← All changes | includes/class-ph-query.php +329 -120 2.2.4 → 2.3.0 View file →

		@@ -1,5 +1,8 @@
1	1	<?php
	2	+// phpcs:set WordPress.Security.ValidatedSanitizedInput customSanitizingFunctions[] ph_clean
	3	+// ph_clean() recursively sanitizes text; presence, shape and unslashing checks remain separate.
	4	+
2	5	/**
3	6	* Contains the query functions for PropertyHive which alter the front-end post queries and loops.
4	7	*
5	8	* @class PH_Query
		@@ -17,8 +20,18 @@
17	20	* PH_Query Class
18	21	*/
19	22	class PH_Query {
20	23
	24	+ /** Keyword normalized by this request's meta-query builder, shared across query instances. */
	25	+ private static $normalized_keyword = null;
	26	+
	27	+ /** Read a department slug for this query without changing the shared request. */
	28	+ private function get_requested_department() {
	29	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- A public search filter only; it does not authorize a write.
	30	+ return isset( $_REQUEST['department'] ) && is_string( $_REQUEST['department'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['department'] ) ) : null;
	31	+ }
	32	+
	33	+
21	34	/** @public array Query vars to add to wp */
22	35	public $query_vars = array();
23	36
24	37	/** @public array Unfiltered property ids (before layered nav etc) */
		@@ -54,9 +67,8 @@
54	67	* @access public
55	68	*/
56	69	public function __construct() {
57	70
58		- //add_action( 'init', array( $this, 'add_endpoints' ) );
59	71	add_action( 'init', array( $this, 'layered_nav_init' ) );
60	72	add_action( 'init', array( $this, 'price_filter_init' ) );
61	73
62	74	if ( ! is_admin() ) {
		@@ -149,14 +161,18 @@
149	161	if ( ( is_array($query->get('post_type')) && in_array('property', $query->get('post_type')) ) || ( !is_array($query->get('post_type')) && $query->get('post_type') == 'property' ) )
150	162	{
151	163	global $wpdb;
152	164
153		- if ( isset($_REQUEST['keyword']) && ph_clean($_REQUEST['keyword']) != '' )
	165	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public keyword filter reads the request, sanitizes/SQL-escapes it, and contributes only to the current SQL WHERE clause. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
	166	+ if ( isset($_REQUEST['keyword']) && is_string( $_REQUEST['keyword'] ) && $_REQUEST['keyword'] != '' )
154	167	{
	168	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only search; reuse the already-unslashed value produced by keyword_meta_query when available.
	169	+ $keyword = isset( self::$normalized_keyword ) && $_REQUEST['keyword'] === self::$normalized_keyword ? self::$normalized_keyword : sanitize_text_field( wp_unslash( $_REQUEST['keyword'] ) );
155	170	$ref_pos = strpos($where, '_features_concatenated');
156	171	if ( $ref_pos !== FALSE )
157	172	{
158		- $str_to_insert = " $wpdb->posts.post_excerpt LIKE '%" . esc_sql(ph_clean($_REQUEST['keyword'])) . "%' OR ";
	173	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public keyword filter reads the request, sanitizes/SQL-escapes it, and contributes only to the current SQL WHERE clause. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
	174	+ $str_to_insert = " $wpdb->posts.post_excerpt LIKE '%" . esc_sql( $keyword ) . "%' OR ";
159	175	$where = substr_replace($where, $str_to_insert, $ref_pos - 18, 0);
160	176	}
161	177	}
162	178	}
		@@ -184,9 +200,10 @@
184	200	$unit_filter_parameters = apply_filters( 'propertyhive_unit_filter_parameters', array( 'minimum_floor_area', 'maximum_floor_area' ) );
185	201	$unit_filter_parameter_found = false;
186	202	foreach ( $unit_filter_parameters as $parameter )
187	203	{
188		- if ( isset($_REQUEST[$parameter]) && ph_clean($_REQUEST[$parameter]) != '' )
	204	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public commercial display filter reads a request flag and contributes only to the current SQL WHERE clause. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
	205	+ if ( isset($_REQUEST[$parameter]) && ph_clean( wp_unslash( $_REQUEST[$parameter] ) ) != '' )
189	206	{
190	207	$unit_filter_parameter_found = true;
191	208	}
192	209	}
		@@ -219,21 +236,14 @@
219	236	/**
220	237	* Get any errors from querystring
221	238	*/
222	239	public function get_errors() {
223		- if ( ! empty( $_GET['ph_error'] ) && ( $error = sanitize_text_field( $_GET['ph_error'] ) ) && ! ph_has_notice( $error, 'error' ) )
	240	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public frontend reads ph_error to add a request-scoped notice; it does not write posts, options, user data, or other persistent state. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
	241	+ if ( ! empty( $_GET['ph_error'] ) && ( $error = sanitize_text_field( wp_unslash( $_GET['ph_error'] ) ) ) && ! ph_has_notice( $error, 'error' ) )
224	242	ph_add_notice( $error, 'error' );
225	243	}
226	244
227	245	/**
228		- * Add endpoints for query vars
229		- */
230		- public function add_endpoints() {
231		- foreach ( $this->query_vars as $key => $var )
232		- add_rewrite_endpoint( $var, EP_PAGES );
233		- }
234		-
235		- /**
236	246	* add_query_vars function.
237	247	*
238	248	* @access public
239	249	* @param array $vars
		@@ -261,9 +271,11 @@
261	271	global $wp;
262	272
263	273	// Map query vars to their keys, or get them if endpoints are not supported
264	274	foreach ( $this->query_vars as $key => $var ) {
	275	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public frontend normalizes a URL query variable into the current WP request query_vars; this is request/query state only and has no persistent write. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
265	276	if ( isset( $_GET[ $var ] ) ) {
	277	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public frontend normalizes a URL query variable into the current WP request query_vars; this is request/query state only and has no persistent write. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
266	278	$wp->query_vars[ $key ] = sanitize_text_field( wp_unslash( $_GET[ $var ] ) );
267	279	}
268	280
269	281	elseif ( isset( $wp->query_vars[ $var ] ) ) {
		@@ -320,8 +332,9 @@
320	332	if ( isset( $q->query['paged'] ) )
321	333	$q->set( 'paged', $q->query['paged'] );
322	334
323	335	// Define a variable so we know this is the front page search results later on
	336	+ // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedConstantFound -- Retain the existing frontend state constant for theme and extension compatibility.
324	337	define( 'SEARCH_RESULTS_IS_ON_FRONT', true );
325	338
326	339	// Get the actual WP page to avoid errors and let us use is_front_page()
327	340	// This is hacky but works. Awaiting http://core.trac.wordpress.org/ticket/21096
		@@ -521,8 +534,9 @@
521	534	$q->set( 'meta_query', $meta_query );
522	535	$q->set( 'tax_query', $tax_query );
523	536	$q->set( 'date_query', $date_query );
524	537	$q->set( 'post__in', $post__in );
	538	+ // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound -- Existing public Property Hive extension hook loop_search_results_per_page; changing the established name would detach installed callbacks.
525	539	$q->set( 'posts_per_page', $q->get( 'posts_per_page' ) ? $q->get( 'posts_per_page' ) : apply_filters( 'loop_search_results_per_page', get_option( 'posts_per_page' ) ) );
526	540
527	541	// Set a special variable
528	542	$q->set( 'ph_query', true );
		@@ -594,8 +608,9 @@
594	608	array(
595	609	'post_type' => 'property',
596	610	'numberposts' => -1,
597	611	'post_status' => 'publish',
	612	+ // phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_meta_query -- Cached property IDs must preserve the current search metadata predicates; only IDs are fetched, without totals or metadata/term cache priming.
