← All changes | includes/class-ph-query.php +329 -111 2.2.6 → 2.3.0 View file →

		@@ -1,5 +1,8 @@
1	1	<?php
	2	+// phpcs:set WordPress.Security.ValidatedSanitizedInput customSanitizingFunctions[] ph_clean
	3	+// ph_clean() recursively sanitizes text; presence, shape and unslashing checks remain separate.
	4	+
2	5	/**
3	6	* Contains the query functions for PropertyHive which alter the front-end post queries and loops.
4	7	*
5	8	* @class PH_Query
		@@ -17,8 +20,18 @@
17	20	* PH_Query Class
18	21	*/
19	22	class PH_Query {
20	23
	24	+ /** Keyword normalized by this request's meta-query builder, shared across query instances. */
	25	+ private static $normalized_keyword = null;
	26	+
	27	+ /** Read a department slug for this query without changing the shared request. */
	28	+ private function get_requested_department() {
	29	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- A public search filter only; it does not authorize a write.
	30	+ return isset( $_REQUEST['department'] ) && is_string( $_REQUEST['department'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['department'] ) ) : null;
	31	+ }
	32	+
	33	+
21	34	/** @public array Query vars to add to wp */
22	35	public $query_vars = array();
23	36
24	37	/** @public array Unfiltered property ids (before layered nav etc) */
		@@ -148,14 +161,18 @@
148	161	if ( ( is_array($query->get('post_type')) && in_array('property', $query->get('post_type')) ) || ( !is_array($query->get('post_type')) && $query->get('post_type') == 'property' ) )
149	162	{
150	163	global $wpdb;
151	164
152		- if ( isset($_REQUEST['keyword']) && ph_clean($_REQUEST['keyword']) != '' )
	165	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public keyword filter reads the request, sanitizes/SQL-escapes it, and contributes only to the current SQL WHERE clause. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
	166	+ if ( isset($_REQUEST['keyword']) && is_string( $_REQUEST['keyword'] ) && $_REQUEST['keyword'] != '' )
153	167	{
	168	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only search; reuse the already-unslashed value produced by keyword_meta_query when available.
	169	+ $keyword = isset( self::$normalized_keyword ) && $_REQUEST['keyword'] === self::$normalized_keyword ? self::$normalized_keyword : sanitize_text_field( wp_unslash( $_REQUEST['keyword'] ) );
154	170	$ref_pos = strpos($where, '_features_concatenated');
155	171	if ( $ref_pos !== FALSE )
156	172	{
157		- $str_to_insert = " $wpdb->posts.post_excerpt LIKE '%" . esc_sql(ph_clean($_REQUEST['keyword'])) . "%' OR ";
	173	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public keyword filter reads the request, sanitizes/SQL-escapes it, and contributes only to the current SQL WHERE clause. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
	174	+ $str_to_insert = " $wpdb->posts.post_excerpt LIKE '%" . esc_sql( $keyword ) . "%' OR ";
158	175	$where = substr_replace($where, $str_to_insert, $ref_pos - 18, 0);
159	176	}
160	177	}
161	178	}
		@@ -183,9 +200,10 @@
183	200	$unit_filter_parameters = apply_filters( 'propertyhive_unit_filter_parameters', array( 'minimum_floor_area', 'maximum_floor_area' ) );
184	201	$unit_filter_parameter_found = false;
185	202	foreach ( $unit_filter_parameters as $parameter )
186	203	{
187		- if ( isset($_REQUEST[$parameter]) && ph_clean($_REQUEST[$parameter]) != '' )
	204	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public commercial display filter reads a request flag and contributes only to the current SQL WHERE clause. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
	205	+ if ( isset($_REQUEST[$parameter]) && ph_clean( wp_unslash( $_REQUEST[$parameter] ) ) != '' )
188	206	{
189	207	$unit_filter_parameter_found = true;
190	208	}
191	209	}
		@@ -218,9 +236,10 @@
218	236	/**
219	237	* Get any errors from querystring
220	238	*/
221	239	public function get_errors() {
222		- if ( ! empty( $_GET['ph_error'] ) && ( $error = sanitize_text_field( $_GET['ph_error'] ) ) && ! ph_has_notice( $error, 'error' ) )
	240	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public frontend reads ph_error to add a request-scoped notice; it does not write posts, options, user data, or other persistent state. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
	241	+ if ( ! empty( $_GET['ph_error'] ) && ( $error = sanitize_text_field( wp_unslash( $_GET['ph_error'] ) ) ) && ! ph_has_notice( $error, 'error' ) )
223	242	ph_add_notice( $error, 'error' );
224	243	}
225	244
226	245	/**
		@@ -252,9 +271,11 @@
252	271	global $wp;
253	272
254	273	// Map query vars to their keys, or get them if endpoints are not supported
255	274	foreach ( $this->query_vars as $key => $var ) {
	275	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public frontend normalizes a URL query variable into the current WP request query_vars; this is request/query state only and has no persistent write. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
256	276	if ( isset( $_GET[ $var ] ) ) {
	277	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public frontend normalizes a URL query variable into the current WP request query_vars; this is request/query state only and has no persistent write. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
257	278	$wp->query_vars[ $key ] = sanitize_text_field( wp_unslash( $_GET[ $var ] ) );
258	279	}
259	280
260	281	elseif ( isset( $wp->query_vars[ $var ] ) ) {
		@@ -311,8 +332,9 @@
311	332	if ( isset( $q->query['paged'] ) )
312	333	$q->set( 'paged', $q->query['paged'] );
313	334
314	335	// Define a variable so we know this is the front page search results later on
	336	+ // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedConstantFound -- Retain the existing frontend state constant for theme and extension compatibility.
315	337	define( 'SEARCH_RESULTS_IS_ON_FRONT', true );
316	338
317	339	// Get the actual WP page to avoid errors and let us use is_front_page()
318	340	// This is hacky but works. Awaiting http://core.trac.wordpress.org/ticket/21096
		@@ -512,8 +534,9 @@
512	534	$q->set( 'meta_query', $meta_query );
513	535	$q->set( 'tax_query', $tax_query );
514	536	$q->set( 'date_query', $date_query );
515	537	$q->set( 'post__in', $post__in );
	538	+ // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound -- Existing public Property Hive extension hook loop_search_results_per_page; changing the established name would detach installed callbacks.
516	539	$q->set( 'posts_per_page', $q->get( 'posts_per_page' ) ? $q->get( 'posts_per_page' ) : apply_filters( 'loop_search_results_per_page', get_option( 'posts_per_page' ) ) );
517	540
518	541	// Set a special variable
519	542	$q->set( 'ph_query', true );
		@@ -585,8 +608,9 @@
585	608	array(
586	609	'post_type' => 'property',
587	610	'numberposts' => -1,
588	611	'post_status' => 'publish',
	612	+ // phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_meta_query -- Cached property IDs must preserve the current search metadata predicates; only IDs are fetched, without totals or metadata/term cache priming.
