $term);
3374 + if (is_string($resolved) && $resolved !== '') {
3375 + return $resolved;
3376 + }
3377 + } catch (Exception $e) {
3378 + // fall through to manual replacement
3379 + }
3380 + }
3381 +
3382 + // AIOSEO's replaceTags() takes a post ID. Handing it a term ID does not
3383 + // fail — it resolves against whatever post shares that ID and returns
3384 + // another page's title, so the native engine is deliberately skipped
3385 + // here and the manual map below is the only path for AIOSEO terms.
3386 + return $this->manually_replace_term_placeholders($text, $term, $plugin);
3387 + }
3388 +
3389 + /**
3390 + * Manual token replacement for term values.
3391 + *
3392 + * @param string $text
3393 + * @param WP_Term $term
3394 + * @param string $plugin
3395 + * @return string
3396 + */
3397 + private function manually_replace_term_placeholders($text, $term, $plugin) {
3398 + $site_name = (string) get_bloginfo('name');
3399 + $site_desc = (string) get_bloginfo('description');
3400 + $sep = $this->resolve_source_separator($plugin);
3401 + $year = (string) gmdate('Y');
3402 +
3403 + $term_name = (string) $term->name;
3404 + $term_desc = wp_strip_all_tags((string) $term->description);
3405 +
3406 + $map = [
3407 + // ── Yoast (%%var%%) ──────────────────────────────────────────────
3408 + '%%term_title%%' => $term_name,
3409 + '%%term_description%%' => $term_desc,
3410 + '%%category%%' => $term_name,
3411 + '%%category_description%%' => $term_desc,
3412 + '%%tag%%' => $term_name,
3413 + '%%sitename%%' => $site_name,
3414 + '%%sitedesc%%' => $site_desc,
3415 + '%%sep%%' => $sep,
3416 + '%%currentyear%%' => $year,
3417 + '%%page%%' => '',
3418 + '%%pagenumber%%' => '',
3419 + '%%pagetotal%%' => '',
3420 + // ── Rank Math (%var%) ────────────────────────────────────────────
3421 + '%term%' => $term_name,
3422 + '%term_description%' => $term_desc,
3423 + '%category%' => $term_name,
3424 + '%tag%' => $term_name,
3425 + '%sitename%' => $site_name,
3426 + '%sitedesc%' => $site_desc,
3427 + '%sep%' => $sep,
3428 + '%currentyear%' => $year,
3429 + '%page%' => '',
3430 + // ── AIOSEO (#var) ────────────────────────────────────────────────
3431 + '#taxonomy_title' => $term_name,
3432 + '#taxonomy_description' => $term_desc,
3433 + '#archive_title' => $term_name,
3434 + '#site_title' => $site_name,
3435 + '#blog_title' => $site_name,
3436 + '#site_description' => $site_desc,
3437 + '#tagline' => $site_desc,
3438 + '#separator_sa' => $sep,
3439 + '#current_year' => $year,
3440 + '#page_number' => '',
3441 + ];
3442 +
3443 + // Longest token first, so a short token never eats the start of a
3444 + // longer one (#site_title must not consume #site_description).
3445 + uksort($map, function ($a, $b) {
3446 + return strlen($b) - strlen($a);
3447 + });
3448 +
3449 + $resolved = str_replace(array_keys($map), array_values($map), $text);
3450 +
3451 + return trim(preg_replace('/\s+/', ' ', $resolved));
3452 + }
3453 +
3454 + /**
3455 + * Persist an imported term title or description on its low-priority key.
3456 + *
3457 + * Mirrors store_imported_post_value(): imported values never land on the
3458 + * key that means "the customer set this", a value that resolves to nothing
3459 + * is not written, and an overwrite run clears a now-stale value.
3460 + *
3461 + * @param WP_Term $term Term being imported.
3462 + * @param string $raw Raw value from the source plugin.
3463 + * @param string $plugin 'yoast', 'rankmath', or 'aioseo'.
3464 + * @param string $meta_key Imported destination key.
3465 + * @param bool $overwrite Whether the run replaces existing values.
3466 + * @return bool Whether the term's meta changed.
3467 + */
3468 + private function store_imported_term_value($term, $raw, $plugin, $meta_key, $overwrite) {
3469 + if ($raw === '') {
3470 + return false;
3471 + }
3472 +
3473 + $term_id = (int) $term->term_id;
3474 + $existing = get_term_meta($term_id, $meta_key, true);
3475 + if (!empty($existing) && !$overwrite) {
3476 + return false;
3477 + }
3478 +
3479 + $resolved = $this->resolve_term_placeholders($raw, $term, $plugin);
3480 +
3481 + // A token we do not know would otherwise be stored literally and render
3482 + // as '#taxonomy_title' on the archive — the defect this path exists to
3483 + // prevent. Skipping leaves the slot free for OTTO.
3484 + if ($this->has_unresolved_placeholders($resolved, $plugin)) {
3485 + return false;
3486 + }
3487 +
3488 + if (trim($resolved) !== '') {
3489 + $sanitized = $this->sanitize_imported_value($resolved, $meta_key);
3490 +
3491 + // See store_imported_post_value(): a value the source supplied but
3492 + // sanitization rejected must not blank an existing one, and must
3493 + // not count as a successful update.
3494 + if ($sanitized === '') {
3495 + return false;
3496 + }
3497 +
3498 + // update_term_meta() unslashes what it stores; slash first so a
3499 + // backslash in the value survives the round trip.
3500 + update_term_meta($term_id, $meta_key, wp_slash($sanitized));
3501 + return true;
3502 + }
3503 +
3504 + if ($overwrite && !empty($existing)) {
3505 + delete_term_meta($term_id, $meta_key);
3506 + return true;
3507 + }
3508 +
3509 + return false;
3510 + }
3511 +
3512 + /**
3513 + * Add unresolved-placeholder reporting to an import result.
3514 + *
3515 + * @param array $result Result array to augment.
3516 + * @param array $unresolved Failures collected during the batch.
3517 + * @return array Result with the report attached.
3518 + */
3519 + private function attach_unresolved_report(array $result, array $unresolved) {
3520 + $count = count($unresolved);
3521 + $result['unresolved'] = $count;
3522 +
3523 + if ($count === 0) {
3524 + return $result;
3525 + }
3526 +
3527 + // Keep the payload small — a few examples are enough to diagnose.