598	613	'meta_query' => $this->meta_query,
599	614	'fields' => 'ids',
600	615	'no_found_rows' => true,
601	616	'update_post_meta_cache' => false,
		@@ -630,11 +645,14 @@
630	645	* @access public
631	646	* @return array
632	647	*/
633	648	public function get_search_results_ordering_args( $orderby = '', $order = '' ) {
	649	+ $request_department = $this->get_requested_department();
	650	+
634	651	// Get ordering from query string unless defined
635	652	if ( ! $orderby ) {
636		- $orderby_value = isset( $_GET['orderby'] ) ? sanitize_text_field( $_GET['orderby'] ) : apply_filters( 'propertyhive_default_search_results_orderby', get_option( 'propertyhive_default_search_results_orderby' ) );
	653	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads ordering/filter inputs and returns ordering arguments for the current query only. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
	654	+ $orderby_value = isset( $_GET['orderby'] ) ? sanitize_text_field( wp_unslash( $_GET['orderby'] ) ) : apply_filters( 'propertyhive_default_search_results_orderby', get_option( 'propertyhive_default_search_results_orderby' ) );
637	655
638	656	// Get order + orderby args from string
639	657	$orderby_value = explode( '-', $orderby_value );
640	658	$orderby = esc_attr( $orderby_value[0] );
		@@ -647,23 +665,29 @@
647	665	$args = array();
648	666
649	667	// default - menu_order
650	668	if (
651		- ( isset($_REQUEST['department']) && $_REQUEST['department'] != 'commercial' && ph_get_custom_department_based_on($_REQUEST['department']) != 'commercial' ) ||
652		- ( !isset($_REQUEST['department']) && get_option( 'propertyhive_primary_department' ) != 'commercial' && ph_get_custom_department_based_on(get_option( 'propertyhive_primary_department' )) != 'commercial' )
	669	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads ordering/filter inputs and returns ordering arguments for the current query only. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
	670	+ ( isset($request_department) && $request_department != 'commercial' && ph_get_custom_department_based_on($request_department) != 'commercial' ) ||
	671	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads ordering/filter inputs and returns ordering arguments for the current query only. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
	672	+ ( !isset($request_department) && get_option( 'propertyhive_primary_department' ) != 'commercial' && ph_get_custom_department_based_on(get_option( 'propertyhive_primary_department' )) != 'commercial' )
653	673	)
654	674	{
655	675	$args['orderby'] = 'meta_value_num';
656	676	$args['order'] = $order == 'ASC' ? 'ASC' : 'DESC';
	677	+ // phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_meta_key -- Search ordering maps supported price/floor-area/date choices to literal stored meta keys. switch cases and department branches set fixed keys; order direction is constrained to ASC/DESC.
657	678	$args['meta_key'] = '_price_actual';
658	679	}
659	680	elseif (
660		- ( isset($_REQUEST['department']) && ( $_REQUEST['department'] == 'commercial' || ph_get_custom_department_based_on($_REQUEST['department']) == 'commercial' ) ) ||
661		- ( !isset($_REQUEST['department']) && ( get_option( 'propertyhive_primary_department' ) == 'commercial' || ph_get_custom_department_based_on(get_option( 'propertyhive_primary_department' )) == 'commercial' ) )
	681	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads ordering/filter inputs and returns ordering arguments for the current query only. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
	682	+ ( isset($request_department) && ( $request_department == 'commercial' || ph_get_custom_department_based_on($request_department) == 'commercial' ) ) ||
	683	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads ordering/filter inputs and returns ordering arguments for the current query only. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
	684	+ ( !isset($request_department) && ( get_option( 'propertyhive_primary_department' ) == 'commercial' || ph_get_custom_department_based_on(get_option( 'propertyhive_primary_department' )) == 'commercial' ) )
662	685	)
663	686	{
664	687	$args['orderby'] = 'meta_value_num';
665	688	$args['order'] = $order == 'ASC' ? 'ASC' : 'DESC';
	689	+ // phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_meta_key -- Search ordering maps supported price/floor-area/date choices to literal stored meta keys. switch cases and department branches set fixed keys; order direction is constrained to ASC/DESC.
666	690	$args['meta_key'] = '_floor_area_from_sqft';
667	691	}
668	692
669	693	switch ( $orderby ) {
		@@ -670,16 +694,20 @@
670	694	case 'price' :
671	695	$args['orderby'] = 'meta_value_num';
672	696	$args['order'] = $order == 'ASC' ? 'ASC' : 'DESC';
673	697	if (
674		- ( isset($_REQUEST['department']) && ( $_REQUEST['department'] == 'commercial' || ph_get_custom_department_based_on($_REQUEST['department']) == 'commercial' ) ) ||
675		- ( !isset($_REQUEST['department']) && ( get_option( 'propertyhive_primary_department' ) == 'commercial' || ph_get_custom_department_based_on(get_option( 'propertyhive_primary_department' )) == 'commercial' ) )
	698	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads ordering/filter inputs and returns ordering arguments for the current query only. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
	699	+ ( isset($request_department) && ( $request_department == 'commercial' || ph_get_custom_department_based_on($request_department) == 'commercial' ) ) ||
	700	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads ordering/filter inputs and returns ordering arguments for the current query only. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
	701	+ ( !isset($request_department) && ( get_option( 'propertyhive_primary_department' ) == 'commercial' || ph_get_custom_department_based_on(get_option( 'propertyhive_primary_department' )) == 'commercial' ) )
676	702	)
677	703	{
	704	+ // phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_meta_key -- Search ordering maps supported price/floor-area/date choices to literal stored meta keys. switch cases and department branches set fixed keys; order direction is constrained to ASC/DESC.
678	705	$args['meta_key'] = '_price_from_actual';
679	706	}
680	707	else
681	708	{
	709	+ // phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_meta_key -- Search ordering maps supported price/floor-area/date choices to literal stored meta keys. switch cases and department branches set fixed keys; order direction is constrained to ASC/DESC.
682	710	$args['meta_key'] = '_price_actual';
683	711	}
684	712	break;
685	713	case 'floor_area' :
		@@ -684,13 +712,15 @@
684	712	break;
685	713	case 'floor_area' :
686	714	$args['orderby'] = 'meta_value_num';
687	715	$args['order'] = $order == 'ASC' ? 'ASC' : 'DESC';
	716	+ // phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_meta_key -- Search ordering maps supported price/floor-area/date choices to literal stored meta keys. switch cases and department branches set fixed keys; order direction is constrained to ASC/DESC.
688	717	$args['meta_key'] = '_floor_area_from_sqft';
689	718	break;
690	719	case 'date' :
691	720	$args['orderby'] = 'meta_value';
692	721	$args['order'] = $order == 'ASC' ? 'ASC' : 'DESC';
	722	+ // phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_meta_key -- Search ordering maps supported price/floor-area/date choices to literal stored meta keys. switch cases and department branches set fixed keys; order direction is constrained to ASC/DESC.
693	723	$args['meta_key'] = '_on_market_change_date';
694	724	break;
695	725	default :
696	726	{
		@@ -714,21 +744,25 @@
714	744	public function get_date_query() {
715	745
716	746	$date_query = array();
717	747
	748	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
718	749	if ( isset( $_REQUEST['added_from'] ) && $_REQUEST['added_from'] != '' )
719	750	{
720	751	$date_query = array(
721	752	'column' => 'post_date_gmt',
722		- 'after' => sanitize_text_field( $_REQUEST['added_from'] )
	753	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
	754	+ 'after' => sanitize_text_field( wp_unslash( $_REQUEST['added_from'] ) )
723	755	);
724	756	}
725	757
	758	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
726	759	if ( isset( $_REQUEST['added_from_hours'] ) && $_REQUEST['added_from_hours'] != '' )
727	760	{
728	761	$date_query = array(
729	762	'column' => 'post_date_gmt',
730		- 'after' => sanitize_text_field( $_REQUEST['added_from_hours'] ) . ' hours ago'
	763	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
	764	+ 'after' => sanitize_text_field( wp_unslash( $_REQUEST['added_from_hours'] ) ) . ' hours ago'
731	765	);
732	766	}
733	767
734	768	return array_filter( $date_query );
		@@ -818,16 +852,18 @@
818	852	* @access public
819	853	* @return array
820	854	*/
821	855	public function department_meta_query( $q ) {
	856	+ $request_department = $this->get_requested_department();
	857	+
822	858
823	859	$meta_query = array();
824	860
825		- if ( isset( $_REQUEST['department'] ) && $_REQUEST['department'] != '' )
	861	+ if ( isset( $request_department ) && $request_department != '' )
826	862	{
827	863	$meta_query = array(
828	864	'key' => '_department',
829		- 'value' => sanitize_text_field( $_REQUEST['department'] ),
	865	+ 'value' => sanitize_text_field( $request_department ),
830	866	'compare' => '='
831	867	);
832	868	}
833	869	else
		@@ -877,8 +913,9 @@
877	913	public function featured_meta_query( ) {
878	914
879	915	$meta_query = array();
880	916
	917	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
881	918	if ( isset( $_REQUEST['featured'] ) && $_REQUEST['featured'] != '' )
882	919	{
883	920	$meta_query = array(
884	921	'key' => '_featured',
		@@ -899,13 +936,15 @@
899	936	public function date_added_meta_query( ) {
900	937
901	938	$meta_query = array();
902	939
	940	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
903	941	if ( isset( $_REQUEST['date_added'] ) && $_REQUEST['date_added'] != '' && is_numeric($_REQUEST['date_added']) )
904	942	{
905	943	$meta_query = array(
906	944	'key' => '_on_market_change_date',
907		- 'value' => date('Y-m-d H:i:s', strtotime('-' . $_REQUEST['date_added'] . ' days')),
	945	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
	946	+ 'value' => gmdate('Y-m-d H:i:s', strtotime('-' . sanitize_text_field( wp_unslash( $_REQUEST['date_added'] ) ) . ' days')),
908	947	'compare' => '>=',
909	948	'type' => 'DATETIME',
910	949	);
911	950	}
		@@ -921,18 +960,33 @@
921	960	*/
922	961	public function address_keyword_meta_query( ) {
923	962
924	963	$meta_query = array();
925		-
926		- if ( isset( $_REQUEST['address_keyword'] ) && !empty($_REQUEST['address_keyword']) )
	964	+
	965	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Public read-only search control; no persistent state change.