589	613	'meta_query' => $this->meta_query,
590	614	'fields' => 'ids',
591	615	'no_found_rows' => true,
592	616	'update_post_meta_cache' => false,
		@@ -621,11 +645,14 @@
621	645	* @access public
622	646	* @return array
623	647	*/
624	648	public function get_search_results_ordering_args( $orderby = '', $order = '' ) {
	649	+ $request_department = $this->get_requested_department();
	650	+
625	651	// Get ordering from query string unless defined
626	652	if ( ! $orderby ) {
627		- $orderby_value = isset( $_GET['orderby'] ) ? sanitize_text_field( $_GET['orderby'] ) : apply_filters( 'propertyhive_default_search_results_orderby', get_option( 'propertyhive_default_search_results_orderby' ) );
	653	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads ordering/filter inputs and returns ordering arguments for the current query only. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
	654	+ $orderby_value = isset( $_GET['orderby'] ) ? sanitize_text_field( wp_unslash( $_GET['orderby'] ) ) : apply_filters( 'propertyhive_default_search_results_orderby', get_option( 'propertyhive_default_search_results_orderby' ) );
628	655
629	656	// Get order + orderby args from string
630	657	$orderby_value = explode( '-', $orderby_value );
631	658	$orderby = esc_attr( $orderby_value[0] );
		@@ -638,23 +665,29 @@
638	665	$args = array();
639	666
640	667	// default - menu_order
641	668	if (
642		- ( isset($_REQUEST['department']) && $_REQUEST['department'] != 'commercial' && ph_get_custom_department_based_on($_REQUEST['department']) != 'commercial' ) ||
643		- ( !isset($_REQUEST['department']) && get_option( 'propertyhive_primary_department' ) != 'commercial' && ph_get_custom_department_based_on(get_option( 'propertyhive_primary_department' )) != 'commercial' )
	669	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads ordering/filter inputs and returns ordering arguments for the current query only. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
	670	+ ( isset($request_department) && $request_department != 'commercial' && ph_get_custom_department_based_on($request_department) != 'commercial' ) ||
	671	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads ordering/filter inputs and returns ordering arguments for the current query only. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
	672	+ ( !isset($request_department) && get_option( 'propertyhive_primary_department' ) != 'commercial' && ph_get_custom_department_based_on(get_option( 'propertyhive_primary_department' )) != 'commercial' )
644	673	)
645	674	{
646	675	$args['orderby'] = 'meta_value_num';
647	676	$args['order'] = $order == 'ASC' ? 'ASC' : 'DESC';
	677	+ // phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_meta_key -- Search ordering maps supported price/floor-area/date choices to literal stored meta keys. switch cases and department branches set fixed keys; order direction is constrained to ASC/DESC.
648	678	$args['meta_key'] = '_price_actual';
649	679	}
650	680	elseif (
651		- ( isset($_REQUEST['department']) && ( $_REQUEST['department'] == 'commercial' || ph_get_custom_department_based_on($_REQUEST['department']) == 'commercial' ) ) ||
652		- ( !isset($_REQUEST['department']) && ( get_option( 'propertyhive_primary_department' ) == 'commercial' || ph_get_custom_department_based_on(get_option( 'propertyhive_primary_department' )) == 'commercial' ) )
	681	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads ordering/filter inputs and returns ordering arguments for the current query only. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
	682	+ ( isset($request_department) && ( $request_department == 'commercial' || ph_get_custom_department_based_on($request_department) == 'commercial' ) ) ||
	683	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads ordering/filter inputs and returns ordering arguments for the current query only. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
	684	+ ( !isset($request_department) && ( get_option( 'propertyhive_primary_department' ) == 'commercial' || ph_get_custom_department_based_on(get_option( 'propertyhive_primary_department' )) == 'commercial' ) )
653	685	)
654	686	{
655	687	$args['orderby'] = 'meta_value_num';
656	688	$args['order'] = $order == 'ASC' ? 'ASC' : 'DESC';
	689	+ // phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_meta_key -- Search ordering maps supported price/floor-area/date choices to literal stored meta keys. switch cases and department branches set fixed keys; order direction is constrained to ASC/DESC.
657	690	$args['meta_key'] = '_floor_area_from_sqft';
658	691	}
659	692
660	693	switch ( $orderby ) {
		@@ -661,16 +694,20 @@
661	694	case 'price' :
662	695	$args['orderby'] = 'meta_value_num';
663	696	$args['order'] = $order == 'ASC' ? 'ASC' : 'DESC';
664	697	if (
665		- ( isset($_REQUEST['department']) && ( $_REQUEST['department'] == 'commercial' || ph_get_custom_department_based_on($_REQUEST['department']) == 'commercial' ) ) ||
666		- ( !isset($_REQUEST['department']) && ( get_option( 'propertyhive_primary_department' ) == 'commercial' || ph_get_custom_department_based_on(get_option( 'propertyhive_primary_department' )) == 'commercial' ) )
	698	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads ordering/filter inputs and returns ordering arguments for the current query only. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
	699	+ ( isset($request_department) && ( $request_department == 'commercial' || ph_get_custom_department_based_on($request_department) == 'commercial' ) ) ||
	700	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads ordering/filter inputs and returns ordering arguments for the current query only. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
	701	+ ( !isset($request_department) && ( get_option( 'propertyhive_primary_department' ) == 'commercial' || ph_get_custom_department_based_on(get_option( 'propertyhive_primary_department' )) == 'commercial' ) )
667	702	)
668	703	{
	704	+ // phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_meta_key -- Search ordering maps supported price/floor-area/date choices to literal stored meta keys. switch cases and department branches set fixed keys; order direction is constrained to ASC/DESC.
669	705	$args['meta_key'] = '_price_from_actual';
670	706	}
671	707	else
672	708	{
	709	+ // phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_meta_key -- Search ordering maps supported price/floor-area/date choices to literal stored meta keys. switch cases and department branches set fixed keys; order direction is constrained to ASC/DESC.
673	710	$args['meta_key'] = '_price_actual';
674	711	}
675	712	break;
676	713	case 'floor_area' :
		@@ -675,13 +712,15 @@
675	712	break;
676	713	case 'floor_area' :
677	714	$args['orderby'] = 'meta_value_num';
678	715	$args['order'] = $order == 'ASC' ? 'ASC' : 'DESC';
	716	+ // phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_meta_key -- Search ordering maps supported price/floor-area/date choices to literal stored meta keys. switch cases and department branches set fixed keys; order direction is constrained to ASC/DESC.
679	717	$args['meta_key'] = '_floor_area_from_sqft';
680	718	break;
681	719	case 'date' :
682	720	$args['orderby'] = 'meta_value';
683	721	$args['order'] = $order == 'ASC' ? 'ASC' : 'DESC';
	722	+ // phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_meta_key -- Search ordering maps supported price/floor-area/date choices to literal stored meta keys. switch cases and department branches set fixed keys; order direction is constrained to ASC/DESC.