3528 + $result['unresolved_samples'] = array_slice($unresolved, 0, 5);
3529 +
3530 + if (!empty($result['message'])) {
3531 + $result['message'] .= sprintf(
3532 + ' %d value(s) skipped because placeholders could not be resolved.',
3533 + $count
3534 + );
3535 + }
3536 +
3537 + return $result;
3538 + }
3539 +
3540 + /**
1916 3541 * Import SEO Metadata (Titles and Descriptions)
1917 3542 * Supports batch processing via AJAX
1918 3543 *
1919 3544 * @param string $plugin Plugin to import from (yoast, rankmath, aioseo)
@@ -1997,22 +3622,23 @@
1997 3622 ];
1998 3623 }
1999 3624
2000 3625 // Get total count (for progress tracking)
2001 - $meta_keys_placeholders = implode(',', array_fill(0, count($meta_keys), '%s'));
2002 - $total_posts = (int) $wpdb->get_var($wpdb->prepare("
3626 + // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- one-shot import tool — bulk reads from third-party SEO plugin storage; no bulk WordPress API exists
3627 + $total_posts = (int) $wpdb->get_var($wpdb->prepare('
2003 3628 SELECT COUNT(DISTINCT post_id)
2004 - FROM {$wpdb->postmeta}
2005 - WHERE meta_key IN ($meta_keys_placeholders)
3629 + FROM ' . $wpdb->postmeta . '
3630 + WHERE meta_key IN (' . implode(',', array_fill(0, count($meta_keys), '%s')) . ")
2006 3631 AND meta_value != ''
2007 3632 AND post_id IN (SELECT ID FROM {$wpdb->posts} WHERE post_status = 'publish')
2008 3633 ", $meta_keys));
2009 3634
2010 3635 // Get batch of posts with Yoast data
2011 - $posts = $wpdb->get_results($wpdb->prepare("
3636 + // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- one-shot import tool — bulk reads from third-party SEO plugin storage; no bulk WordPress API exists
3637 + $posts = $wpdb->get_results($wpdb->prepare('
2012 3638 SELECT DISTINCT post_id
2013 - FROM {$wpdb->postmeta}
2014 - WHERE meta_key IN ($meta_keys_placeholders)
3639 + FROM ' . $wpdb->postmeta . '
3640 + WHERE meta_key IN (' . implode(',', array_fill(0, count($meta_keys), '%s')) . ")
2015 3641 AND meta_value != ''
2016 3642 AND post_id IN (SELECT ID FROM {$wpdb->posts} WHERE post_status = 'publish')
2017 3643 ORDER BY post_id ASC
2018 3644 LIMIT %d OFFSET %d
@@ -2019,8 +3645,9 @@
2019 3645 ", array_merge($meta_keys, [$batch_size, $offset])));
2020 3646
2021 3647 $imported_count = 0;
2022 3648 $skipped_count = 0;
3649 + $unresolved = [];
2023 3650
2024 3651 foreach ($posts as $post_obj) {
2025 3652 $post_id = $post_obj->post_id;
2026 3653 $updated = false;
@@ -2028,15 +3655,16 @@
2028 3655 // Import title
2029 3656 if ($import_titles) {
2030 3657 $yoast_title = get_post_meta($post_id, '_yoast_wpseo_title', true);
2031 3658 if (!empty($yoast_title)) {
2032 - $existing_title = get_post_meta($post_id, '_metasync_seo_title', true);
2033 -
2034 - if (empty($existing_title) || $overwrite) {
2035 - $yoast_title = $this->resolve_seo_placeholders($yoast_title, $post_id, 'yoast');
2036 - update_post_meta($post_id, '_metasync_seo_title', sanitize_text_field($yoast_title));
2037 - $updated = true;
2038 - }
3659 + $updated = $this->store_imported_post_value(
3660 + $post_id,
3661 + (string) $yoast_title,
3662 + 'yoast',
3663 + Metasync_Seo_Precedence::KEY_IMPORTED_TITLE,
3664 + $overwrite,
3665 + $unresolved
3666 + );
2039 3667 }
2040 3668 }
2041 3669
2042 3670 // Import description
@@ -2042,15 +3670,16 @@
2042 3670 // Import description
2043 3671 if ($import_descriptions) {
2044 3672 $yoast_desc = get_post_meta($post_id, '_yoast_wpseo_metadesc', true);
2045 3673 if (!empty($yoast_desc)) {
2046 - $existing_desc = get_post_meta($post_id, '_metasync_seo_desc', true);
2047 -
2048 - if (empty($existing_desc) || $overwrite) {
2049 - $yoast_desc = $this->resolve_seo_placeholders($yoast_desc, $post_id, 'yoast');
2050 - update_post_meta($post_id, '_metasync_seo_desc', sanitize_textarea_field($yoast_desc));
2051 - $updated = true;
2052 - }
3674 + $updated = $this->store_imported_post_value(
3675 + $post_id,
3676 + (string) $yoast_desc,
3677 + 'yoast',
3678 + Metasync_Seo_Precedence::KEY_IMPORTED_DESC,
3679 + $overwrite,
3680 + $unresolved
3681 + ) || $updated;
2053 3682 }
2054 3683 }
2055 3684
2056 3685 // Import social text
@@ -2056,44 +3685,52 @@
2056 3685 // Import social text
2057 3686 if ($import_social_text) {
2058 3687 $yoast_og_title = get_post_meta($post_id, '_yoast_wpseo_opengraph-title', true);
2059 3688 if (!empty($yoast_og_title)) {
2060 - $existing = get_post_meta($post_id, '_metasync_og_title', true);
2061 - if (empty($existing) || $overwrite) {
2062 - $yoast_og_title = $this->resolve_seo_placeholders($yoast_og_title, $post_id, 'yoast');
2063 - update_post_meta($post_id, '_metasync_og_title', sanitize_text_field($yoast_og_title));
2064 - $updated = true;
2065 - }
3689 + $updated = $this->store_imported_post_value(
3690 + $post_id,
3691 + (string) $yoast_og_title,
3692 + 'yoast',
3693 + Metasync_Seo_Precedence::KEY_IMPORTED_OG_TITLE,
3694 + $overwrite,
3695 + $unresolved
3696 + ) || $updated;
2066 3697 }
2067 3698
2068 3699 $yoast_og_desc = get_post_meta($post_id, '_yoast_wpseo_opengraph-description', true);
2069 3700 if (!empty($yoast_og_desc)) {
2070 - $existing = get_post_meta($post_id, '_metasync_og_description', true);
2071 - if (empty($existing) || $overwrite) {
2072 - $yoast_og_desc = $this->resolve_seo_placeholders($yoast_og_desc, $post_id, 'yoast');
2073 - update_post_meta($post_id, '_metasync_og_description', sanitize_textarea_field($yoast_og_desc));
2074 - $updated = true;
2075 - }
3701 + $updated = $this->store_imported_post_value(
3702 + $post_id,
3703 + (string) $yoast_og_desc,
3704 + 'yoast',
3705 + Metasync_Seo_Precedence::KEY_IMPORTED_OG_DESC,
3706 + $overwrite,
3707 + $unresolved
3708 + ) || $updated;
2076 3709 }
2077 3710
2078 3711 $yoast_tw_title = get_post_meta($post_id, '_yoast_wpseo_twitter-title', true);
2079 3712 if (!empty($yoast_tw_title)) {
2080 - $existing = get_post_meta($post_id, '_metasync_twitter_title', true);
2081 - if (empty($existing) || $overwrite) {
2082 - $yoast_tw_title = $this->resolve_seo_placeholders($yoast_tw_title, $post_id, 'yoast');
2083 - update_post_meta($post_id, '_metasync_twitter_title', sanitize_text_field($yoast_tw_title));
2084 - $updated = true;
2085 - }
3713 + $updated = $this->store_imported_post_value(
3714 + $post_id,
3715 + (string) $yoast_tw_title,
3716 + 'yoast',