	966	+ if ( isset( $_REQUEST['address_keyword'] ) && !empty($_REQUEST['address_keyword']) )
927	967	{
928		- $_REQUEST['address_keyword'] = ph_clean( wp_unslash( $_REQUEST['address_keyword'] ) );
929	968
	969	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Public read-only address search; values are validated below before query construction.
	970	+ $address_input = ph_clean( wp_unslash( $_REQUEST['address_keyword'] ) );
	971	+ if ( ! is_string( $address_input ) && ! is_array( $address_input ) ) {
	972	+ return $meta_query;
	973	+ }
	974	+ foreach ( (array) $address_input as $address_value ) {
	975	+ if ( ! is_string( $address_value ) ) {
	976	+ return $meta_query;
	977	+ }
	978	+ }
	979	+ $address_input = ph_clean( $address_input );
	980	+ // Preserve the normalized request value consumed by existing extensions.
	981	+ $_REQUEST['address_keyword'] = $address_input;
	982	+
930	983	$do_address_search = true;
931		- if ( get_option( 'propertyhive_address_keyword_compare', '=' ) == 'polygon' )
	984	+ if ( is_string( $address_input ) && get_option( 'propertyhive_address_keyword_compare', '=' ) == 'polygon' )
932	985	{
933	986	$address_keyword_polygon = new PH_Address_Keyword_Polygon();
934		- $polygon_coordinates = $address_keyword_polygon->get_address_keyword_polygon_coordinates( $_REQUEST['address_keyword'] . ', UK' );
	987	+
	988	+ $polygon_coordinates = $address_keyword_polygon->get_address_keyword_polygon_coordinates( $address_input . ', UK' );
935	989
936	990	if ( $polygon_coordinates !== FALSE )
937	991	{
938	992	$this->address_keyword_polygon_points = $polygon_coordinates;
		@@ -942,10 +996,11 @@
942	996	}
943	997
944	998	if ( $do_address_search )
945	999	{
946		- $address_keywords_to_query = is_array($_REQUEST['address_keyword']) ? $_REQUEST['address_keyword'] : array( $_REQUEST['address_keyword'] );
947	1000
	1001	+ $address_keywords_to_query = is_array($address_input) ? $address_input : array( $address_input );
	1002	+
948	1003	$address_fields_to_query = array(
949	1004	'_reference_number',
950	1005	'_address_street',
951	1006	'_address_two',
		@@ -1165,21 +1220,25 @@
1165	1220	public function country_meta_query( ) {
1166	1221
1167	1222	$meta_query = array();
1168	1223
	1224	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
1169	1225	if ( isset( $_REQUEST['country'] ) && $_REQUEST['country'] != '' )
1170	1226	{
1171	1227	$meta_query = array(
1172	1228	'key' => '_address_country',
1173		- 'value' => ph_clean( $_REQUEST['country'] )
	1229	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
	1230	+ 'value' => ph_clean( wp_unslash( $_REQUEST['country'] ) )
1174	1231	);
1175	1232	}
1176	1233
	1234	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
1177	1235	if ( isset( $_REQUEST['country_not'] ) && $_REQUEST['country_not'] != '' )
1178	1236	{
1179	1237	$meta_query = array(
1180	1238	'key' => '_address_country',
1181		- 'value' => ph_clean( $_REQUEST['country_not'] ),
	1239	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
	1240	+ 'value' => ph_clean( wp_unslash( $_REQUEST['country_not'] ) ),
1182	1241	'compare' => '!='
1183	1242	);
1184	1243	}
1185	1244
		@@ -1192,17 +1251,21 @@
1192	1251	* @access public
1193	1252	* @return array
1194	1253	*/
1195	1254	public function minimum_price_meta_query( ) {
	1255	+ $request_department = $this->get_requested_department();
	1256	+
1196	1257
1197	1258	$meta_query = array();
1198	1259
1199	1260	if (
1200		- isset( $_REQUEST['department'] ) && ( $_REQUEST['department'] == 'residential-sales' || ph_get_custom_department_based_on($_REQUEST['department']) == 'residential-sales' ) &&
	1261	+ isset( $request_department ) && ( $request_department == 'residential-sales' || ph_get_custom_department_based_on($request_department) == 'residential-sales' ) &&
	1262	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
1201	1263	isset( $_REQUEST['minimum_price'] ) && $_REQUEST['minimum_price'] != ''
1202	1264	)
1203	1265	{
1204		- $minimum_price = $_REQUEST['minimum_price'];
	1266	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
	1267	+ $minimum_price = is_string( $_REQUEST['minimum_price'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['minimum_price'] ) ) : '';
1205	1268
1206	1269	if ( !is_numeric($minimum_price) )
1207	1270	{
1208	1271	return $meta_query;
		@@ -1236,17 +1299,21 @@
1236	1299	* @access public
1237	1300	* @return array
1238	1301	*/
1239	1302	public function maximum_price_meta_query( ) {
	1303	+ $request_department = $this->get_requested_department();
	1304	+
1240	1305
1241	1306	$meta_query = array();
1242	1307
1243	1308	if (
1244		- isset( $_REQUEST['department'] ) && ( $_REQUEST['department'] == 'residential-sales' || ph_get_custom_department_based_on($_REQUEST['department']) == 'residential-sales' ) &&
	1309	+ isset( $request_department ) && ( $request_department == 'residential-sales' || ph_get_custom_department_based_on($request_department) == 'residential-sales' ) &&
	1310	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
1245	1311	isset( $_REQUEST['maximum_price'] ) && $_REQUEST['maximum_price'] != ''
1246	1312	)
1247	1313	{
1248		- $maximum_price = $_REQUEST['maximum_price'];
	1314	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
	1315	+ $maximum_price = is_string( $_REQUEST['maximum_price'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['maximum_price'] ) ) : '';
1249	1316
1250	1317	if ( !is_numeric($maximum_price) )
1251	1318	{
1252	1319	return $meta_query;
		@@ -1280,17 +1347,21 @@
1280	1347	* @access public
1281	1348	* @return array
1282	1349	*/
1283	1350	public function price_range_meta_query( ) {
	1351	+ $request_department = $this->get_requested_department();
	1352	+
1284	1353
1285	1354	$meta_query = array();
1286	1355
1287	1356	if (
1288		- isset( $_REQUEST['department'] ) && ( $_REQUEST['department'] == 'residential-sales' || ph_get_custom_department_based_on($_REQUEST['department']) == 'residential-sales' ) &&
1289		- isset( $_REQUEST['price_range'] ) && $_REQUEST['price_range'] != ''
	1357	+ isset( $request_department ) && ( $request_department == 'residential-sales' || ph_get_custom_department_based_on($request_department) == 'residential-sales' ) &&
	1358	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
	1359	+ isset( $_REQUEST['price_range'] ) && is_string( $_REQUEST['price_range'] ) && $_REQUEST['price_range'] != ''
1290	1360	)
1291	1361	{
1292		- $explode_price_range = explode("-", ph_clean($_REQUEST['price_range']));
	1362	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
	1363	+ $explode_price_range = explode("-", ph_clean( wp_unslash( $_REQUEST['price_range'] ) ));
1293	1364
1294	1365	$search_form_currency = get_option( 'propertyhive_search_form_currency', 'GBP' );
1295	1366	$search_form_currency = apply_filters( 'propertyhive_query_search_form_currency', $search_form_currency );
1296	1367
		@@ -1353,17 +1424,21 @@
1353	1424	* @access public
1354	1425	* @return array
1355	1426	*/
1356	1427	public function minimum_rent_meta_query( ) {
	1428	+ $request_department = $this->get_requested_department();
	1429	+
1357	1430
1358	1431	$meta_query = array();
1359	1432
1360	1433	if (
1361		- isset( $_REQUEST['department'] ) && ( $_REQUEST['department'] == 'residential-lettings' || ph_get_custom_department_based_on($_REQUEST['department']) == 'residential-lettings' ) &&
	1434	+ isset( $request_department ) && ( $request_department == 'residential-lettings' || ph_get_custom_department_based_on($request_department) == 'residential-lettings' ) &&
	1435	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
1362	1436	isset( $_REQUEST['minimum_rent'] ) && $_REQUEST['minimum_rent'] != ''
1363	1437	)
1364	1438	{
1365		- $minimum_rent = $_REQUEST['minimum_rent'];
	1439	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
	1440	+ $minimum_rent = is_string( $_REQUEST['minimum_rent'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['minimum_rent'] ) ) : '';
1366	1441
1367	1442	if ( !is_numeric($minimum_rent) )
1368	1443	{