684	723	$args['meta_key'] = '_on_market_change_date';
685	724	break;
686	725	default :
687	726	{
		@@ -705,21 +744,25 @@
705	744	public function get_date_query() {
706	745
707	746	$date_query = array();
708	747
	748	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
709	749	if ( isset( $_REQUEST['added_from'] ) && $_REQUEST['added_from'] != '' )
710	750	{
711	751	$date_query = array(
712	752	'column' => 'post_date_gmt',
713		- 'after' => sanitize_text_field( $_REQUEST['added_from'] )
	753	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
	754	+ 'after' => sanitize_text_field( wp_unslash( $_REQUEST['added_from'] ) )
714	755	);
715	756	}
716	757
	758	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
717	759	if ( isset( $_REQUEST['added_from_hours'] ) && $_REQUEST['added_from_hours'] != '' )
718	760	{
719	761	$date_query = array(
720	762	'column' => 'post_date_gmt',
721		- 'after' => sanitize_text_field( $_REQUEST['added_from_hours'] ) . ' hours ago'
	763	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
	764	+ 'after' => sanitize_text_field( wp_unslash( $_REQUEST['added_from_hours'] ) ) . ' hours ago'
722	765	);
723	766	}
724	767
725	768	return array_filter( $date_query );
		@@ -809,16 +852,18 @@
809	852	* @access public
810	853	* @return array
811	854	*/
812	855	public function department_meta_query( $q ) {
	856	+ $request_department = $this->get_requested_department();
	857	+
813	858
814	859	$meta_query = array();
815	860
816		- if ( isset( $_REQUEST['department'] ) && $_REQUEST['department'] != '' )
	861	+ if ( isset( $request_department ) && $request_department != '' )
817	862	{
818	863	$meta_query = array(
819	864	'key' => '_department',
820		- 'value' => sanitize_text_field( $_REQUEST['department'] ),
	865	+ 'value' => sanitize_text_field( $request_department ),
821	866	'compare' => '='
822	867	);
823	868	}
824	869	else
		@@ -868,8 +913,9 @@
868	913	public function featured_meta_query( ) {
869	914
870	915	$meta_query = array();
871	916
	917	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
872	918	if ( isset( $_REQUEST['featured'] ) && $_REQUEST['featured'] != '' )
873	919	{
874	920	$meta_query = array(
875	921	'key' => '_featured',
		@@ -890,13 +936,15 @@
890	936	public function date_added_meta_query( ) {
891	937
892	938	$meta_query = array();
893	939
	940	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
894	941	if ( isset( $_REQUEST['date_added'] ) && $_REQUEST['date_added'] != '' && is_numeric($_REQUEST['date_added']) )
895	942	{
896	943	$meta_query = array(
897	944	'key' => '_on_market_change_date',
898		- 'value' => date('Y-m-d H:i:s', strtotime('-' . $_REQUEST['date_added'] . ' days')),
	945	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
	946	+ 'value' => gmdate('Y-m-d H:i:s', strtotime('-' . sanitize_text_field( wp_unslash( $_REQUEST['date_added'] ) ) . ' days')),
899	947	'compare' => '>=',
900	948	'type' => 'DATETIME',
901	949	);
902	950	}
		@@ -912,18 +960,33 @@
912	960	*/
913	961	public function address_keyword_meta_query( ) {
914	962
915	963	$meta_query = array();
916		-
917		- if ( isset( $_REQUEST['address_keyword'] ) && !empty($_REQUEST['address_keyword']) )
	964	+
	965	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Public read-only search control; no persistent state change.
	966	+ if ( isset( $_REQUEST['address_keyword'] ) && !empty($_REQUEST['address_keyword']) )
918	967	{
919		- $_REQUEST['address_keyword'] = ph_clean( wp_unslash( $_REQUEST['address_keyword'] ) );
920	968
	969	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Public read-only address search; values are validated below before query construction.
	970	+ $address_input = ph_clean( wp_unslash( $_REQUEST['address_keyword'] ) );
	971	+ if ( ! is_string( $address_input ) && ! is_array( $address_input ) ) {
	972	+ return $meta_query;
	973	+ }
	974	+ foreach ( (array) $address_input as $address_value ) {
	975	+ if ( ! is_string( $address_value ) ) {
	976	+ return $meta_query;
	977	+ }
	978	+ }
	979	+ $address_input = ph_clean( $address_input );
	980	+ // Preserve the normalized request value consumed by existing extensions.
	981	+ $_REQUEST['address_keyword'] = $address_input;
	982	+
921	983	$do_address_search = true;
922		- if ( get_option( 'propertyhive_address_keyword_compare', '=' ) == 'polygon' )
	984	+ if ( is_string( $address_input ) && get_option( 'propertyhive_address_keyword_compare', '=' ) == 'polygon' )
923	985	{
924	986	$address_keyword_polygon = new PH_Address_Keyword_Polygon();
925		- $polygon_coordinates = $address_keyword_polygon->get_address_keyword_polygon_coordinates( $_REQUEST['address_keyword'] . ', UK' );
	987	+
	988	+ $polygon_coordinates = $address_keyword_polygon->get_address_keyword_polygon_coordinates( $address_input . ', UK' );
926	989
927	990	if ( $polygon_coordinates !== FALSE )
928	991	{
929	992	$this->address_keyword_polygon_points = $polygon_coordinates;
		@@ -933,10 +996,11 @@
933	996	}
934	997
935	998	if ( $do_address_search )
936	999	{
937		- $address_keywords_to_query = is_array($_REQUEST['address_keyword']) ? $_REQUEST['address_keyword'] : array( $_REQUEST['address_keyword'] );
938	1000
	1001	+ $address_keywords_to_query = is_array($address_input) ? $address_input : array( $address_input );
	1002	+
939	1003	$address_fields_to_query = array(
940	1004	'_reference_number',
941	1005	'_address_street',
942	1006	'_address_two',
		@@ -1156,21 +1220,25 @@
1156	1220	public function country_meta_query( ) {
1157	1221
1158	1222	$meta_query = array();
1159	1223
	1224	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
1160	1225	if ( isset( $_REQUEST['country'] ) && $_REQUEST['country'] != '' )
1161	1226	{
1162	1227	$meta_query = array(
1163	1228	'key' => '_address_country',
1164		- 'value' => ph_clean( $_REQUEST['country'] )
	1229	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
	1230	+ 'value' => ph_clean( wp_unslash( $_REQUEST['country'] ) )
1165	1231	);
1166	1232	}
1167	1233
	1234	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
1168	1235	if ( isset( $_REQUEST['country_not'] ) && $_REQUEST['country_not'] != '' )
1169	1236	{
1170	1237	$meta_query = array(
1171	1238	'key' => '_address_country',
1172		- 'value' => ph_clean( $_REQUEST['country_not'] ),
	1239	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
	1240	+ 'value' => ph_clean( wp_unslash( $_REQUEST['country_not'] ) ),
1173	1241	'compare' => '!='
1174	1242	);
1175	1243	}
1176	1244
		@@ -1183,17 +1251,21 @@
1183	1251	* @access public
1184	1252	* @return array
1185	1253	*/
1186	1254	public function minimum_price_meta_query( ) {
	1255	+ $request_department = $this->get_requested_department();
	1256	+
1187	1257
1188	1258	$meta_query = array();
1189	1259
1190	1260	if (
1191		- isset( $_REQUEST['department'] ) && ( $_REQUEST['department'] == 'residential-sales' || ph_get_custom_department_based_on($_REQUEST['department']) == 'residential-sales' ) &&