3717 + Metasync_Seo_Precedence::KEY_IMPORTED_TWITTER_TITLE,
3718 + $overwrite,
3719 + $unresolved
3720 + ) || $updated;
2086 3721 }
2087 3722
2088 3723 $yoast_tw_desc = get_post_meta($post_id, '_yoast_wpseo_twitter-description', true);
2089 3724 if (!empty($yoast_tw_desc)) {
2090 - $existing = get_post_meta($post_id, '_metasync_twitter_description', true);
2091 - if (empty($existing) || $overwrite) {
2092 - $yoast_tw_desc = $this->resolve_seo_placeholders($yoast_tw_desc, $post_id, 'yoast');
2093 - update_post_meta($post_id, '_metasync_twitter_description', sanitize_textarea_field($yoast_tw_desc));
2094 - $updated = true;
2095 - }
3725 + $updated = $this->store_imported_post_value(
3726 + $post_id,
3727 + (string) $yoast_tw_desc,
3728 + 'yoast',
3729 + Metasync_Seo_Precedence::KEY_IMPORTED_TWITTER_DESC,
3730 + $overwrite,
3731 + $unresolved
3732 + ) || $updated;
2096 3733 }
2097 3734 }
2098 3735
2099 3736 // Import social images
@@ -2099,22 +3736,28 @@
2099 3736 // Import social images
2100 3737 if ($import_social_images) {
2101 3738 $yoast_og_image = get_post_meta($post_id, '_yoast_wpseo_opengraph-image', true);
2102 3739 if (!empty($yoast_og_image)) {
2103 - $existing_og = get_post_meta($post_id, '_metasync_og_image', true);
2104 - if (empty($existing_og) || $overwrite) {
2105 - update_post_meta($post_id, '_metasync_og_image', esc_url_raw($yoast_og_image));
2106 - $updated = true;
2107 - }
3740 + $updated = $this->store_imported_post_value(
3741 + $post_id,
3742 + (string) $yoast_og_image,
3743 + 'yoast',
3744 + Metasync_Seo_Precedence::KEY_IMPORTED_OG_IMAGE,
3745 + $overwrite,
3746 + $unresolved
3747 + ) || $updated;
2108 3748 }
2109 3749
2110 3750 $yoast_twitter_image = get_post_meta($post_id, '_yoast_wpseo_twitter-image', true);
2111 3751 if (!empty($yoast_twitter_image)) {
2112 - $existing_twitter = get_post_meta($post_id, '_metasync_twitter_image', true);
2113 - if (empty($existing_twitter) || $overwrite) {
2114 - update_post_meta($post_id, '_metasync_twitter_image', esc_url_raw($yoast_twitter_image));
2115 - $updated = true;
2116 - }
3752 + $updated = $this->store_imported_post_value(
3753 + $post_id,
3754 + (string) $yoast_twitter_image,
3755 + 'yoast',
3756 + Metasync_Seo_Precedence::KEY_IMPORTED_TWITTER_IMAGE,
3757 + $overwrite,
3758 + $unresolved
3759 + ) || $updated;
2117 3760 }
2118 3761 }
2119 3762
2120 3763 if ($updated) {
@@ -2126,9 +3769,9 @@
2126 3769
2127 3770 $processed = $offset + count($posts);
2128 3771 $is_complete = $processed >= $total_posts;
2129 3772
2130 - return [
3773 + return $this->attach_unresolved_report([
2131 3774 'success' => true,
2132 3775 'imported' => $imported_count,
2133 3776 'skipped' => $skipped_count,
2134 3777 'total' => $total_posts,
@@ -2137,9 +3780,9 @@
2137 3780 'progress_percent' => $total_posts > 0 ? round(($processed / $total_posts) * 100) : 100,
2138 3781 'message' => $is_complete
2139 3782 ? "Import complete! Imported {$imported_count} posts, skipped {$skipped_count} posts."
2140 3783 : "Processing... {$imported_count} imported, {$skipped_count} skipped."
2141 - ];
3784 + ], $unresolved);
2142 3785 }
2143 3786
2144 3787 /**
2145 3788 * Import SEO metadata from Rank Math
@@ -2182,22 +3825,23 @@
2182 3825 ];
2183 3826 }
2184 3827
2185 3828 // Get total count
2186 - $meta_keys_placeholders = implode(',', array_fill(0, count($meta_keys), '%s'));
2187 - $total_posts = (int) $wpdb->get_var($wpdb->prepare("
3829 + // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- one-shot import tool — bulk reads from third-party SEO plugin storage; no bulk WordPress API exists
3830 + $total_posts = (int) $wpdb->get_var($wpdb->prepare('
2188 3831 SELECT COUNT(DISTINCT post_id)
2189 - FROM {$wpdb->postmeta}
2190 - WHERE meta_key IN ($meta_keys_placeholders)
3832 + FROM ' . $wpdb->postmeta . '
3833 + WHERE meta_key IN (' . implode(',', array_fill(0, count($meta_keys), '%s')) . ")
2191 3834 AND meta_value != ''
2192 3835 AND post_id IN (SELECT ID FROM {$wpdb->posts} WHERE post_status = 'publish')
2193 3836 ", $meta_keys));
2194 3837
2195 3838 // Get batch of posts
2196 - $posts = $wpdb->get_results($wpdb->prepare("
3839 + // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- one-shot import tool — bulk reads from third-party SEO plugin storage; no bulk WordPress API exists
3840 + $posts = $wpdb->get_results($wpdb->prepare('
2197 3841 SELECT DISTINCT post_id
2198 - FROM {$wpdb->postmeta}
2199 - WHERE meta_key IN ($meta_keys_placeholders)
3842 + FROM ' . $wpdb->postmeta . '
3843 + WHERE meta_key IN (' . implode(',', array_fill(0, count($meta_keys), '%s')) . ")
2200 3844 AND meta_value != ''
2201 3845 AND post_id IN (SELECT ID FROM {$wpdb->posts} WHERE post_status = 'publish')
2202 3846 ORDER BY post_id ASC
2203 3847 LIMIT %d OFFSET %d
@@ -2204,8 +3848,9 @@
2204 3848 ", array_merge($meta_keys, [$batch_size, $offset])));
2205 3849
2206 3850 $imported_count = 0;
2207 3851 $skipped_count = 0;
3852 + $unresolved = [];
2208 3853
2209 3854 foreach ($posts as $post_obj) {
2210 3855 $post_id = $post_obj->post_id;
2211 3856 $updated = false;
@@ -2213,15 +3858,16 @@
2213 3858 // Import title
2214 3859 if ($import_titles) {
2215 3860 $rm_title = get_post_meta($post_id, 'rank_math_title', true);
2216 3861 if (!empty($rm_title)) {
2217 - $existing_title = get_post_meta($post_id, '_metasync_seo_title', true);
2218 -
2219 - if (empty($existing_title) || $overwrite) {
2220 - $rm_title = $this->resolve_seo_placeholders($rm_title, $post_id, 'rankmath');
2221 - update_post_meta($post_id, '_metasync_seo_title', sanitize_text_field($rm_title));
2222 - $updated = true;
2223 - }
3862 + $updated = $this->store_imported_post_value(
3863 + $post_id,
3864 + (string) $rm_title,
3865 + 'rankmath',
3866 + Metasync_Seo_Precedence::KEY_IMPORTED_TITLE,
3867 + $overwrite,
3868 + $unresolved
3869 + );
2224 3870 }
2225 3871 }
2226 3872
2227 3873 // Import description
@@ -2227,15 +3873,16 @@
2227 3873 // Import description
2228 3874 if ($import_descriptions) {
2229 3875 $rm_desc = get_post_meta($post_id, 'rank_math_description', true);
2230 3876 if (!empty($rm_desc)) {
2231 - $existing_desc = get_post_meta($post_id, '_metasync_seo_desc', true);
2232 -
2233 - if (empty($existing_desc) || $overwrite) {
2234 - $rm_desc = $this->resolve_seo_placeholders($rm_desc, $post_id, 'rankmath');