1369	1444	return $meta_query;
		@@ -1406,17 +1481,21 @@
1406	1481	* @access public
1407	1482	* @return array
1408	1483	*/
1409	1484	public function maximum_rent_meta_query( ) {
	1485	+ $request_department = $this->get_requested_department();
	1486	+
1410	1487
1411	1488	$meta_query = array();
1412	1489
1413	1490	if (
1414		- isset( $_REQUEST['department'] ) && ( $_REQUEST['department'] == 'residential-lettings' || ph_get_custom_department_based_on($_REQUEST['department']) == 'residential-lettings' ) &&
	1491	+ isset( $request_department ) && ( $request_department == 'residential-lettings' || ph_get_custom_department_based_on($request_department) == 'residential-lettings' ) &&
	1492	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
1415	1493	isset( $_REQUEST['maximum_rent'] ) && $_REQUEST['maximum_rent'] != ''
1416	1494	)
1417	1495	{
1418		- $maximum_rent = $_REQUEST['maximum_rent'];
	1496	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
	1497	+ $maximum_rent = is_string( $_REQUEST['maximum_rent'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['maximum_rent'] ) ) : '';
1419	1498
1420	1499	if ( !is_numeric($maximum_rent) )
1421	1500	{
1422	1501	return $meta_query;
		@@ -1459,17 +1538,21 @@
1459	1538	* @access public
1460	1539	* @return array
1461	1540	*/
1462	1541	public function rent_range_meta_query( ) {
	1542	+ $request_department = $this->get_requested_department();
	1543	+
1463	1544
1464	1545	$meta_query = array();
1465	1546
1466	1547	if (
1467		- isset( $_REQUEST['department'] ) && ( $_REQUEST['department'] == 'residential-lettings' || ph_get_custom_department_based_on($_REQUEST['department']) == 'residential-lettings' ) &&
1468		- isset( $_REQUEST['rent_range'] ) && $_REQUEST['rent_range'] != ''
	1548	+ isset( $request_department ) && ( $request_department == 'residential-lettings' || ph_get_custom_department_based_on($request_department) == 'residential-lettings' ) &&
	1549	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
	1550	+ isset( $_REQUEST['rent_range'] ) && is_string( $_REQUEST['rent_range'] ) && $_REQUEST['rent_range'] != ''
1469	1551	)
1470	1552	{
1471		- $explode_rent_range = explode("-", ph_clean($_REQUEST['rent_range']));
	1553	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
	1554	+ $explode_rent_range = explode("-", ph_clean( wp_unslash( $_REQUEST['rent_range'] ) ));
1472	1555
1473	1556	$search_form_currency = get_option( 'propertyhive_search_form_currency', 'GBP' );
1474	1557	$search_form_currency = apply_filters( 'propertyhive_query_search_form_currency', $search_form_currency );
1475	1558
		@@ -1550,22 +1633,26 @@
1550	1633	* @access public
1551	1634	* @return array
1552	1635	*/
1553	1636	public function bedrooms_meta_query( ) {
	1637	+ $request_department = $this->get_requested_department();
	1638	+
1554	1639
1555	1640	$meta_query = array();
1556	1641
1557	1642	if (
1558	1643	(
1559		- (isset( $_REQUEST['department'] ) && ( $_REQUEST['department'] == 'residential-sales' || ph_get_custom_department_based_on($_REQUEST['department']) == 'residential-sales' )) ||
1560		- (isset( $_REQUEST['department'] ) && ( $_REQUEST['department'] == 'residential-lettings' || ph_get_custom_department_based_on($_REQUEST['department']) == 'residential-lettings' ))
	1644	+ (isset( $request_department ) && ( $request_department == 'residential-sales' || ph_get_custom_department_based_on($request_department) == 'residential-sales' )) ||
	1645	+ (isset( $request_department ) && ( $request_department == 'residential-lettings' || ph_get_custom_department_based_on($request_department) == 'residential-lettings' ))
1561	1646	) &&
	1647	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
1562	1648	isset( $_REQUEST['bedrooms'] ) && $_REQUEST['bedrooms'] != ''
1563	1649	)
1564	1650	{
1565	1651	$meta_query = array(
1566	1652	'key' => '_bedrooms',
1567		- 'value' => ph_clean( $_REQUEST['bedrooms'] ),
	1653	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
	1654	+ 'value' => ph_clean( wp_unslash( $_REQUEST['bedrooms'] ) ),
1568	1655	'compare' => '=',
1569	1656	'type' => 'NUMERIC'
1570	1657	);
1571	1658	}
		@@ -1579,22 +1666,26 @@
1579	1666	* @access public
1580	1667	* @return array
1581	1668	*/
1582	1669	public function minimum_bedrooms_meta_query( ) {
	1670	+ $request_department = $this->get_requested_department();
	1671	+
1583	1672
1584	1673	$meta_query = array();
1585	1674
1586	1675	if (
1587	1676	(
1588		- (isset( $_REQUEST['department'] ) && ( $_REQUEST['department'] == 'residential-sales' || ph_get_custom_department_based_on($_REQUEST['department']) == 'residential-sales' )) ||
1589		- (isset( $_REQUEST['department'] ) && ( $_REQUEST['department'] == 'residential-lettings' || ph_get_custom_department_based_on($_REQUEST['department']) == 'residential-lettings' ))
	1677	+ (isset( $request_department ) && ( $request_department == 'residential-sales' || ph_get_custom_department_based_on($request_department) == 'residential-sales' )) ||
	1678	+ (isset( $request_department ) && ( $request_department == 'residential-lettings' || ph_get_custom_department_based_on($request_department) == 'residential-lettings' ))
1590	1679	) &&
	1680	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
1591	1681	isset( $_REQUEST['minimum_bedrooms'] ) && $_REQUEST['minimum_bedrooms'] != ''
1592	1682	)
1593	1683	{
1594	1684	$meta_query = array(
1595	1685	'key' => '_bedrooms',
1596		- 'value' => ph_clean( $_REQUEST['minimum_bedrooms'] ),
	1686	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
	1687	+ 'value' => ph_clean( wp_unslash( $_REQUEST['minimum_bedrooms'] ) ),
1597	1688	'compare' => '>=',
1598	1689	'type' => 'NUMERIC'
1599	1690	);
1600	1691	}
		@@ -1608,22 +1699,26 @@
1608	1699	* @access public
1609	1700	* @return array
1610	1701	*/
1611	1702	public function maximum_bedrooms_meta_query( ) {
	1703	+ $request_department = $this->get_requested_department();
	1704	+
1612	1705
1613	1706	$meta_query = array();
1614	1707
1615	1708	if (
1616	1709	(
1617		- (isset( $_REQUEST['department'] ) && ( $_REQUEST['department'] == 'residential-sales' || ph_get_custom_department_based_on($_REQUEST['department']) == 'residential-sales' )) ||
1618		- (isset( $_REQUEST['department'] ) && ( $_REQUEST['department'] == 'residential-lettings' || ph_get_custom_department_based_on($_REQUEST['department']) == 'residential-lettings' ))
	1710	+ (isset( $request_department ) && ( $request_department == 'residential-sales' || ph_get_custom_department_based_on($request_department) == 'residential-sales' )) ||
	1711	+ (isset( $request_department ) && ( $request_department == 'residential-lettings' || ph_get_custom_department_based_on($request_department) == 'residential-lettings' ))
1619	1712	) &&
	1713	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
1620	1714	isset( $_REQUEST['maximum_bedrooms'] ) && $_REQUEST['maximum_bedrooms'] != ''
1621	1715	)
1622	1716	{
1623	1717	$meta_query = array(
1624	1718	'key' => '_bedrooms',
1625		- 'value' => ph_clean( $_REQUEST['maximum_bedrooms'] ),
	1719	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
	1720	+ 'value' => ph_clean( wp_unslash( $_REQUEST['maximum_bedrooms'] ) ),
1626	1721	'compare' => '<=',
1627	1722	'type' => 'NUMERIC'
1628	1723	);
1629	1724	}
		@@ -1637,22 +1732,26 @@
1637	1732	* @access public
1638	1733	* @return array
1639	1734	*/
1640	1735	public function minimum_bathrooms_meta_query( ) {
	1736	+ $request_department = $this->get_requested_department();
	1737	+
1641	1738
1642	1739	$meta_query = array();
1643	1740
1644	1741	if (
1645	1742	(
1646		- (isset( $_REQUEST['department'] ) && ( $_REQUEST['department'] == 'residential-sales' || ph_get_custom_department_based_on($_REQUEST['department']) == 'residential-sales' )) ||
1647		- (isset( $_REQUEST['department'] ) && ( $_REQUEST['department'] == 'residential-lettings' || ph_get_custom_department_based_on($_REQUEST['department']) == 'residential-lettings' ))
	1743	+ (isset( $request_department ) && ( $request_department == 'residential-sales' || ph_get_custom_department_based_on($request_department) == 'residential-sales' )) ||