	1261	+ isset( $request_department ) && ( $request_department == 'residential-sales' || ph_get_custom_department_based_on($request_department) == 'residential-sales' ) &&
	1262	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
1192	1263	isset( $_REQUEST['minimum_price'] ) && $_REQUEST['minimum_price'] != ''
1193	1264	)
1194	1265	{
1195		- $minimum_price = $_REQUEST['minimum_price'];
	1266	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
	1267	+ $minimum_price = is_string( $_REQUEST['minimum_price'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['minimum_price'] ) ) : '';
1196	1268
1197	1269	if ( !is_numeric($minimum_price) )
1198	1270	{
1199	1271	return $meta_query;
		@@ -1227,17 +1299,21 @@
1227	1299	* @access public
1228	1300	* @return array
1229	1301	*/
1230	1302	public function maximum_price_meta_query( ) {
	1303	+ $request_department = $this->get_requested_department();
	1304	+
1231	1305
1232	1306	$meta_query = array();
1233	1307
1234	1308	if (
1235		- isset( $_REQUEST['department'] ) && ( $_REQUEST['department'] == 'residential-sales' || ph_get_custom_department_based_on($_REQUEST['department']) == 'residential-sales' ) &&
	1309	+ isset( $request_department ) && ( $request_department == 'residential-sales' || ph_get_custom_department_based_on($request_department) == 'residential-sales' ) &&
	1310	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
1236	1311	isset( $_REQUEST['maximum_price'] ) && $_REQUEST['maximum_price'] != ''
1237	1312	)
1238	1313	{
1239		- $maximum_price = $_REQUEST['maximum_price'];
	1314	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
	1315	+ $maximum_price = is_string( $_REQUEST['maximum_price'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['maximum_price'] ) ) : '';
1240	1316
1241	1317	if ( !is_numeric($maximum_price) )
1242	1318	{
1243	1319	return $meta_query;
		@@ -1271,17 +1347,21 @@
1271	1347	* @access public
1272	1348	* @return array
1273	1349	*/
1274	1350	public function price_range_meta_query( ) {
	1351	+ $request_department = $this->get_requested_department();
	1352	+
1275	1353
1276	1354	$meta_query = array();
1277	1355
1278	1356	if (
1279		- isset( $_REQUEST['department'] ) && ( $_REQUEST['department'] == 'residential-sales' || ph_get_custom_department_based_on($_REQUEST['department']) == 'residential-sales' ) &&
1280		- isset( $_REQUEST['price_range'] ) && $_REQUEST['price_range'] != ''
	1357	+ isset( $request_department ) && ( $request_department == 'residential-sales' || ph_get_custom_department_based_on($request_department) == 'residential-sales' ) &&
	1358	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
	1359	+ isset( $_REQUEST['price_range'] ) && is_string( $_REQUEST['price_range'] ) && $_REQUEST['price_range'] != ''
1281	1360	)
1282	1361	{
1283		- $explode_price_range = explode("-", ph_clean($_REQUEST['price_range']));
	1362	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
	1363	+ $explode_price_range = explode("-", ph_clean( wp_unslash( $_REQUEST['price_range'] ) ));
1284	1364
1285	1365	$search_form_currency = get_option( 'propertyhive_search_form_currency', 'GBP' );
1286	1366	$search_form_currency = apply_filters( 'propertyhive_query_search_form_currency', $search_form_currency );
1287	1367
		@@ -1344,17 +1424,21 @@
1344	1424	* @access public
1345	1425	* @return array
1346	1426	*/
1347	1427	public function minimum_rent_meta_query( ) {
	1428	+ $request_department = $this->get_requested_department();
	1429	+
1348	1430
1349	1431	$meta_query = array();
1350	1432
1351	1433	if (
1352		- isset( $_REQUEST['department'] ) && ( $_REQUEST['department'] == 'residential-lettings' || ph_get_custom_department_based_on($_REQUEST['department']) == 'residential-lettings' ) &&
	1434	+ isset( $request_department ) && ( $request_department == 'residential-lettings' || ph_get_custom_department_based_on($request_department) == 'residential-lettings' ) &&
	1435	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
1353	1436	isset( $_REQUEST['minimum_rent'] ) && $_REQUEST['minimum_rent'] != ''
1354	1437	)
1355	1438	{
1356		- $minimum_rent = $_REQUEST['minimum_rent'];
	1439	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
	1440	+ $minimum_rent = is_string( $_REQUEST['minimum_rent'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['minimum_rent'] ) ) : '';
1357	1441
1358	1442	if ( !is_numeric($minimum_rent) )
1359	1443	{
1360	1444	return $meta_query;
		@@ -1397,17 +1481,21 @@
1397	1481	* @access public
1398	1482	* @return array
1399	1483	*/
1400	1484	public function maximum_rent_meta_query( ) {
	1485	+ $request_department = $this->get_requested_department();
	1486	+
1401	1487
1402	1488	$meta_query = array();
1403	1489
1404	1490	if (
1405		- isset( $_REQUEST['department'] ) && ( $_REQUEST['department'] == 'residential-lettings' || ph_get_custom_department_based_on($_REQUEST['department']) == 'residential-lettings' ) &&
	1491	+ isset( $request_department ) && ( $request_department == 'residential-lettings' || ph_get_custom_department_based_on($request_department) == 'residential-lettings' ) &&
	1492	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
1406	1493	isset( $_REQUEST['maximum_rent'] ) && $_REQUEST['maximum_rent'] != ''
1407	1494	)
1408	1495	{
1409		- $maximum_rent = $_REQUEST['maximum_rent'];
	1496	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
	1497	+ $maximum_rent = is_string( $_REQUEST['maximum_rent'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['maximum_rent'] ) ) : '';
1410	1498
1411	1499	if ( !is_numeric($maximum_rent) )
1412	1500	{
1413	1501	return $meta_query;
		@@ -1450,17 +1538,21 @@
1450	1538	* @access public
1451	1539	* @return array
1452	1540	*/
1453	1541	public function rent_range_meta_query( ) {
	1542	+ $request_department = $this->get_requested_department();
	1543	+
1454	1544
1455	1545	$meta_query = array();
1456	1546
1457	1547	if (
1458		- isset( $_REQUEST['department'] ) && ( $_REQUEST['department'] == 'residential-lettings' || ph_get_custom_department_based_on($_REQUEST['department']) == 'residential-lettings' ) &&
1459		- isset( $_REQUEST['rent_range'] ) && $_REQUEST['rent_range'] != ''
	1548	+ isset( $request_department ) && ( $request_department == 'residential-lettings' || ph_get_custom_department_based_on($request_department) == 'residential-lettings' ) &&
	1549	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
	1550	+ isset( $_REQUEST['rent_range'] ) && is_string( $_REQUEST['rent_range'] ) && $_REQUEST['rent_range'] != ''
1460	1551	)
1461	1552	{
1462		- $explode_rent_range = explode("-", ph_clean($_REQUEST['rent_range']));
	1553	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
	1554	+ $explode_rent_range = explode("-", ph_clean( wp_unslash( $_REQUEST['rent_range'] ) ));
1463	1555
1464	1556	$search_form_currency = get_option( 'propertyhive_search_form_currency', 'GBP' );
1465	1557	$search_form_currency = apply_filters( 'propertyhive_query_search_form_currency', $search_form_currency );
1466	1558