2235 - update_post_meta($post_id, '_metasync_seo_desc', sanitize_textarea_field($rm_desc));
2236 - $updated = true;
2237 - }
3877 + $updated = $this->store_imported_post_value(
3878 + $post_id,
3879 + (string) $rm_desc,
3880 + 'rankmath',
3881 + Metasync_Seo_Precedence::KEY_IMPORTED_DESC,
3882 + $overwrite,
3883 + $unresolved
3884 + ) || $updated;
2238 3885 }
2239 3886 }
2240 3887
2241 3888 // Import social text
@@ -2241,44 +3888,52 @@
2241 3888 // Import social text
2242 3889 if ($import_social_text) {
2243 3890 $rm_og_title = get_post_meta($post_id, 'rank_math_facebook_title', true);
2244 3891 if (!empty($rm_og_title)) {
2245 - $existing = get_post_meta($post_id, '_metasync_og_title', true);
2246 - if (empty($existing) || $overwrite) {
2247 - $rm_og_title = $this->resolve_seo_placeholders($rm_og_title, $post_id, 'rankmath');
2248 - update_post_meta($post_id, '_metasync_og_title', sanitize_text_field($rm_og_title));
2249 - $updated = true;
2250 - }
3892 + $updated = $this->store_imported_post_value(
3893 + $post_id,
3894 + (string) $rm_og_title,
3895 + 'rankmath',
3896 + Metasync_Seo_Precedence::KEY_IMPORTED_OG_TITLE,
3897 + $overwrite,
3898 + $unresolved
3899 + ) || $updated;
2251 3900 }
2252 3901
2253 3902 $rm_og_desc = get_post_meta($post_id, 'rank_math_facebook_description', true);
2254 3903 if (!empty($rm_og_desc)) {
2255 - $existing = get_post_meta($post_id, '_metasync_og_description', true);
2256 - if (empty($existing) || $overwrite) {
2257 - $rm_og_desc = $this->resolve_seo_placeholders($rm_og_desc, $post_id, 'rankmath');
2258 - update_post_meta($post_id, '_metasync_og_description', sanitize_textarea_field($rm_og_desc));
2259 - $updated = true;
2260 - }
3904 + $updated = $this->store_imported_post_value(
3905 + $post_id,
3906 + (string) $rm_og_desc,
3907 + 'rankmath',
3908 + Metasync_Seo_Precedence::KEY_IMPORTED_OG_DESC,
3909 + $overwrite,
3910 + $unresolved
3911 + ) || $updated;
2261 3912 }
2262 3913
2263 3914 $rm_tw_title = get_post_meta($post_id, 'rank_math_twitter_title', true);
2264 3915 if (!empty($rm_tw_title)) {
2265 - $existing = get_post_meta($post_id, '_metasync_twitter_title', true);
2266 - if (empty($existing) || $overwrite) {
2267 - $rm_tw_title = $this->resolve_seo_placeholders($rm_tw_title, $post_id, 'rankmath');
2268 - update_post_meta($post_id, '_metasync_twitter_title', sanitize_text_field($rm_tw_title));
2269 - $updated = true;
2270 - }
3916 + $updated = $this->store_imported_post_value(
3917 + $post_id,
3918 + (string) $rm_tw_title,
3919 + 'rankmath',
3920 + Metasync_Seo_Precedence::KEY_IMPORTED_TWITTER_TITLE,
3921 + $overwrite,
3922 + $unresolved
3923 + ) || $updated;
2271 3924 }
2272 3925
2273 3926 $rm_tw_desc = get_post_meta($post_id, 'rank_math_twitter_description', true);
2274 3927 if (!empty($rm_tw_desc)) {
2275 - $existing = get_post_meta($post_id, '_metasync_twitter_description', true);
2276 - if (empty($existing) || $overwrite) {
2277 - $rm_tw_desc = $this->resolve_seo_placeholders($rm_tw_desc, $post_id, 'rankmath');
2278 - update_post_meta($post_id, '_metasync_twitter_description', sanitize_textarea_field($rm_tw_desc));
2279 - $updated = true;
2280 - }
3928 + $updated = $this->store_imported_post_value(
3929 + $post_id,
3930 + (string) $rm_tw_desc,
3931 + 'rankmath',
3932 + Metasync_Seo_Precedence::KEY_IMPORTED_TWITTER_DESC,
3933 + $overwrite,
3934 + $unresolved
3935 + ) || $updated;
2281 3936 }
2282 3937 }
2283 3938
2284 3939 // Import social images
@@ -2284,22 +3939,28 @@
2284 3939 // Import social images
2285 3940 if ($import_social_images) {
2286 3941 $rm_og_image = get_post_meta($post_id, 'rank_math_facebook_image', true);
2287 3942 if (!empty($rm_og_image)) {
2288 - $existing_og = get_post_meta($post_id, '_metasync_og_image', true);
2289 - if (empty($existing_og) || $overwrite) {
2290 - update_post_meta($post_id, '_metasync_og_image', esc_url_raw($rm_og_image));
2291 - $updated = true;
2292 - }
3943 + $updated = $this->store_imported_post_value(
3944 + $post_id,
3945 + (string) $rm_og_image,
3946 + 'rankmath',
3947 + Metasync_Seo_Precedence::KEY_IMPORTED_OG_IMAGE,
3948 + $overwrite,
3949 + $unresolved
3950 + ) || $updated;
2293 3951 }
2294 3952
2295 3953 $rm_twitter_image = get_post_meta($post_id, 'rank_math_twitter_image', true);
2296 3954 if (!empty($rm_twitter_image)) {
2297 - $existing_twitter = get_post_meta($post_id, '_metasync_twitter_image', true);
2298 - if (empty($existing_twitter) || $overwrite) {
2299 - update_post_meta($post_id, '_metasync_twitter_image', esc_url_raw($rm_twitter_image));
2300 - $updated = true;
2301 - }
3955 + $updated = $this->store_imported_post_value(
3956 + $post_id,
3957 + (string) $rm_twitter_image,
3958 + 'rankmath',
3959 + Metasync_Seo_Precedence::KEY_IMPORTED_TWITTER_IMAGE,
3960 + $overwrite,
3961 + $unresolved
3962 + ) || $updated;
2302 3963 }
2303 3964 }
2304 3965
2305 3966 if ($updated) {
@@ -2311,9 +3972,9 @@
2311 3972
2312 3973 $processed = $offset + count($posts);
2313 3974 $is_complete = $processed >= $total_posts;
2314 3975
2315 - return [
3976 + return $this->attach_unresolved_report([
2316 3977 'success' => true,
2317 3978 'imported' => $imported_count,
2318 3979 'skipped' => $skipped_count,
2319 3980 'total' => $total_posts,
@@ -2322,9 +3983,9 @@
2322 3983 'progress_percent' => $total_posts > 0 ? round(($processed / $total_posts) * 100) : 100,
2323 3984 'message' => $is_complete
2324 3985 ? "Import complete! Imported {$imported_count} posts, skipped {$skipped_count} posts."
2325 3986 : "Processing... {$imported_count} imported, {$skipped_count} skipped."
2326 - ];
3987 + ], $unresolved);
2327 3988 }
2328 3989
2329 3990 /**
2330 3991 * Import SEO metadata from All in One SEO
@@ -2342,9 +4003,9 @@
2342 4003 $overwrite = (bool) $options['overwrite_existing'];
2343 4004
2344 4005 // Check if AIOSEO table exists
2345 4006 $table = $wpdb->prefix . 'aioseo_posts';
2346 - if ($wpdb->get_var("SHOW TABLES LIKE '$table'") !== $table) {
4007 + if ($wpdb->get_var($wpdb->prepare('SHOW TABLES LIKE %s', $wpdb->esc_like($table))) !== $table) { // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- one-shot import tool — bulk reads from third-party SEO plugin storage; no bulk WordPress API exists
2347 4008 return [
2348 4009 'success' => false,
2349 4010 'message' => 'AIOSEO database table not found.'