	1744	+ (isset( $request_department ) && ( $request_department == 'residential-lettings' || ph_get_custom_department_based_on($request_department) == 'residential-lettings' ))
1648	1745	) &&
	1746	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
1649	1747	isset( $_REQUEST['minimum_bathrooms'] ) && $_REQUEST['minimum_bathrooms'] != ''
1650	1748	)
1651	1749	{
1652	1750	$meta_query = array(
1653	1751	'key' => '_bathrooms',
1654		- 'value' => ph_clean( $_REQUEST['minimum_bathrooms'] ),
	1752	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
	1753	+ 'value' => ph_clean( wp_unslash( $_REQUEST['minimum_bathrooms'] ) ),
1655	1754	'compare' => '>=',
1656	1755	'type' => 'NUMERIC'
1657	1756	);
1658	1757	}
		@@ -1666,22 +1765,26 @@
1666	1765	* @access public
1667	1766	* @return array
1668	1767	*/
1669	1768	public function maximum_bathrooms_meta_query( ) {
	1769	+ $request_department = $this->get_requested_department();
	1770	+
1670	1771
1671	1772	$meta_query = array();
1672	1773
1673	1774	if (
1674	1775	(
1675		- (isset( $_REQUEST['department'] ) && ( $_REQUEST['department'] == 'residential-sales' || ph_get_custom_department_based_on($_REQUEST['department']) == 'residential-sales' )) ||
1676		- (isset( $_REQUEST['department'] ) && ( $_REQUEST['department'] == 'residential-lettings' || ph_get_custom_department_based_on($_REQUEST['department']) == 'residential-lettings' ))
	1776	+ (isset( $request_department ) && ( $request_department == 'residential-sales' || ph_get_custom_department_based_on($request_department) == 'residential-sales' )) ||
	1777	+ (isset( $request_department ) && ( $request_department == 'residential-lettings' || ph_get_custom_department_based_on($request_department) == 'residential-lettings' ))
1677	1778	) &&
	1779	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
1678	1780	isset( $_REQUEST['maximum_bathrooms'] ) && $_REQUEST['maximum_bathrooms'] != ''
1679	1781	)
1680	1782	{
1681	1783	$meta_query = array(
1682	1784	'key' => '_bathrooms',
1683		- 'value' => ph_clean( $_REQUEST['maximum_bathrooms'] ),
	1785	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
	1786	+ 'value' => ph_clean( wp_unslash( $_REQUEST['maximum_bathrooms'] ) ),
1684	1787	'compare' => '<=',
1685	1788	'type' => 'NUMERIC'
1686	1789	);
1687	1790	}
		@@ -1695,22 +1798,26 @@
1695	1798	* @access public
1696	1799	* @return array
1697	1800	*/
1698	1801	public function minimum_reception_rooms_meta_query( ) {
	1802	+ $request_department = $this->get_requested_department();
	1803	+
1699	1804
1700	1805	$meta_query = array();
1701	1806
1702	1807	if (
1703	1808	(
1704		- (isset( $_REQUEST['department'] ) && ( $_REQUEST['department'] == 'residential-sales' || ph_get_custom_department_based_on($_REQUEST['department']) == 'residential-sales' )) ||
1705		- (isset( $_REQUEST['department'] ) && ( $_REQUEST['department'] == 'residential-lettings' || ph_get_custom_department_based_on($_REQUEST['department']) == 'residential-lettings' ))
	1809	+ (isset( $request_department ) && ( $request_department == 'residential-sales' || ph_get_custom_department_based_on($request_department) == 'residential-sales' )) ||
	1810	+ (isset( $request_department ) && ( $request_department == 'residential-lettings' || ph_get_custom_department_based_on($request_department) == 'residential-lettings' ))
1706	1811	) &&
	1812	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
1707	1813	isset( $_REQUEST['minimum_reception_rooms'] ) && $_REQUEST['minimum_reception_rooms'] != ''
1708	1814	)
1709	1815	{
1710	1816	$meta_query = array(
1711	1817	'key' => '_reception_rooms',
1712		- 'value' => ph_clean( $_REQUEST['minimum_reception_rooms'] ),
	1818	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
	1819	+ 'value' => ph_clean( wp_unslash( $_REQUEST['minimum_reception_rooms'] ) ),
1713	1820	'compare' => '>=',
1714	1821	'type' => 'NUMERIC'
1715	1822	);
1716	1823	}
		@@ -1724,22 +1831,26 @@
1724	1831	* @access public
1725	1832	* @return array
1726	1833	*/
1727	1834	public function maximum_reception_rooms_meta_query( ) {
	1835	+ $request_department = $this->get_requested_department();
	1836	+
1728	1837
1729	1838	$meta_query = array();
1730	1839
1731	1840	if (
1732	1841	(
1733		- (isset( $_REQUEST['department'] ) && ( $_REQUEST['department'] == 'residential-sales' || ph_get_custom_department_based_on($_REQUEST['department']) == 'residential-sales' )) ||
1734		- (isset( $_REQUEST['department'] ) && ( $_REQUEST['department'] == 'residential-lettings' || ph_get_custom_department_based_on($_REQUEST['department']) == 'residential-lettings' ))
	1842	+ (isset( $request_department ) && ( $request_department == 'residential-sales' || ph_get_custom_department_based_on($request_department) == 'residential-sales' )) ||
	1843	+ (isset( $request_department ) && ( $request_department == 'residential-lettings' || ph_get_custom_department_based_on($request_department) == 'residential-lettings' ))
1735	1844	) &&
	1845	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
1736	1846	isset( $_REQUEST['maximum_reception_rooms'] ) && $_REQUEST['maximum_reception_rooms'] != ''
1737	1847	)
1738	1848	{
1739	1849	$meta_query = array(
1740	1850	'key' => '_reception_rooms',
1741		- 'value' => ph_clean( $_REQUEST['maximum_reception_rooms'] ),
	1851	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
	1852	+ 'value' => ph_clean( wp_unslash( $_REQUEST['maximum_reception_rooms'] ) ),
1742	1853	'compare' => '<=',
1743	1854	'type' => 'NUMERIC'
1744	1855	);
1745	1856	}
		@@ -1753,17 +1864,21 @@
1753	1864	* @access public
1754	1865	* @return array
1755	1866	*/
1756	1867	public function available_date_from_meta_query( ) {
	1868	+ $request_department = $this->get_requested_department();
	1869	+
1757	1870
1758	1871	$meta_query = array();
1759	1872
1760	1873	if (
1761		- isset( $_REQUEST['department'] ) && ( $_REQUEST['department'] == 'residential-lettings' || ph_get_custom_department_based_on($_REQUEST['department']) == 'residential-lettings' ) &&
1762		- isset( $_REQUEST['available_date_from'] ) && $_REQUEST['available_date_from'] != ''
	1874	+ isset( $request_department ) && ( $request_department == 'residential-lettings' || ph_get_custom_department_based_on($request_department) == 'residential-lettings' ) &&
	1875	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
	1876	+ isset( $_REQUEST['available_date_from'] ) && is_string( $_REQUEST['available_date_from'] ) && $_REQUEST['available_date_from'] != ''
1763	1877	)
1764	1878	{
1765		- $available_date = ph_clean($_REQUEST['available_date_from']);
	1879	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
	1880	+ $available_date = ph_clean( wp_unslash( $_REQUEST['available_date_from'] ) );
1766	1881	if ( strpos($available_date, '/') !== FALSE )
1767	1882	{
1768	1883	// it's been provided in the format dd/mm/yyyy
1769	1884	$explode_available_date = explode("/", $available_date);
		@@ -1788,21 +1903,27 @@
1788	1903	* @access public
1789	1904	* @return array
1790	1905	*/
1791	1906	public function minimum_floor_area_meta_query( ) {
	1907	+ $request_department = $this->get_requested_department();
	1908	+
1792	1909
1793	1910	$meta_query = array();
1794	1911
1795	1912	if (
1796		- isset( $_REQUEST['department'] ) && ( $_REQUEST['department'] == 'commercial' || ph_get_custom_department_based_on($_REQUEST['department']) == 'commercial' ) &&
	1913	+ isset( $request_department ) && ( $request_department == 'commercial' || ph_get_custom_department_based_on($request_department) == 'commercial' ) &&
	1914	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
1797	1915	isset( $_REQUEST['minimum_floor_area'] ) && $_REQUEST['minimum_floor_area'] != '' &&
1798	1916	(
	1917	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
1799	1918	!isset( $_REQUEST['maximum_floor_area'] ) ||
	1919	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
1800	1920	( isset( $_REQUEST['maximum_floor_area'] ) && $_REQUEST['maximum_floor_area'] == '' )