		@@ -1541,22 +1633,26 @@
1541	1633	* @access public
1542	1634	* @return array
1543	1635	*/
1544	1636	public function bedrooms_meta_query( ) {
	1637	+ $request_department = $this->get_requested_department();
	1638	+
1545	1639
1546	1640	$meta_query = array();
1547	1641
1548	1642	if (
1549	1643	(
1550		- (isset( $_REQUEST['department'] ) && ( $_REQUEST['department'] == 'residential-sales' || ph_get_custom_department_based_on($_REQUEST['department']) == 'residential-sales' )) ||
1551		- (isset( $_REQUEST['department'] ) && ( $_REQUEST['department'] == 'residential-lettings' || ph_get_custom_department_based_on($_REQUEST['department']) == 'residential-lettings' ))
	1644	+ (isset( $request_department ) && ( $request_department == 'residential-sales' || ph_get_custom_department_based_on($request_department) == 'residential-sales' )) ||
	1645	+ (isset( $request_department ) && ( $request_department == 'residential-lettings' || ph_get_custom_department_based_on($request_department) == 'residential-lettings' ))
1552	1646	) &&
	1647	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
1553	1648	isset( $_REQUEST['bedrooms'] ) && $_REQUEST['bedrooms'] != ''
1554	1649	)
1555	1650	{
1556	1651	$meta_query = array(
1557	1652	'key' => '_bedrooms',
1558		- 'value' => ph_clean( $_REQUEST['bedrooms'] ),
	1653	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
	1654	+ 'value' => ph_clean( wp_unslash( $_REQUEST['bedrooms'] ) ),
1559	1655	'compare' => '=',
1560	1656	'type' => 'NUMERIC'
1561	1657	);
1562	1658	}
		@@ -1570,22 +1666,26 @@
1570	1666	* @access public
1571	1667	* @return array
1572	1668	*/
1573	1669	public function minimum_bedrooms_meta_query( ) {
	1670	+ $request_department = $this->get_requested_department();
	1671	+
1574	1672
1575	1673	$meta_query = array();
1576	1674
1577	1675	if (
1578	1676	(
1579		- (isset( $_REQUEST['department'] ) && ( $_REQUEST['department'] == 'residential-sales' || ph_get_custom_department_based_on($_REQUEST['department']) == 'residential-sales' )) ||
1580		- (isset( $_REQUEST['department'] ) && ( $_REQUEST['department'] == 'residential-lettings' || ph_get_custom_department_based_on($_REQUEST['department']) == 'residential-lettings' ))
	1677	+ (isset( $request_department ) && ( $request_department == 'residential-sales' || ph_get_custom_department_based_on($request_department) == 'residential-sales' )) ||
	1678	+ (isset( $request_department ) && ( $request_department == 'residential-lettings' || ph_get_custom_department_based_on($request_department) == 'residential-lettings' ))
1581	1679	) &&
	1680	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
1582	1681	isset( $_REQUEST['minimum_bedrooms'] ) && $_REQUEST['minimum_bedrooms'] != ''
1583	1682	)
1584	1683	{
1585	1684	$meta_query = array(
1586	1685	'key' => '_bedrooms',
1587		- 'value' => ph_clean( $_REQUEST['minimum_bedrooms'] ),
	1686	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
	1687	+ 'value' => ph_clean( wp_unslash( $_REQUEST['minimum_bedrooms'] ) ),
1588	1688	'compare' => '>=',
1589	1689	'type' => 'NUMERIC'
1590	1690	);
1591	1691	}
		@@ -1599,22 +1699,26 @@
1599	1699	* @access public
1600	1700	* @return array
1601	1701	*/
1602	1702	public function maximum_bedrooms_meta_query( ) {
	1703	+ $request_department = $this->get_requested_department();
	1704	+
1603	1705
1604	1706	$meta_query = array();
1605	1707
1606	1708	if (
1607	1709	(
1608		- (isset( $_REQUEST['department'] ) && ( $_REQUEST['department'] == 'residential-sales' || ph_get_custom_department_based_on($_REQUEST['department']) == 'residential-sales' )) ||
1609		- (isset( $_REQUEST['department'] ) && ( $_REQUEST['department'] == 'residential-lettings' || ph_get_custom_department_based_on($_REQUEST['department']) == 'residential-lettings' ))
	1710	+ (isset( $request_department ) && ( $request_department == 'residential-sales' || ph_get_custom_department_based_on($request_department) == 'residential-sales' )) ||
	1711	+ (isset( $request_department ) && ( $request_department == 'residential-lettings' || ph_get_custom_department_based_on($request_department) == 'residential-lettings' ))
1610	1712	) &&
	1713	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
1611	1714	isset( $_REQUEST['maximum_bedrooms'] ) && $_REQUEST['maximum_bedrooms'] != ''
1612	1715	)
1613	1716	{
1614	1717	$meta_query = array(
1615	1718	'key' => '_bedrooms',
1616		- 'value' => ph_clean( $_REQUEST['maximum_bedrooms'] ),
	1719	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
	1720	+ 'value' => ph_clean( wp_unslash( $_REQUEST['maximum_bedrooms'] ) ),
1617	1721	'compare' => '<=',
1618	1722	'type' => 'NUMERIC'
1619	1723	);
1620	1724	}
		@@ -1628,22 +1732,26 @@
1628	1732	* @access public
1629	1733	* @return array
1630	1734	*/
1631	1735	public function minimum_bathrooms_meta_query( ) {
	1736	+ $request_department = $this->get_requested_department();
	1737	+
1632	1738
1633	1739	$meta_query = array();
1634	1740
1635	1741	if (
1636	1742	(
1637		- (isset( $_REQUEST['department'] ) && ( $_REQUEST['department'] == 'residential-sales' || ph_get_custom_department_based_on($_REQUEST['department']) == 'residential-sales' )) ||
1638		- (isset( $_REQUEST['department'] ) && ( $_REQUEST['department'] == 'residential-lettings' || ph_get_custom_department_based_on($_REQUEST['department']) == 'residential-lettings' ))
	1743	+ (isset( $request_department ) && ( $request_department == 'residential-sales' || ph_get_custom_department_based_on($request_department) == 'residential-sales' )) ||
	1744	+ (isset( $request_department ) && ( $request_department == 'residential-lettings' || ph_get_custom_department_based_on($request_department) == 'residential-lettings' ))
1639	1745	) &&
	1746	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
1640	1747	isset( $_REQUEST['minimum_bathrooms'] ) && $_REQUEST['minimum_bathrooms'] != ''
1641	1748	)
1642	1749	{
1643	1750	$meta_query = array(
1644	1751	'key' => '_bathrooms',
1645		- 'value' => ph_clean( $_REQUEST['minimum_bathrooms'] ),
	1752	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
	1753	+ 'value' => ph_clean( wp_unslash( $_REQUEST['minimum_bathrooms'] ) ),
1646	1754	'compare' => '>=',
1647	1755	'type' => 'NUMERIC'
1648	1756	);
1649	1757	}
		@@ -1657,22 +1765,26 @@
1657	1765	* @access public
1658	1766	* @return array
1659	1767	*/
1660	1768	public function maximum_bathrooms_meta_query( ) {
	1769	+ $request_department = $this->get_requested_department();
	1770	+
1661	1771
1662	1772	$meta_query = array();
1663	1773
1664	1774	if (
1665	1775	(
1666		- (isset( $_REQUEST['department'] ) && ( $_REQUEST['department'] == 'residential-sales' || ph_get_custom_department_based_on($_REQUEST['department']) == 'residential-sales' )) ||
1667		- (isset( $_REQUEST['department'] ) && ( $_REQUEST['department'] == 'residential-lettings' || ph_get_custom_department_based_on($_REQUEST['department']) == 'residential-lettings' ))