2350 4011 ];
@@ -2356,93 +4017,209 @@
2356 4017 'message' => 'No import options selected.'
2357 4018 ];
2358 4019 }
2359 4020
2360 - // Build WHERE clause
2361 - $where_conditions = [];
4021 + // Columns read off the AIOSEO row, excluding post_id. The same list gates
4022 + // row selection, so deriving both from one array keeps them in step — a
4023 + // WHERE that admitted a column the SELECT did not fetch would read a
4024 + // property that isn't there.
4025 + $value_columns = [];
2362 4026 if ($import_titles) {
2363 - $where_conditions[] = '(title IS NOT NULL AND title != \'\')';
4027 + $value_columns[] = 'title';
2364 4028 }
2365 4029 if ($import_descriptions) {
2366 - $where_conditions[] = '(description IS NOT NULL AND description != \'\')';
4030 + $value_columns[] = 'description';
2367 4031 }
2368 4032 if ($import_social_text) {
2369 - $where_conditions[] = '(og_title IS NOT NULL AND og_title != \'\')';
2370 - $where_conditions[] = '(og_description IS NOT NULL AND og_description != \'\')';
2371 - $where_conditions[] = '(twitter_title IS NOT NULL AND twitter_title != \'\')';
2372 - $where_conditions[] = '(twitter_description IS NOT NULL AND twitter_description != \'\')';
4033 + $value_columns[] = 'og_title';
4034 + $value_columns[] = 'og_description';
4035 + $value_columns[] = 'twitter_title';
4036 + $value_columns[] = 'twitter_description';
2373 4037 }
2374 4038 if ($import_social_images) {
2375 - $where_conditions[] = '(og_image_custom_url IS NOT NULL AND og_image_custom_url != \'\')';
2376 - $where_conditions[] = '(twitter_image_custom_url IS NOT NULL AND twitter_image_custom_url != \'\')';
4039 + $value_columns[] = 'og_image_custom_url';
4040 + $value_columns[] = 'twitter_image_custom_url';
2377 4041 }
2378 - $where_clause = implode(' OR ', $where_conditions);
2379 4042
2380 - // Build SELECT columns
2381 - $select_columns = ['post_id'];
2382 - if ($import_titles) {
2383 - $select_columns[] = 'title';
4043 + $build_has_value_clause = function ($prefix) use ($value_columns) {
4044 + $conditions = [];
4045 + foreach ($value_columns as $column) {
4046 + $col = $prefix . $column;
4047 + $conditions[] = "({$col} IS NOT NULL AND {$col} != '')";
4048 + }
4049 + return implode(' OR ', $conditions);
4050 + };
4051 +
4052 + $where_clause = $build_has_value_clause('');
4053 + $joined_has_value = $build_has_value_clause('a.');
4054 +
4055 + // AIOSEO serves a title and description for every post through its
4056 + // site-wide templates, not only for posts carrying a per-post override.
4057 + // Walking the AIOSEO table alone therefore reaches almost nothing on a
4058 + // typical site — overrides are the exception, templates are the rule. So
4059 + // when templates are in play, anchor the walk on the posts table and join
4060 + // the AIOSEO row in; the per-post value still wins wherever it exists.
4061 + $templates = ($import_titles || $import_descriptions)
4062 + ? $this->get_aioseo_post_type_templates()
4063 + : [];
4064 +
4065 + $template_post_types = [];
4066 + foreach ($templates as $post_type => $template) {
4067 + if (($import_titles && $template['title'] !== '')
4068 + || ($import_descriptions && $template['description'] !== '')) {
4069 + $template_post_types[] = $post_type;
4070 + }
2384 4071 }
2385 - if ($import_descriptions) {
2386 - $select_columns[] = 'description';
2387 - }
2388 - if ($import_social_text) {
2389 - $select_columns[] = 'og_title';
2390 - $select_columns[] = 'og_description';
2391 - $select_columns[] = 'twitter_title';
2392 - $select_columns[] = 'twitter_description';
2393 - }
2394 - if ($import_social_images) {
2395 - $select_columns[] = 'og_image_custom_url';
2396 - $select_columns[] = 'twitter_image_custom_url';
2397 - }
2398 - $select_clause = implode(', ', $select_columns);
2399 4072
2400 - // Get total count
2401 - $total_posts = (int) $wpdb->get_var("
2402 - SELECT COUNT(post_id)
2403 - FROM {$table}
2404 - WHERE ({$where_clause})
2405 - AND post_id IN (SELECT ID FROM {$wpdb->posts} WHERE post_status = 'publish')
2406 - ");
4073 + if (!empty($template_post_types)) {
4074 + $type_placeholders = implode(', ', array_fill(0, count($template_post_types), '%s'));
2407 4075
2408 - // Get batch of posts
2409 - $posts = $wpdb->get_results($wpdb->prepare("
2410 - SELECT {$select_clause}
2411 - FROM {$table}
2412 - WHERE ({$where_clause})
2413 - AND post_id IN (SELECT ID FROM {$wpdb->posts} WHERE post_status = 'publish')
2414 - ORDER BY post_id ASC
2415 - LIMIT %d OFFSET %d
2416 - ", $batch_size, $offset));
4076 + // Template mode visits every published post, not just the few with an
4077 + // override, and AIOSEO's default description template is #post_excerpt
4078 + // — which on a post without a manual excerpt runs the whole the_content
4079 + // filter chain. On page-builder content that is a large fraction of a
4080 + // second each, so the caller's batch of 50 can outlive a proxy read
4081 + // timeout. Smaller batches cost more requests and finish.
4082 + $batch_size = min($batch_size, 20);
2417 4083
4084 + // COUNT and SELECT must describe the identical row set. is_complete
4085 + // compares (offset + rows returned) against this count and the client
4086 + // loops until they meet, with no iteration cap — a count broader than
4087 + // the select spins forever, a narrower one stops early and silently
4088 + // drops the remainder. Counting the joined set rather than the posts
4089 + // table alone also keeps cardinality identical if the AIOSEO table
4090 + // ever held two rows for one post: its post_id index is not unique.
4091 + //
4092 + // The post-type list governs which posts get a *template*, so it must
4093 + // not also decide which posts get read at all: a post type with no
4094 + // template — one AIOSEO never configured, one with SEO switched off,
4095 + // one registered non-public — can still carry per-post overrides that
4096 + // the override-only walk always imported. The second arm keeps every
4097 + // row holding real AIOSEO data in scope whatever its post type, so
4098 + // adding a template never removes anything from the import.
4099 + // $joined_has_value is built only from the fixed $value_columns
4100 + // allowlist above; table names are inline literals.
4101 + $from_clause = "FROM {$wpdb->posts} p
4102 + LEFT JOIN {$wpdb->prefix}aioseo_posts a ON a.post_id = p.ID
4103 + WHERE p.post_status = 'publish'
4104 + AND (p.post_type IN (" . implode(', ', array_fill(0, count($template_post_types), '%s')) . ") OR ({$joined_has_value}))";
4105 +
4106 + // Assembled from the literal fragments above; post types bind via prepare().
4107 + $count_query = "SELECT COUNT(*) {$from_clause}";
4108 + $total_posts = (int) $wpdb->get_var($wpdb->prepare($count_query, $template_post_types)); // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.DirectDatabaseQuery -- fragments built from fixed allowlists, values bound via prepare()
4109 +
4110 + $joined_columns = array_map(
4111 + function ($column) {
4112 + return "a.{$column}";
4113 + },
4114 + $value_columns
4115 + );
4116 + // At least one import flag is set — the "no import options selected"
4117 + // guard above returns before this point — so there is always at
4118 + // least one value column to select.