1801	1921	)
1802	1922	)
1803	1923	{
1804		- $value = ph_clean( $_REQUEST['minimum_floor_area'] );
	1924	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
	1925	+ $value = ph_clean( wp_unslash( $_REQUEST['minimum_floor_area'] ) );
1805	1926	if ( apply_filters('propertyhive_default_commercial_search_floor_area_unit', 'sqft') != 'sqft' )
1806	1927	{
1807	1928	// Convert value from square metres to square feet
1808	1929	$value = $value * 10.76391041671;
		@@ -1825,21 +1946,27 @@
1825	1946	* @access public
1826	1947	* @return array
1827	1948	*/
1828	1949	public function maximum_floor_area_meta_query( ) {
	1950	+ $request_department = $this->get_requested_department();
	1951	+
1829	1952
1830	1953	$meta_query = array();
1831	1954
1832	1955	if (
1833		- isset( $_REQUEST['department'] ) && ( $_REQUEST['department'] == 'commercial' || ph_get_custom_department_based_on($_REQUEST['department']) == 'commercial' ) &&
	1956	+ isset( $request_department ) && ( $request_department == 'commercial' || ph_get_custom_department_based_on($request_department) == 'commercial' ) &&
	1957	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
1834	1958	isset( $_REQUEST['maximum_floor_area'] ) && $_REQUEST['maximum_floor_area'] != '' &&
1835	1959	(
	1960	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
1836	1961	!isset( $_REQUEST['minimum_floor_area'] ) ||
	1962	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
1837	1963	( isset( $_REQUEST['minimum_floor_area'] ) && $_REQUEST['minimum_floor_area'] == '' )
1838	1964	)
1839	1965	)
1840	1966	{
1841		- $value = ph_clean( $_REQUEST['maximum_floor_area'] );
	1967	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
	1968	+ $value = ph_clean( wp_unslash( $_REQUEST['maximum_floor_area'] ) );
1842	1969	if ( apply_filters('propertyhive_default_commercial_search_floor_area_unit', 'sqft') != 'sqft' )
1843	1970	{
1844	1971	// Convert value from square metres to square feet
1845	1972	$value = $value * 10.76391041671;
		@@ -1862,19 +1989,25 @@
1862	1989	* @access public
1863	1990	* @return array
1864	1991	*/
1865	1992	public function minimum_maximum_floor_area_meta_query( ) {
	1993	+ $request_department = $this->get_requested_department();
	1994	+
1866	1995
1867	1996	$meta_query = array();
1868	1997
1869	1998	if (
1870		- isset( $_REQUEST['department'] ) && ( $_REQUEST['department'] == 'commercial' || ph_get_custom_department_based_on($_REQUEST['department']) == 'commercial' ) &&
	1999	+ isset( $request_department ) && ( $request_department == 'commercial' || ph_get_custom_department_based_on($request_department) == 'commercial' ) &&
	2000	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
1871	2001	isset( $_REQUEST['minimum_floor_area'] ) && $_REQUEST['minimum_floor_area'] != '' &&
	2002	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
1872	2003	isset( $_REQUEST['maximum_floor_area'] ) && $_REQUEST['maximum_floor_area'] != ''
1873	2004	)
1874	2005	{
1875		- $maximum_floor_area = ph_clean( $_REQUEST['maximum_floor_area'] );
1876		- $minimum_floor_area = ph_clean( $_REQUEST['minimum_floor_area'] );
	2006	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
	2007	+ $maximum_floor_area = ph_clean( wp_unslash( $_REQUEST['maximum_floor_area'] ) );
	2008	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
	2009	+ $minimum_floor_area = ph_clean( wp_unslash( $_REQUEST['minimum_floor_area'] ) );
1877	2010	if ( apply_filters('propertyhive_default_commercial_search_floor_area_unit', 'sqft') != 'sqft' )
1878	2011	{
1879	2012	// Convert value from square metres to square feet
1880	2013	$maximum_floor_area = $maximum_floor_area * 10.76391041671;
		@@ -1905,17 +2038,21 @@
1905	2038	* @access public
1906	2039	* @return array
1907	2040	*/
1908	2041	public function floor_area_range_meta_query( ) {
	2042	+ $request_department = $this->get_requested_department();
	2043	+
1909	2044
1910	2045	$meta_query = array();
1911	2046
1912	2047	if (
1913		- isset( $_REQUEST['department'] ) && ( $_REQUEST['department'] == 'commercial' || ph_get_custom_department_based_on($_REQUEST['department']) == 'commercial' ) &&
1914		- isset( $_REQUEST['floor_area_range'] ) && $_REQUEST['floor_area_range'] != ''
	2048	+ isset( $request_department ) && ( $request_department == 'commercial' || ph_get_custom_department_based_on($request_department) == 'commercial' ) &&
	2049	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
	2050	+ isset( $_REQUEST['floor_area_range'] ) && is_string( $_REQUEST['floor_area_range'] ) && $_REQUEST['floor_area_range'] != ''
1915	2051	)
1916	2052	{
1917		- $explode_floor_area_range = explode("-", ph_clean($_REQUEST['floor_area_range']));
	2053	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
	2054	+ $explode_floor_area_range = explode("-", ph_clean( wp_unslash( $_REQUEST['floor_area_range'] ) ));
1918	2055
1919	2056	if ( isset($explode_floor_area_range[0]) && $explode_floor_area_range[0] != '' )
1920	2057	{
1921	2058	$meta_query = array(
		@@ -1945,13 +2082,16 @@
1945	2082	* @access public
1946	2083	* @return array
1947	2084	*/
1948	2085	public function commercial_for_sale_to_rent_meta_query( ) {
	2086	+ $request_department = $this->get_requested_department();
	2087	+
1949	2088
1950	2089	$meta_query = array();
1951	2090
1952	2091	if (
1953		- isset( $_REQUEST['department'] ) && ( $_REQUEST['department'] == 'commercial' || ph_get_custom_department_based_on($_REQUEST['department']) == 'commercial' ) &&
	2092	+ isset( $request_department ) && ( $request_department == 'commercial' || ph_get_custom_department_based_on($request_department) == 'commercial' ) &&
	2093	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
1954	2094	isset( $_REQUEST['commercial_for_sale_to_rent'] ) && $_REQUEST['commercial_for_sale_to_rent'] == 'for_sale'
1955	2095	)
1956	2096	{
1957	2097	$meta_query = array(
		@@ -1961,9 +2101,10 @@
1961	2101	);
1962	2102	}
1963	2103
1964	2104	if (
1965		- isset( $_REQUEST['department'] ) && ( $_REQUEST['department'] == 'commercial' || ph_get_custom_department_based_on($_REQUEST['department']) == 'commercial' ) &&
	2105	+ isset( $request_department ) && ( $request_department == 'commercial' || ph_get_custom_department_based_on($request_department) == 'commercial' ) &&
	2106	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
1966	2107	isset( $_REQUEST['commercial_for_sale_to_rent'] ) && $_REQUEST['commercial_for_sale_to_rent'] == 'to_rent'
1967	2108	)
1968	2109	{
1969	2110	$meta_query = array(
		@@ -1982,13 +2123,16 @@
1982	2123	* @access public
1983	2124	* @return array
1984	2125	*/
1985	2126	public function commercial_for_sale_meta_query( ) {
	2127	+ $request_department = $this->get_requested_department();
	2128	+
1986	2129
1987	2130	$meta_query = array();
1988	2131
1989	2132	if (
1990		- isset( $_REQUEST['department'] ) && ( $_REQUEST['department'] == 'commercial' || ph_get_custom_department_based_on($_REQUEST['department']) == 'commercial' ) &&
	2133	+ isset( $request_department ) && ( $request_department == 'commercial' || ph_get_custom_department_based_on($request_department) == 'commercial' ) &&
	2134	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
1991	2135	isset( $_REQUEST['commercial_for_sale'] ) && $_REQUEST['commercial_for_sale'] == '1'
1992	2136	)
1993	2137	{
1994	2138	$meta_query = array(
		@@ -2007,13 +2151,16 @@
2007	2151	* @access public
2008	2152	* @return array
2009	2153	*/
2010	2154	public function commercial_to_rent_meta_query( ) {
	2155	+ $request_department = $this->get_requested_department();
	2156	+
2011	2157
2012	2158	$meta_query = array();
2013	2159
2014	2160	if (
2015		- isset( $_REQUEST['department'] ) && ( $_REQUEST['department'] == 'commercial' || ph_get_custom_department_based_on($_REQUEST['department']) == 'commercial' ) &&
	2161	+ isset( $request_department ) && ( $request_department == 'commercial' || ph_get_custom_department_based_on($request_department) == 'commercial' ) &&
	2162	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