	1776	+ (isset( $request_department ) && ( $request_department == 'residential-sales' || ph_get_custom_department_based_on($request_department) == 'residential-sales' )) ||
	1777	+ (isset( $request_department ) && ( $request_department == 'residential-lettings' || ph_get_custom_department_based_on($request_department) == 'residential-lettings' ))
1668	1778	) &&
	1779	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
1669	1780	isset( $_REQUEST['maximum_bathrooms'] ) && $_REQUEST['maximum_bathrooms'] != ''
1670	1781	)
1671	1782	{
1672	1783	$meta_query = array(
1673	1784	'key' => '_bathrooms',
1674		- 'value' => ph_clean( $_REQUEST['maximum_bathrooms'] ),
	1785	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
	1786	+ 'value' => ph_clean( wp_unslash( $_REQUEST['maximum_bathrooms'] ) ),
1675	1787	'compare' => '<=',
1676	1788	'type' => 'NUMERIC'
1677	1789	);
1678	1790	}
		@@ -1686,22 +1798,26 @@
1686	1798	* @access public
1687	1799	* @return array
1688	1800	*/
1689	1801	public function minimum_reception_rooms_meta_query( ) {
	1802	+ $request_department = $this->get_requested_department();
	1803	+
1690	1804
1691	1805	$meta_query = array();
1692	1806
1693	1807	if (
1694	1808	(
1695		- (isset( $_REQUEST['department'] ) && ( $_REQUEST['department'] == 'residential-sales' || ph_get_custom_department_based_on($_REQUEST['department']) == 'residential-sales' )) ||
1696		- (isset( $_REQUEST['department'] ) && ( $_REQUEST['department'] == 'residential-lettings' || ph_get_custom_department_based_on($_REQUEST['department']) == 'residential-lettings' ))
	1809	+ (isset( $request_department ) && ( $request_department == 'residential-sales' || ph_get_custom_department_based_on($request_department) == 'residential-sales' )) ||
	1810	+ (isset( $request_department ) && ( $request_department == 'residential-lettings' || ph_get_custom_department_based_on($request_department) == 'residential-lettings' ))
1697	1811	) &&
	1812	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
1698	1813	isset( $_REQUEST['minimum_reception_rooms'] ) && $_REQUEST['minimum_reception_rooms'] != ''
1699	1814	)
1700	1815	{
1701	1816	$meta_query = array(
1702	1817	'key' => '_reception_rooms',
1703		- 'value' => ph_clean( $_REQUEST['minimum_reception_rooms'] ),
	1818	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
	1819	+ 'value' => ph_clean( wp_unslash( $_REQUEST['minimum_reception_rooms'] ) ),
1704	1820	'compare' => '>=',
1705	1821	'type' => 'NUMERIC'
1706	1822	);
1707	1823	}
		@@ -1715,22 +1831,26 @@
1715	1831	* @access public
1716	1832	* @return array
1717	1833	*/
1718	1834	public function maximum_reception_rooms_meta_query( ) {
	1835	+ $request_department = $this->get_requested_department();
	1836	+
1719	1837
1720	1838	$meta_query = array();
1721	1839
1722	1840	if (
1723	1841	(
1724		- (isset( $_REQUEST['department'] ) && ( $_REQUEST['department'] == 'residential-sales' || ph_get_custom_department_based_on($_REQUEST['department']) == 'residential-sales' )) ||
1725		- (isset( $_REQUEST['department'] ) && ( $_REQUEST['department'] == 'residential-lettings' || ph_get_custom_department_based_on($_REQUEST['department']) == 'residential-lettings' ))
	1842	+ (isset( $request_department ) && ( $request_department == 'residential-sales' || ph_get_custom_department_based_on($request_department) == 'residential-sales' )) ||
	1843	+ (isset( $request_department ) && ( $request_department == 'residential-lettings' || ph_get_custom_department_based_on($request_department) == 'residential-lettings' ))
1726	1844	) &&
	1845	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
1727	1846	isset( $_REQUEST['maximum_reception_rooms'] ) && $_REQUEST['maximum_reception_rooms'] != ''
1728	1847	)
1729	1848	{
1730	1849	$meta_query = array(
1731	1850	'key' => '_reception_rooms',
1732		- 'value' => ph_clean( $_REQUEST['maximum_reception_rooms'] ),
	1851	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
	1852	+ 'value' => ph_clean( wp_unslash( $_REQUEST['maximum_reception_rooms'] ) ),
1733	1853	'compare' => '<=',
1734	1854	'type' => 'NUMERIC'
1735	1855	);
1736	1856	}
		@@ -1744,17 +1864,21 @@
1744	1864	* @access public
1745	1865	* @return array
1746	1866	*/
1747	1867	public function available_date_from_meta_query( ) {
	1868	+ $request_department = $this->get_requested_department();
	1869	+
1748	1870
1749	1871	$meta_query = array();
1750	1872
1751	1873	if (
1752		- isset( $_REQUEST['department'] ) && ( $_REQUEST['department'] == 'residential-lettings' || ph_get_custom_department_based_on($_REQUEST['department']) == 'residential-lettings' ) &&
1753		- isset( $_REQUEST['available_date_from'] ) && $_REQUEST['available_date_from'] != ''
	1874	+ isset( $request_department ) && ( $request_department == 'residential-lettings' || ph_get_custom_department_based_on($request_department) == 'residential-lettings' ) &&
	1875	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
	1876	+ isset( $_REQUEST['available_date_from'] ) && is_string( $_REQUEST['available_date_from'] ) && $_REQUEST['available_date_from'] != ''
1754	1877	)
1755	1878	{
1756		- $available_date = ph_clean($_REQUEST['available_date_from']);
	1879	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
	1880	+ $available_date = ph_clean( wp_unslash( $_REQUEST['available_date_from'] ) );
1757	1881	if ( strpos($available_date, '/') !== FALSE )
1758	1882	{
1759	1883	// it's been provided in the format dd/mm/yyyy
1760	1884	$explode_available_date = explode("/", $available_date);
		@@ -1779,21 +1903,27 @@
1779	1903	* @access public
1780	1904	* @return array
1781	1905	*/
1782	1906	public function minimum_floor_area_meta_query( ) {
	1907	+ $request_department = $this->get_requested_department();
	1908	+
1783	1909
1784	1910	$meta_query = array();
1785	1911
1786	1912	if (
1787		- isset( $_REQUEST['department'] ) && ( $_REQUEST['department'] == 'commercial' || ph_get_custom_department_based_on($_REQUEST['department']) == 'commercial' ) &&
	1913	+ isset( $request_department ) && ( $request_department == 'commercial' || ph_get_custom_department_based_on($request_department) == 'commercial' ) &&
	1914	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
1788	1915	isset( $_REQUEST['minimum_floor_area'] ) && $_REQUEST['minimum_floor_area'] != '' &&
1789	1916	(
	1917	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
1790	1918	!isset( $_REQUEST['maximum_floor_area'] ) ||
	1919	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
1791	1920	( isset( $_REQUEST['maximum_floor_area'] ) && $_REQUEST['maximum_floor_area'] == '' )
1792	1921	)
1793	1922	)
1794	1923	{
1795		- $value = ph_clean( $_REQUEST['minimum_floor_area'] );
	1924	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
	1925	+ $value = ph_clean( wp_unslash( $_REQUEST['minimum_floor_area'] ) );
1796	1926	if ( apply_filters('propertyhive_default_commercial_search_floor_area_unit', 'sqft') != 'sqft' )
1797	1927	{
1798	1928	// Convert value from square metres to square feet
1799	1929	$value = $value * 10.76391041671;