4119 + $joined_select = 'p.ID AS post_id, p.post_type AS post_type, '
4120 + . implode(', ', $joined_columns);
4121 +
4122 + // Assembled from the literal fragments above; post types bind via prepare().
4123 + $posts_query = "SELECT {$joined_select}
4124 + {$from_clause}
4125 + ORDER BY p.ID ASC
4126 + LIMIT %d OFFSET %d";
4127 + $posts = $wpdb->get_results($wpdb->prepare($posts_query, array_merge($template_post_types, [$batch_size, $offset]))); // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.DirectDatabaseQuery -- fragments built from fixed allowlists, values bound via prepare()
4128 + } else {
4129 + // No usable templates — e.g. only the social options are selected, or
4130 + // aioseo_options_dynamic is missing. Fall back to the original
4131 + // override-only walk so those sites behave exactly as before.
4132 + $select_clause = implode(', ', array_merge(['post_id'], $value_columns));
4133 +
4134 + // $where_clause / $select_clause are built only from the fixed
4135 + // $value_columns allowlist above.
4136 + // phpcs:disable WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- $where_clause is built only from the fixed $value_columns allowlist above
4137 + // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- one-shot import tool — bulk reads from third-party SEO plugin storage; no bulk WordPress API exists
4138 + $total_posts = (int) $wpdb->get_var("
4139 + SELECT COUNT(post_id)
4140 + FROM {$wpdb->prefix}aioseo_posts
4141 + WHERE ({$where_clause})
4142 + AND post_id IN (SELECT ID FROM {$wpdb->posts} WHERE post_status = 'publish')
4143 + ");
4144 + // phpcs:enable WordPress.DB.PreparedSQL.InterpolatedNotPrepared
4145 +
4146 + // phpcs:disable WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- $select_clause / $where_clause are built only from the fixed $value_columns allowlist above
4147 + // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- one-shot import tool — bulk reads from third-party SEO plugin storage; no bulk WordPress API exists
4148 + $posts = $wpdb->get_results($wpdb->prepare("
4149 + SELECT {$select_clause}
4150 + FROM {$wpdb->prefix}aioseo_posts
4151 + WHERE ({$where_clause})
4152 + AND post_id IN (SELECT ID FROM {$wpdb->posts} WHERE post_status = 'publish')
4153 + ORDER BY post_id ASC
4154 + LIMIT %d OFFSET %d
4155 + ", $batch_size, $offset));
4156 + // phpcs:enable WordPress.DB.PreparedSQL.InterpolatedNotPrepared
4157 + }
4158 +
2418 4159 $imported_count = 0;
2419 4160 $skipped_count = 0;
4161 + $unresolved = [];
2420 4162
2421 4163 foreach ($posts as $aioseo_data) {
2422 4164 $post_id = $aioseo_data->post_id;
2423 4165 $updated = false;
2424 4166
2425 - // Import title
2426 - if ($import_titles && !empty($aioseo_data->title)) {
2427 - $existing_title = get_post_meta($post_id, '_metasync_seo_title', true);
4167 + // Present only on the template-anchored query; the fallback walk has
4168 + // no join to read it from.
4169 + $post_type = isset($aioseo_data->post_type)
4170 + ? (string) $aioseo_data->post_type
4171 + : (string) get_post_type($post_id);
2428 4172
2429 - if (empty($existing_title) || $overwrite) {
2430 - $aioseo_title = $this->resolve_seo_placeholders($aioseo_data->title, $post_id, 'aioseo');
2431 - update_post_meta($post_id, '_metasync_seo_title', sanitize_text_field($aioseo_title));
2432 - $updated = true;
4173 + $title_template = $templates[$post_type]['title'] ?? '';
4174 + $desc_template = $templates[$post_type]['description'] ?? '';
4175 +
4176 + // Import title.
4177 + //
4178 + // The per-post value wins; the site-wide template is the fallback,
4179 + // matching the order AIOSEO itself resolves in. Destination and
4180 + // write rules come from store_imported_post_value().
4181 + if ($import_titles) {
4182 + $raw_title = !empty($aioseo_data->title) ? (string) $aioseo_data->title : '';
4183 +
4184 + if ($raw_title === '' && $title_template !== '') {
4185 + $raw_title = $title_template;
2433 4186 }
4187 +
4188 + $updated = $this->store_imported_post_value(
4189 + $post_id,
4190 + $raw_title,
4191 + 'aioseo',
4192 + Metasync_Seo_Precedence::KEY_IMPORTED_TITLE,
4193 + $overwrite,
4194 + $unresolved
4195 + );
2434 4196 }
2435 4197
2436 - // Import description
2437 - if ($import_descriptions && !empty($aioseo_data->description)) {
2438 - $existing_desc = get_post_meta($post_id, '_metasync_seo_desc', true);
4198 + // Import description — same reasoning as the title above.
4199 + if ($import_descriptions) {
4200 + $raw_desc = !empty($aioseo_data->description) ? (string) $aioseo_data->description : '';
4201 + $desc_from_template = false;
2439 4202
2440 - if (empty($existing_desc) || $overwrite) {
2441 - $aioseo_desc = $this->resolve_seo_placeholders($aioseo_data->description, $post_id, 'aioseo');
2442 - update_post_meta($post_id, '_metasync_seo_desc', sanitize_textarea_field($aioseo_desc));
2443 - $updated = true;
4203 + if ($raw_desc === '' && $desc_template !== '') {
4204 + $raw_desc = $desc_template;
4205 + $desc_from_template = true;
2444 4206 }
4207 +
4208 + // Only template-derived values are trimmed. A '#post_content'
4209 + // template resolves to the whole body, and AIOSEO emits that
4210 + // untruncated — copying it verbatim would give every page a
4211 + // multi-thousand-character description. What the customer
4212 + // typed on the post is left exactly as they wrote it.