2016	2163	isset( $_REQUEST['commercial_to_rent'] ) && $_REQUEST['commercial_to_rent'] == '1'
2017	2164	)
2018	2165	{
2019	2166	$meta_query = array(
		@@ -2032,22 +2179,28 @@
2032	2179	* @access public
2033	2180	* @return array
2034	2181	*/
2035	2182	public function commercial_minimum_price_meta_query( ) {
	2183	+ $request_department = $this->get_requested_department();
	2184	+
2036	2185
2037	2186	$meta_query = array();
2038	2187
2039	2188	if (
2040		- isset( $_REQUEST['department'] ) && ( $_REQUEST['department'] == 'commercial' || ph_get_custom_department_based_on($_REQUEST['department']) == 'commercial' ) &&
	2189	+ isset( $request_department ) && ( $request_department == 'commercial' || ph_get_custom_department_based_on($request_department) == 'commercial' ) &&
2041	2190	(
	2191	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
2042	2192	( isset( $_REQUEST['commercial_for_sale_to_rent'] ) && $_REQUEST['commercial_for_sale_to_rent'] == 'for_sale' )
2043	2193	||
	2194	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
2044	2195	( isset( $_REQUEST['commercial_for_sale'] ) && $_REQUEST['commercial_for_sale'] == '1' )
2045	2196	) &&
	2197	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
2046	2198	isset( $_REQUEST['commercial_minimum_price'] ) && $_REQUEST['commercial_minimum_price'] != ''
2047	2199	)
2048	2200	{
2049		- $minimum_price = $_REQUEST['commercial_minimum_price'];
	2201	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
	2202	+ $minimum_price = is_string( $_REQUEST['commercial_minimum_price'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['commercial_minimum_price'] ) ) : '';
2050	2203
2051	2204	if ( !is_numeric($minimum_price) )
2052	2205	{
2053	2206	return $meta_query;
		@@ -2081,22 +2234,28 @@
2081	2234	* @access public
2082	2235	* @return array
2083	2236	*/
2084	2237	public function commercial_maximum_price_meta_query( ) {
	2238	+ $request_department = $this->get_requested_department();
	2239	+
2085	2240
2086	2241	$meta_query = array();
2087	2242
2088	2243	if (
2089		- isset( $_REQUEST['department'] ) && ( $_REQUEST['department'] == 'commercial' || ph_get_custom_department_based_on($_REQUEST['department']) == 'commercial' ) &&
	2244	+ isset( $request_department ) && ( $request_department == 'commercial' || ph_get_custom_department_based_on($request_department) == 'commercial' ) &&
2090	2245	(
	2246	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
2091	2247	( isset( $_REQUEST['commercial_for_sale_to_rent'] ) && $_REQUEST['commercial_for_sale_to_rent'] == 'for_sale' )
2092	2248	||
	2249	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
2093	2250	( isset( $_REQUEST['commercial_for_sale'] ) && $_REQUEST['commercial_for_sale'] == '1' )
2094	2251	) &&
	2252	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
2095	2253	isset( $_REQUEST['commercial_maximum_price'] ) && $_REQUEST['commercial_maximum_price'] != ''
2096	2254	)
2097	2255	{
2098		- $maximum_price = $_REQUEST['commercial_maximum_price'];
	2256	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
	2257	+ $maximum_price = is_string( $_REQUEST['commercial_maximum_price'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['commercial_maximum_price'] ) ) : '';
2099	2258
2100	2259	if ( !is_numeric($maximum_price) )
2101	2260	{
2102	2261	return $meta_query;
		@@ -2130,22 +2289,28 @@
2130	2289	* @access public
2131	2290	* @return array
2132	2291	*/
2133	2292	public function commercial_minimum_rent_meta_query( ) {
	2293	+ $request_department = $this->get_requested_department();
	2294	+
2134	2295
2135	2296	$meta_query = array();
2136	2297
2137	2298	if (
2138		- isset( $_REQUEST['department'] ) && ( $_REQUEST['department'] == 'commercial' || ph_get_custom_department_based_on($_REQUEST['department']) == 'commercial' ) &&
	2299	+ isset( $request_department ) && ( $request_department == 'commercial' || ph_get_custom_department_based_on($request_department) == 'commercial' ) &&
2139	2300	(
	2301	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
2140	2302	( isset( $_REQUEST['commercial_for_sale_to_rent'] ) && $_REQUEST['commercial_for_sale_to_rent'] == 'to_rent' )
2141	2303	||
	2304	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
2142	2305	( isset( $_REQUEST['commercial_to_rent'] ) && $_REQUEST['commercial_to_rent'] == '1' )
2143	2306	) &&
	2307	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
2144	2308	isset( $_REQUEST['commercial_minimum_rent'] ) && $_REQUEST['commercial_minimum_rent'] != ''
2145	2309	)
2146	2310	{
2147		- $minimum_rent = $_REQUEST['commercial_minimum_rent'];
	2311	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
	2312	+ $minimum_rent = is_string( $_REQUEST['commercial_minimum_rent'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['commercial_minimum_rent'] ) ) : '';
2148	2313
2149	2314	if ( !is_numeric($minimum_rent) )
2150	2315	{
2151	2316	return $meta_query;
		@@ -2179,22 +2344,28 @@
2179	2344	* @access public
2180	2345	* @return array
2181	2346	*/
2182	2347	public function commercial_maximum_rent_meta_query( ) {
	2348	+ $request_department = $this->get_requested_department();
	2349	+
2183	2350
2184	2351	$meta_query = array();
2185	2352
2186	2353	if (
2187		- isset( $_REQUEST['department'] ) && ( $_REQUEST['department'] == 'commercial' || ph_get_custom_department_based_on($_REQUEST['department']) == 'commercial' ) &&
	2354	+ isset( $request_department ) && ( $request_department == 'commercial' || ph_get_custom_department_based_on($request_department) == 'commercial' ) &&
2188	2355	(
	2356	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
2189	2357	( isset( $_REQUEST['commercial_for_sale_to_rent'] ) && $_REQUEST['commercial_for_sale_to_rent'] == 'to_rent' )
2190	2358	||
	2359	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
2191	2360	( isset( $_REQUEST['commercial_to_rent'] ) && $_REQUEST['commercial_to_rent'] == '1' )
2192	2361	) &&
	2362	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
2193	2363	isset( $_REQUEST['commercial_maximum_rent'] ) && $_REQUEST['commercial_maximum_rent'] != ''
2194	2364	)
2195	2365	{
2196		- $maximum_rent = $_REQUEST['commercial_maximum_rent'];
	2366	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
	2367	+ $maximum_rent = is_string( $_REQUEST['commercial_maximum_rent'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['commercial_maximum_rent'] ) ) : '';
2197	2368
2198	2369	if ( !is_numeric($maximum_rent) )
2199	2370	{
2200	2371	return $meta_query;
		@@ -2231,12 +2402,14 @@
2231	2402	public function negotiator_meta_query( ) {
2232	2403
2233	2404	$meta_query = array();
2234	2405
	2406	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
2235	2407	if ( isset( $_REQUEST['negotiator_id'] ) && $_REQUEST['negotiator_id'] != '' )
2236	2408	{
2237	2409	$meta_query = array(
2238	2410	'key' => '_negotiator_id',
	2411	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
2239	2412	'value' => (int)$_REQUEST['negotiator_id'],
2240	2413	'compare' => '='
2241	2414	);
2242	2415	}
		@@ -2254,13 +2427,15 @@
2254	2427	public function office_meta_query( ) {
2255	2428
2256	2429	$meta_query = array();
2257	2430
	2431	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
2258	2432	if ( isset( $_REQUEST['officeID'] ) && $_REQUEST['officeID'] != '' )
2259	2433	{
2260	2434	$meta_query = array(
2261	2435	'key' => '_office_id',
2262		- 'value' => ph_clean( (is_array($_REQUEST['officeID'])) ? $_REQUEST['officeID'] : array( $_REQUEST['officeID'] ) ),
	2436	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
	2437	+ 'value' => ph_clean( wp_unslash( (array) $_REQUEST['officeID'] ) ),
2263	2438	'compare' => 'IN'
2264	2439	);
2265	2440	}
2266	2441
		@@ -2275,46 +2450,64 @@
2275	2450	*/
2276	2451	public function keyword_meta_query( ) {
2277	2452
2278	2453	$meta_query = array();
2279		-
2280		- if ( isset( $_REQUEST['keyword'] ) && $_REQUEST['keyword'] != '' )
	2454	+
	2455	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Public read-only search input; query construction does not change persistent state.