		@@ -1816,21 +1946,27 @@
1816	1946	* @access public
1817	1947	* @return array
1818	1948	*/
1819	1949	public function maximum_floor_area_meta_query( ) {
	1950	+ $request_department = $this->get_requested_department();
	1951	+
1820	1952
1821	1953	$meta_query = array();
1822	1954
1823	1955	if (
1824		- isset( $_REQUEST['department'] ) && ( $_REQUEST['department'] == 'commercial' || ph_get_custom_department_based_on($_REQUEST['department']) == 'commercial' ) &&
	1956	+ isset( $request_department ) && ( $request_department == 'commercial' || ph_get_custom_department_based_on($request_department) == 'commercial' ) &&
	1957	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
1825	1958	isset( $_REQUEST['maximum_floor_area'] ) && $_REQUEST['maximum_floor_area'] != '' &&
1826	1959	(
	1960	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
1827	1961	!isset( $_REQUEST['minimum_floor_area'] ) ||
	1962	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
1828	1963	( isset( $_REQUEST['minimum_floor_area'] ) && $_REQUEST['minimum_floor_area'] == '' )
1829	1964	)
1830	1965	)
1831	1966	{
1832		- $value = ph_clean( $_REQUEST['maximum_floor_area'] );
	1967	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
	1968	+ $value = ph_clean( wp_unslash( $_REQUEST['maximum_floor_area'] ) );
1833	1969	if ( apply_filters('propertyhive_default_commercial_search_floor_area_unit', 'sqft') != 'sqft' )
1834	1970	{
1835	1971	// Convert value from square metres to square feet
1836	1972	$value = $value * 10.76391041671;
		@@ -1853,19 +1989,25 @@
1853	1989	* @access public
1854	1990	* @return array
1855	1991	*/
1856	1992	public function minimum_maximum_floor_area_meta_query( ) {
	1993	+ $request_department = $this->get_requested_department();
	1994	+
1857	1995
1858	1996	$meta_query = array();
1859	1997
1860	1998	if (
1861		- isset( $_REQUEST['department'] ) && ( $_REQUEST['department'] == 'commercial' || ph_get_custom_department_based_on($_REQUEST['department']) == 'commercial' ) &&
	1999	+ isset( $request_department ) && ( $request_department == 'commercial' || ph_get_custom_department_based_on($request_department) == 'commercial' ) &&
	2000	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
1862	2001	isset( $_REQUEST['minimum_floor_area'] ) && $_REQUEST['minimum_floor_area'] != '' &&
	2002	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
1863	2003	isset( $_REQUEST['maximum_floor_area'] ) && $_REQUEST['maximum_floor_area'] != ''
1864	2004	)
1865	2005	{
1866		- $maximum_floor_area = ph_clean( $_REQUEST['maximum_floor_area'] );
1867		- $minimum_floor_area = ph_clean( $_REQUEST['minimum_floor_area'] );
	2006	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
	2007	+ $maximum_floor_area = ph_clean( wp_unslash( $_REQUEST['maximum_floor_area'] ) );
	2008	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
	2009	+ $minimum_floor_area = ph_clean( wp_unslash( $_REQUEST['minimum_floor_area'] ) );
1868	2010	if ( apply_filters('propertyhive_default_commercial_search_floor_area_unit', 'sqft') != 'sqft' )
1869	2011	{
1870	2012	// Convert value from square metres to square feet
1871	2013	$maximum_floor_area = $maximum_floor_area * 10.76391041671;
		@@ -1896,17 +2038,21 @@
1896	2038	* @access public
1897	2039	* @return array
1898	2040	*/
1899	2041	public function floor_area_range_meta_query( ) {
	2042	+ $request_department = $this->get_requested_department();
	2043	+
1900	2044
1901	2045	$meta_query = array();
1902	2046
1903	2047	if (
1904		- isset( $_REQUEST['department'] ) && ( $_REQUEST['department'] == 'commercial' || ph_get_custom_department_based_on($_REQUEST['department']) == 'commercial' ) &&
1905		- isset( $_REQUEST['floor_area_range'] ) && $_REQUEST['floor_area_range'] != ''
	2048	+ isset( $request_department ) && ( $request_department == 'commercial' || ph_get_custom_department_based_on($request_department) == 'commercial' ) &&
	2049	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
	2050	+ isset( $_REQUEST['floor_area_range'] ) && is_string( $_REQUEST['floor_area_range'] ) && $_REQUEST['floor_area_range'] != ''
1906	2051	)
1907	2052	{
1908		- $explode_floor_area_range = explode("-", ph_clean($_REQUEST['floor_area_range']));
	2053	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
	2054	+ $explode_floor_area_range = explode("-", ph_clean( wp_unslash( $_REQUEST['floor_area_range'] ) ));
1909	2055
1910	2056	if ( isset($explode_floor_area_range[0]) && $explode_floor_area_range[0] != '' )
1911	2057	{
1912	2058	$meta_query = array(
		@@ -1936,13 +2082,16 @@
1936	2082	* @access public
1937	2083	* @return array
1938	2084	*/
1939	2085	public function commercial_for_sale_to_rent_meta_query( ) {
	2086	+ $request_department = $this->get_requested_department();
	2087	+
1940	2088
1941	2089	$meta_query = array();
1942	2090
1943	2091	if (
1944		- isset( $_REQUEST['department'] ) && ( $_REQUEST['department'] == 'commercial' || ph_get_custom_department_based_on($_REQUEST['department']) == 'commercial' ) &&
	2092	+ isset( $request_department ) && ( $request_department == 'commercial' || ph_get_custom_department_based_on($request_department) == 'commercial' ) &&
	2093	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
1945	2094	isset( $_REQUEST['commercial_for_sale_to_rent'] ) && $_REQUEST['commercial_for_sale_to_rent'] == 'for_sale'
1946	2095	)
1947	2096	{
1948	2097	$meta_query = array(
		@@ -1952,9 +2101,10 @@
1952	2101	);
1953	2102	}
1954	2103
1955	2104	if (
1956		- isset( $_REQUEST['department'] ) && ( $_REQUEST['department'] == 'commercial' || ph_get_custom_department_based_on($_REQUEST['department']) == 'commercial' ) &&
	2105	+ isset( $request_department ) && ( $request_department == 'commercial' || ph_get_custom_department_based_on($request_department) == 'commercial' ) &&
	2106	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
1957	2107	isset( $_REQUEST['commercial_for_sale_to_rent'] ) && $_REQUEST['commercial_for_sale_to_rent'] == 'to_rent'
1958	2108	)
1959	2109	{
1960	2110	$meta_query = array(
		@@ -1973,13 +2123,16 @@
1973	2123	* @access public
1974	2124	* @return array
1975	2125	*/
1976	2126	public function commercial_for_sale_meta_query( ) {
	2127	+ $request_department = $this->get_requested_department();
	2128	+
1977	2129
1978	2130	$meta_query = array();
1979	2131
1980	2132	if (
1981		- isset( $_REQUEST['department'] ) && ( $_REQUEST['department'] == 'commercial' || ph_get_custom_department_based_on($_REQUEST['department']) == 'commercial' ) &&
	2133	+ isset( $request_department ) && ( $request_department == 'commercial' || ph_get_custom_department_based_on($request_department) == 'commercial' ) &&
	2134	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
1982	2135	isset( $_REQUEST['commercial_for_sale'] ) && $_REQUEST['commercial_for_sale'] == '1'
1983	2136	)
1984	2137	{
1985	2138	$meta_query = array(
		@@ -1998,13 +2151,16 @@
1998	2151	* @access public
1999	2152	* @return array
2000	2153	*/