4213 + $updated = $this->store_imported_post_value(
4214 + $post_id,
4215 + $raw_desc,
4216 + 'aioseo',
4217 + Metasync_Seo_Precedence::KEY_IMPORTED_DESC,
4218 + $overwrite,
4219 + $unresolved,
4220 + $desc_from_template
4221 + ) || $updated;
2445 4222 }
2446 4223
2447 4224 // Import social text
2448 4225 if ($import_social_text) {
@@ -2447,44 +4224,52 @@
2447 4224 // Import social text
2448 4225 if ($import_social_text) {
2449 4226 $aioseo_og_title = isset($aioseo_data->og_title) ? $aioseo_data->og_title : '';
2450 4227 if (!empty($aioseo_og_title)) {
2451 - $existing = get_post_meta($post_id, '_metasync_og_title', true);
2452 - if (empty($existing) || $overwrite) {
2453 - $aioseo_og_title = $this->resolve_seo_placeholders($aioseo_og_title, $post_id, 'aioseo');
2454 - update_post_meta($post_id, '_metasync_og_title', sanitize_text_field($aioseo_og_title));
2455 - $updated = true;
2456 - }
4228 + $updated = $this->store_imported_post_value(
4229 + $post_id,
4230 + (string) $aioseo_og_title,
4231 + 'aioseo',
4232 + Metasync_Seo_Precedence::KEY_IMPORTED_OG_TITLE,
4233 + $overwrite,
4234 + $unresolved
4235 + ) || $updated;
2457 4236 }
2458 4237
2459 4238 $aioseo_og_desc = isset($aioseo_data->og_description) ? $aioseo_data->og_description : '';
2460 4239 if (!empty($aioseo_og_desc)) {
2461 - $existing = get_post_meta($post_id, '_metasync_og_description', true);
2462 - if (empty($existing) || $overwrite) {
2463 - $aioseo_og_desc = $this->resolve_seo_placeholders($aioseo_og_desc, $post_id, 'aioseo');
2464 - update_post_meta($post_id, '_metasync_og_description', sanitize_textarea_field($aioseo_og_desc));
2465 - $updated = true;
2466 - }
4240 + $updated = $this->store_imported_post_value(
4241 + $post_id,
4242 + (string) $aioseo_og_desc,
4243 + 'aioseo',
4244 + Metasync_Seo_Precedence::KEY_IMPORTED_OG_DESC,
4245 + $overwrite,
4246 + $unresolved
4247 + ) || $updated;
2467 4248 }
2468 4249
2469 4250 $aioseo_tw_title = isset($aioseo_data->twitter_title) ? $aioseo_data->twitter_title : '';
2470 4251 if (!empty($aioseo_tw_title)) {
2471 - $existing = get_post_meta($post_id, '_metasync_twitter_title', true);
2472 - if (empty($existing) || $overwrite) {
2473 - $aioseo_tw_title = $this->resolve_seo_placeholders($aioseo_tw_title, $post_id, 'aioseo');
2474 - update_post_meta($post_id, '_metasync_twitter_title', sanitize_text_field($aioseo_tw_title));
2475 - $updated = true;
2476 - }
4252 + $updated = $this->store_imported_post_value(
4253 + $post_id,
4254 + (string) $aioseo_tw_title,
4255 + 'aioseo',
4256 + Metasync_Seo_Precedence::KEY_IMPORTED_TWITTER_TITLE,
4257 + $overwrite,
4258 + $unresolved
4259 + ) || $updated;
2477 4260 }
2478 4261
2479 4262 $aioseo_tw_desc = isset($aioseo_data->twitter_description) ? $aioseo_data->twitter_description : '';
2480 4263 if (!empty($aioseo_tw_desc)) {
2481 - $existing = get_post_meta($post_id, '_metasync_twitter_description', true);
2482 - if (empty($existing) || $overwrite) {
2483 - $aioseo_tw_desc = $this->resolve_seo_placeholders($aioseo_tw_desc, $post_id, 'aioseo');
2484 - update_post_meta($post_id, '_metasync_twitter_description', sanitize_textarea_field($aioseo_tw_desc));
2485 - $updated = true;
2486 - }
4264 + $updated = $this->store_imported_post_value(
4265 + $post_id,
4266 + (string) $aioseo_tw_desc,
4267 + 'aioseo',
4268 + Metasync_Seo_Precedence::KEY_IMPORTED_TWITTER_DESC,
4269 + $overwrite,
4270 + $unresolved
4271 + ) || $updated;
2487 4272 }
2488 4273 }
2489 4274
2490 4275 // Import social images
@@ -2490,22 +4275,28 @@
2490 4275 // Import social images
2491 4276 if ($import_social_images) {
2492 4277 $aioseo_og_image = isset($aioseo_data->og_image_custom_url) ? $aioseo_data->og_image_custom_url : '';
2493 4278 if (!empty($aioseo_og_image)) {
2494 - $existing_og = get_post_meta($post_id, '_metasync_og_image', true);
2495 - if (empty($existing_og) || $overwrite) {
2496 - update_post_meta($post_id, '_metasync_og_image', esc_url_raw($aioseo_og_image));
2497 - $updated = true;
2498 - }
4279 + $updated = $this->store_imported_post_value(
4280 + $post_id,
4281 + (string) $aioseo_og_image,
4282 + 'aioseo',
4283 + Metasync_Seo_Precedence::KEY_IMPORTED_OG_IMAGE,
4284 + $overwrite,
4285 + $unresolved
4286 + ) || $updated;
2499 4287 }
2500 4288
2501 4289 $aioseo_twitter_image = isset($aioseo_data->twitter_image_custom_url) ? $aioseo_data->twitter_image_custom_url : '';
2502 4290 if (!empty($aioseo_twitter_image)) {
2503 - $existing_twitter = get_post_meta($post_id, '_metasync_twitter_image', true);
2504 - if (empty($existing_twitter) || $overwrite) {
2505 - update_post_meta($post_id, '_metasync_twitter_image', esc_url_raw($aioseo_twitter_image));
2506 - $updated = true;
2507 - }
4291 + $updated = $this->store_imported_post_value(
4292 + $post_id,
4293 + (string) $aioseo_twitter_image,
4294 + 'aioseo',
4295 + Metasync_Seo_Precedence::KEY_IMPORTED_TWITTER_IMAGE,
4296 + $overwrite,
4297 + $unresolved
4298 + ) || $updated;
2508 4299 }
2509 4300 }
2510 4301
2511 4302 if ($updated) {
@@ -2515,11 +4306,15 @@
2515 4306 }
2516 4307 }
2517 4308
2518 4309 $processed = $offset + count($posts);
2519 - $is_complete = $processed >= $total_posts;
4310 + // An empty batch always ends the run. The client loops on !is_complete
4311 + // with no iteration cap, so if the count and the select ever disagreed,
4312 + // a batch returning no rows would leave processed stuck below total and
4313 + // spin forever against the server.
4314 + $is_complete = $processed >= $total_posts || empty($posts);
2520 4315
2521 - return [
4316 + return $this->attach_unresolved_report([
2522 4317 'success' => true,
2523 4318 'imported' => $imported_count,
2524 4319 'skipped' => $skipped_count,
2525 4320 'total' => $total_posts,
@@ -2528,9 +4323,9 @@
2528 4323 'progress_percent' => $total_posts > 0 ? round(($processed / $total_posts) * 100) : 100,
2529 4324 'message' => $is_complete
2530 4325 ? "Import complete! Imported {$imported_count} posts, skipped {$skipped_count} posts."
2531 4326 : "Processing... {$imported_count} imported, {$skipped_count} skipped."
2532 - ];
4327 + ], $unresolved);
2533 4328 }
2534 4329
2535 4330 /**
2536 4331 * Import term-level SEO metadata from a third-party SEO plugin into
@@ -2612,16 +4407,22 @@
2612 4407 'message' => $terms->get_error_message(),
2613 4408 ];
2614 4409 }
2615 4410
4411 + // Title and description are handled separately below: they go to the
4412 + // imported keys so they lose to OTTO, and they need their tokens
4413 + // resolved. The rest keep their own keys.