	2456	+ if ( isset( $_REQUEST['keyword'] ) && is_string( $_REQUEST['keyword'] ) && $_REQUEST['keyword'] != '' )
2281	2457	{
2282		- $_REQUEST['keyword'] = ph_clean( wp_unslash( $_REQUEST['keyword'] ) );
2283	2458
	2459	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Public read-only search input is type checked above.
	2460	+ $request_keyword = sanitize_text_field( wp_unslash( $_REQUEST['keyword'] ) );
	2461	+
2284	2462	// Remove country code from end (i.e. ', UK')
2285		- $_REQUEST['keyword'] = preg_replace('/\,\s?[A-Z][A-Z]$/', '', $_REQUEST['keyword']);
2286	2463
	2464	+ $request_keyword = preg_replace('/\,\s?[A-Z][A-Z]$/', '', $request_keyword);
	2465	+
2287	2466	// Extract postcode and use that if exists
2288	2467	$postcode_pattern = '/\b([A-Z]{1,2}[0-9][0-9A-Z]? ?[0-9]?[A-Z]{0,2})\b/i';
2289		- if ( preg_match($postcode_pattern, $_REQUEST['keyword'], $matches) )
	2468	+
	2469	+ if ( preg_match($postcode_pattern, $request_keyword, $matches) )
2290	2470	{
2291		- $_REQUEST['keyword'] = $matches[1];
	2471	+ $request_keyword = $matches[1];
2292	2472	}
2293	2473
2294		- $_REQUEST['keyword'] = trim($_REQUEST['keyword']);
	2474	+ $request_keyword = trim($request_keyword);
2295	2475
2296		- $keywords = array( $_REQUEST['keyword'] );
	2476	+ // Keep the normalized request value available to the existing excerpt query and extension filters.
	2477	+ $_REQUEST['keyword'] = $request_keyword;
	2478	+ self::$normalized_keyword = $request_keyword;
2297	2479
2298		- if ( strpos( $_REQUEST['keyword'], ' ' ) !== FALSE )
	2480	+ $keywords = array( $request_keyword );
	2481	+
	2482	+ if ( strpos( $request_keyword, ' ' ) !== FALSE )
2299	2483	{
2300		- $keywords[] = str_replace(" ", "-", ph_clean($_REQUEST['keyword']));
	2484	+
	2485	+ $keywords[] = str_replace(" ", "-", ph_clean($request_keyword));
2301	2486	}
2302		- if ( strpos( $_REQUEST['keyword'], '-' ) !== FALSE )
	2487	+
	2488	+ if ( strpos( $request_keyword, '-' ) !== FALSE )
2303	2489	{
2304		- $keywords[] = str_replace("-", " ", ph_clean($_REQUEST['keyword']));
	2490	+
	2491	+ $keywords[] = str_replace("-", " ", ph_clean($request_keyword));
2305	2492	}
2306		- if ( strpos( $_REQUEST['keyword'], '.' ) !== FALSE )
	2493	+
	2494	+ if ( strpos( $request_keyword, '.' ) !== FALSE )
2307	2495	{
2308		- $keywords[] = str_replace(".", "", ph_clean($_REQUEST['keyword']));
	2496	+
	2497	+ $keywords[] = str_replace(".", "", ph_clean($request_keyword));
2309	2498	}
2310		- if ( stripos( $_REQUEST['keyword'], 'st ' ) !== FALSE )
	2499	+
	2500	+ if ( stripos( $request_keyword, 'st ' ) !== FALSE )
2311	2501	{
2312		- $keywords[] = str_ireplace("st ", "st. ", ph_clean($_REQUEST['keyword']));
	2502	+
	2503	+ $keywords[] = str_ireplace("st ", "st. ", ph_clean($request_keyword));
2313	2504	}
2314		- if ( strpos( $_REQUEST['keyword'], '\'' ) !== FALSE )
	2505	+
	2506	+ if ( strpos( $request_keyword, '\'' ) !== FALSE )
2315	2507	{
2316		- $keywords[] = str_replace("'", "", ph_clean($_REQUEST['keyword']));
	2508	+
	2509	+ $keywords[] = str_replace("'", "", ph_clean($request_keyword));
2317	2510	}
2318	2511
2319	2512	$meta_query = array( 'relation' => 'OR' );
2320	2513
		@@ -2345,13 +2538,15 @@
2345	2538	}
2346	2539	}
2347	2540	if ( in_array('_address_postcode', $fields_to_query) )
2348	2541	{
2349		- if ( strlen($_REQUEST['keyword']) <= 4 )
	2542	+
	2543	+ if ( strlen($request_keyword) <= 4 )
2350	2544	{
2351	2545	$meta_query[] = array(
2352	2546	'key' => '_address_postcode',
2353		- 'value' => ph_clean( $_REQUEST['keyword'] ),
	2547	+
	2548	+ 'value' => ph_clean( $request_keyword ),
2354	2549	'compare' => '='
2355	2550	);
2356	2551	// Run regex match where given keyword is at the start of the postcode ^
2357	2552	// followed by one or zero letters (for WC2E-style postcodes) [a-zA-Z]?
		@@ -2357,16 +2552,18 @@
2357	2552	// followed by one or zero letters (for WC2E-style postcodes) [a-zA-Z]?
2358	2553	// then a single space [ ]
2359	2554	$meta_query[] = array(
2360	2555	'key' => '_address_postcode',
2361		- 'value' => '^' . ph_clean( $_REQUEST['keyword'] ) . '[a-zA-Z]?[ ]',
	2556	+
	2557	+ 'value' => '^' . ph_clean( $request_keyword ) . '[a-zA-Z]?[ ]',
2362	2558	'compare' => 'RLIKE'
2363	2559	);
2364	2560	}
2365	2561	else
2366	2562	{
2367		- $postcode = ph_clean( $_REQUEST['keyword'] );
2368	2563
	2564	+ $postcode = ph_clean( $request_keyword );
	2565	+
2369	2566	if ( preg_match('#^(GIR ?0AA|[A-PR-UWYZ]([0-9]{1,2}|([A-HK-Y][0-9]([0-9ABEHMNPRV-Y])?)|[0-9][A-HJKPS-UW])[0-9][ABD-HJLNP-UW-Z]{2})$#i', $postcode) )
2370	2567	{
2371	2568	// UK postcode found with no space
2372	2569
		@@ -2414,19 +2611,29 @@
2414	2611	public function get_tax_query( $tax_query = array() ) {
2415	2612	if ( ! is_array( $tax_query ) )
2416	2613	$tax_query = array();
2417	2614
	2615	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Public read-only taxonomy search; this does not authorize a write.
2418	2616	if ( isset($_REQUEST) && !empty($_REQUEST) )
2419	2617	{
	2618	+
	2619	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Public read-only taxonomy search; each value is validated and sanitized below.
2420	2620	foreach ( $_REQUEST as $key => $value )
2421	2621	{
2422		- if ( taxonomy_exists($key) && isset( $_REQUEST[$key] ) && !empty($_REQUEST[$key]) && $this->taxonomy_allowed_for_department( $key ) )
	2622	+
	2623	+ if ( taxonomy_exists($key) && !empty($value) && $this->taxonomy_allowed_for_department( $key ) )
2423	2624	{
	2625	+ $terms = (array) $value;
	2626	+ foreach ( $terms as $term ) {
	2627	+ if ( ! is_string( $term ) && ! is_int( $term ) ) {
	2628	+ continue 2;
	2629	+ }
	2630	+ }
2424	2631	$operator = $key == 'property_feature' ? 'AND' : 'IN';
2425	2632
2426	2633	$tax_query[] = array(
2427	2634	'taxonomy' => $key,
2428		- 'terms' => ph_clean( (is_array($value)) ? $value : array( $value ) ),
	2635	+ 'terms' => ph_clean( wp_unslash( $terms ) ),
2429	2636	'operator' => $operator,
2430	2637	);
2431	2638	}
2432	2639	}
		@@ -2436,11 +2643,13 @@
2436	2643	}
2437	2644
2438	2645	private function taxonomy_allowed_for_department( $taxonomy )
2439	2646	{
2440		- if ( isset( $_REQUEST['department'] ) && $_REQUEST['department'] != '' )
	2647	+ $request_department = $this->get_requested_department();
	2648	+
	2649	+ if ( isset( $request_department ) && $request_department != '' )
2441	2650	{
2442		- $department = ph_clean($_REQUEST['department']);
	2651	+ $department = ph_clean($request_department);
2443	2652	}
2444	2653	else
2445	2654	{
2446	2655	$department = get_option( 'propertyhive_primary_department', 'residential-sales' );