2616 4414 $field_map = [
2617 - 'wpseo_title' => '_metasync_metatitle',
2618 - 'wpseo_desc' => '_metasync_metadesc',
2619 4415 'wpseo_opengraph-title' => '_metasync_og_title',
2620 4416 'wpseo_opengraph-description' => '_metasync_og_description',
2621 4417 'wpseo_canonical' => '_metasync_canonical_url',
2622 4418 ];
2623 4419
4420 + $imported_map = [
4421 + 'wpseo_title' => Metasync_Seo_Precedence::KEY_IMPORTED_TITLE,
4422 + 'wpseo_desc' => Metasync_Seo_Precedence::KEY_IMPORTED_DESC,
4423 + ];
4424 +
2624 4425 $imported = 0;
2625 4426 $skipped = 0;
2626 4427
2627 4428 foreach ($terms as $term) {
@@ -2632,8 +4433,18 @@
2632 4433 if (!is_array($yoast_meta)) {
2633 4434 $yoast_meta = [];
2634 4435 }
2635 4436
4437 + foreach ($imported_map as $src_key => $dest_key) {
4438 + $term_updated = $this->store_imported_term_value(
4439 + $term,
4440 + isset($yoast_meta[$src_key]) ? (string) $yoast_meta[$src_key] : '',
4441 + 'yoast',
4442 + $dest_key,
4443 + $overwrite
4444 + ) || $term_updated;
4445 + }
4446 +
2636 4447 foreach ($field_map as $src_key => $dest_key) {
2637 4448 $src_value = isset($yoast_meta[$src_key]) ? $yoast_meta[$src_key] : '';
2638 4449 if ($src_value === '' || $src_value === null) {
2639 4450 continue;
@@ -2649,8 +4460,13 @@
2649 4460 $src_value = Metasync_Canonical_Sanitizer::sanitize_for_save($src_value);
2650 4461 if ($src_value === '') {
2651 4462 continue;
2652 4463 }
4464 + } else {
4465 + $src_value = $this->resolve_term_placeholders($src_value, $term, 'yoast');
4466 + if (trim($src_value) === '') {
4467 + continue;
4468 + }
2653 4469 }
2654 4470
2655 4471 update_term_meta($term->term_id, $dest_key, $src_value);
2656 4472 $term_updated = true;
@@ -2710,16 +4526,21 @@
2710 4526 'message' => $terms->get_error_message(),
2711 4527 ];
2712 4528 }
2713 4529
4530 + // See import_yoast_term_meta(): title and description are routed to the
4531 + // imported keys and token-resolved; the rest keep their own keys.
2714 4532 $field_map = [
2715 - 'rank_math_title' => '_metasync_metatitle',
2716 - 'rank_math_description' => '_metasync_metadesc',
2717 4533 'rank_math_facebook_title' => '_metasync_og_title',
2718 4534 'rank_math_facebook_description' => '_metasync_og_description',
2719 4535 'rank_math_canonical_url' => '_metasync_canonical_url',
2720 4536 ];
2721 4537
4538 + $imported_map = [
4539 + 'rank_math_title' => Metasync_Seo_Precedence::KEY_IMPORTED_TITLE,
4540 + 'rank_math_description' => Metasync_Seo_Precedence::KEY_IMPORTED_DESC,
4541 + ];
4542 +
2722 4543 $imported = 0;
2723 4544 $skipped = 0;
2724 4545
2725 4546 foreach ($terms as $term) {
@@ -2724,8 +4545,18 @@
2724 4545
2725 4546 foreach ($terms as $term) {
2726 4547 $term_updated = false;
2727 4548
4549 + foreach ($imported_map as $src_key => $dest_key) {
4550 + $term_updated = $this->store_imported_term_value(
4551 + $term,
4552 + (string) get_term_meta($term->term_id, $src_key, true),
4553 + 'rankmath',
4554 + $dest_key,
4555 + $overwrite
4556 + ) || $term_updated;
4557 + }
4558 +
2728 4559 foreach ($field_map as $src_key => $dest_key) {
2729 4560 $src_value = get_term_meta($term->term_id, $src_key, true);
2730 4561 if ($src_value === '' || $src_value === null) {
2731 4562 continue;
@@ -2741,8 +4572,13 @@
2741 4572 $src_value = Metasync_Canonical_Sanitizer::sanitize_for_save($src_value);
2742 4573 if ($src_value === '') {
2743 4574 continue;
2744 4575 }
4576 + } else {
4577 + $src_value = $this->resolve_term_placeholders($src_value, $term, 'rankmath');
4578 + if (trim($src_value) === '') {
4579 + continue;
4580 + }
2745 4581 }
2746 4582
2747 4583 update_term_meta($term->term_id, $dest_key, $src_value);
2748 4584 $term_updated = true;
@@ -2792,9 +4628,9 @@
2792 4628 $overwrite = (bool) $options['overwrite_existing'];
2793 4629
2794 4630 $table = $wpdb->prefix . 'aioseo_terms';
2795 4631
2796 - $table_exists = $wpdb->get_var($wpdb->prepare('SHOW TABLES LIKE %s', $table));
4632 + $table_exists = $wpdb->get_var($wpdb->prepare('SHOW TABLES LIKE %s', $table)); // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- one-shot import tool — bulk reads from third-party SEO plugin storage; no bulk WordPress API exists
2797 4633 if ($table_exists !== $table) {
2798 4634 return [
2799 4635 'success' => false,
2800 4636 'message' => 'AIOSEO terms table not found.',
@@ -2800,11 +4636,11 @@
2800 4636 'message' => 'AIOSEO terms table not found.',
2801 4637 ];
2802 4638 }
2803 4639
2804 - $rows = $wpdb->get_results($wpdb->prepare(
4640 + $rows = $wpdb->get_results($wpdb->prepare( // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- one-shot import tool — bulk reads from third-party SEO plugin storage; no bulk WordPress API exists
2805 4641 "SELECT term_id, title, description, og_title, og_description, canonical_url, robots_noindex
2806 - FROM {$table}
4642 + FROM {$wpdb->prefix}aioseo_terms
2807 4643 ORDER BY term_id ASC
2808 4644 LIMIT %d OFFSET %d",
2809 4645 $batch_size,
2810 4646 $offset
@@ -2818,18 +4654,41 @@
2818 4654 if ($term_id <= 0) {
2819 4655 continue;
2820 4656 }
2821 4657
4658 + // The resolver needs the term's own name and description, and a row
4659 + // can outlive the term it points at.
4660 + $term = get_term($term_id);
4661 + if (!$term || is_wp_error($term)) {
4662 + $skipped++;
4663 + continue;
4664 + }
4665 +
2822 4666 $term_updated = false;
2823 4667
4668 + // See import_yoast_term_meta(): title and description are routed to
4669 + // the imported keys and token-resolved; the rest keep their own keys.
2824 4670 $field_map = [
2825 - 'title' => '_metasync_metatitle',
2826 - 'description' => '_metasync_metadesc',
2827 4671 'og_title' => '_metasync_og_title',
2828 4672 'og_description' => '_metasync_og_description',
2829 4673 'canonical_url' => '_metasync_canonical_url',
2830 4674 ];
2831 4675
4676 + $imported_map = [
4677 + 'title' => Metasync_Seo_Precedence::KEY_IMPORTED_TITLE,
4678 + 'description' => Metasync_Seo_Precedence::KEY_IMPORTED_DESC,
4679 + ];
4680 +
4681 + foreach ($imported_map as $column => $dest_key) {
4682 + $term_updated = $this->store_imported_term_value(
4683 + $term,
4684 + isset($row->$column) ? (string) $row->$column : '',
4685 + 'aioseo',
4686 + $dest_key,
4687 + $overwrite
4688 + ) || $term_updated;
4689 + }
4690 +
2832 4691 foreach ($field_map as $column => $dest_key) {
2833 4692 $value = isset($row->$column) ? $row->$column : '';
2834 4693 if ($value === '' || $value === null) {
2835 4694 continue;
@@ -2843,8 +4702,13 @@
2843 4702 // Validate canonical: never import a corrupted value.
2844 4703 if ($dest_key === '_metasync_canonical_url') {
2845 4704 $value = Metasync_Canonical_Sanitizer::sanitize_for_save($value);
2846 4705 if ($value === '') {
4706 + continue;
4707 + }
4708 + } else {
4709 + $value = $this->resolve_term_placeholders($value, $term, 'aioseo');
4710 + if (trim($value) === '' || $this->has_unresolved_placeholders($value, 'aioseo')) {
2847 4711 continue;
2848 4712 }
2849 4713 }
2850 4714