2001	2154	public function commercial_to_rent_meta_query( ) {
	2155	+ $request_department = $this->get_requested_department();
	2156	+
2002	2157
2003	2158	$meta_query = array();
2004	2159
2005	2160	if (
2006		- isset( $_REQUEST['department'] ) && ( $_REQUEST['department'] == 'commercial' || ph_get_custom_department_based_on($_REQUEST['department']) == 'commercial' ) &&
	2161	+ isset( $request_department ) && ( $request_department == 'commercial' || ph_get_custom_department_based_on($request_department) == 'commercial' ) &&
	2162	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
2007	2163	isset( $_REQUEST['commercial_to_rent'] ) && $_REQUEST['commercial_to_rent'] == '1'
2008	2164	)
2009	2165	{
2010	2166	$meta_query = array(
		@@ -2023,22 +2179,28 @@
2023	2179	* @access public
2024	2180	* @return array
2025	2181	*/
2026	2182	public function commercial_minimum_price_meta_query( ) {
	2183	+ $request_department = $this->get_requested_department();
	2184	+
2027	2185
2028	2186	$meta_query = array();
2029	2187
2030	2188	if (
2031		- isset( $_REQUEST['department'] ) && ( $_REQUEST['department'] == 'commercial' || ph_get_custom_department_based_on($_REQUEST['department']) == 'commercial' ) &&
	2189	+ isset( $request_department ) && ( $request_department == 'commercial' || ph_get_custom_department_based_on($request_department) == 'commercial' ) &&
2032	2190	(
	2191	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
2033	2192	( isset( $_REQUEST['commercial_for_sale_to_rent'] ) && $_REQUEST['commercial_for_sale_to_rent'] == 'for_sale' )
2034	2193	||
	2194	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
2035	2195	( isset( $_REQUEST['commercial_for_sale'] ) && $_REQUEST['commercial_for_sale'] == '1' )
2036	2196	) &&
	2197	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
2037	2198	isset( $_REQUEST['commercial_minimum_price'] ) && $_REQUEST['commercial_minimum_price'] != ''
2038	2199	)
2039	2200	{
2040		- $minimum_price = $_REQUEST['commercial_minimum_price'];
	2201	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
	2202	+ $minimum_price = is_string( $_REQUEST['commercial_minimum_price'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['commercial_minimum_price'] ) ) : '';
2041	2203
2042	2204	if ( !is_numeric($minimum_price) )
2043	2205	{
2044	2206	return $meta_query;
		@@ -2072,22 +2234,28 @@
2072	2234	* @access public
2073	2235	* @return array
2074	2236	*/
2075	2237	public function commercial_maximum_price_meta_query( ) {
	2238	+ $request_department = $this->get_requested_department();
	2239	+
2076	2240
2077	2241	$meta_query = array();
2078	2242
2079	2243	if (
2080		- isset( $_REQUEST['department'] ) && ( $_REQUEST['department'] == 'commercial' || ph_get_custom_department_based_on($_REQUEST['department']) == 'commercial' ) &&
	2244	+ isset( $request_department ) && ( $request_department == 'commercial' || ph_get_custom_department_based_on($request_department) == 'commercial' ) &&
2081	2245	(
	2246	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
2082	2247	( isset( $_REQUEST['commercial_for_sale_to_rent'] ) && $_REQUEST['commercial_for_sale_to_rent'] == 'for_sale' )
2083	2248	||
	2249	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
2084	2250	( isset( $_REQUEST['commercial_for_sale'] ) && $_REQUEST['commercial_for_sale'] == '1' )
2085	2251	) &&
	2252	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
2086	2253	isset( $_REQUEST['commercial_maximum_price'] ) && $_REQUEST['commercial_maximum_price'] != ''
2087	2254	)
2088	2255	{
2089		- $maximum_price = $_REQUEST['commercial_maximum_price'];
	2256	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
	2257	+ $maximum_price = is_string( $_REQUEST['commercial_maximum_price'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['commercial_maximum_price'] ) ) : '';
2090	2258
2091	2259	if ( !is_numeric($maximum_price) )
2092	2260	{
2093	2261	return $meta_query;
		@@ -2121,22 +2289,28 @@
2121	2289	* @access public
2122	2290	* @return array
2123	2291	*/
2124	2292	public function commercial_minimum_rent_meta_query( ) {
	2293	+ $request_department = $this->get_requested_department();
	2294	+
2125	2295
2126	2296	$meta_query = array();
2127	2297
2128	2298	if (
2129		- isset( $_REQUEST['department'] ) && ( $_REQUEST['department'] == 'commercial' || ph_get_custom_department_based_on($_REQUEST['department']) == 'commercial' ) &&
	2299	+ isset( $request_department ) && ( $request_department == 'commercial' || ph_get_custom_department_based_on($request_department) == 'commercial' ) &&
2130	2300	(
	2301	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
2131	2302	( isset( $_REQUEST['commercial_for_sale_to_rent'] ) && $_REQUEST['commercial_for_sale_to_rent'] == 'to_rent' )
2132	2303	||
	2304	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
2133	2305	( isset( $_REQUEST['commercial_to_rent'] ) && $_REQUEST['commercial_to_rent'] == '1' )
2134	2306	) &&
	2307	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
2135	2308	isset( $_REQUEST['commercial_minimum_rent'] ) && $_REQUEST['commercial_minimum_rent'] != ''
2136	2309	)
2137	2310	{
2138		- $minimum_rent = $_REQUEST['commercial_minimum_rent'];
	2311	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
	2312	+ $minimum_rent = is_string( $_REQUEST['commercial_minimum_rent'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['commercial_minimum_rent'] ) ) : '';
2139	2313
2140	2314	if ( !is_numeric($minimum_rent) )
2141	2315	{
2142	2316	return $meta_query;
		@@ -2170,22 +2344,28 @@
2170	2344	* @access public
2171	2345	* @return array
2172	2346	*/
2173	2347	public function commercial_maximum_rent_meta_query( ) {
	2348	+ $request_department = $this->get_requested_department();
	2349	+
2174	2350
2175	2351	$meta_query = array();
2176	2352
2177	2353	if (
2178		- isset( $_REQUEST['department'] ) && ( $_REQUEST['department'] == 'commercial' || ph_get_custom_department_based_on($_REQUEST['department']) == 'commercial' ) &&
	2354	+ isset( $request_department ) && ( $request_department == 'commercial' || ph_get_custom_department_based_on($request_department) == 'commercial' ) &&
2179	2355	(
	2356	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
2180	2357	( isset( $_REQUEST['commercial_for_sale_to_rent'] ) && $_REQUEST['commercial_for_sale_to_rent'] == 'to_rent' )
2181	2358	||
	2359	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
2182	2360	( isset( $_REQUEST['commercial_to_rent'] ) && $_REQUEST['commercial_to_rent'] == '1' )
2183	2361	) &&
	2362	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
2184	2363	isset( $_REQUEST['commercial_maximum_rent'] ) && $_REQUEST['commercial_maximum_rent'] != ''
2185	2364	)
2186	2365	{
2187		- $maximum_rent = $_REQUEST['commercial_maximum_rent'];
	2366	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
	2367	+ $maximum_rent = is_string( $_REQUEST['commercial_maximum_rent'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['commercial_maximum_rent'] ) ) : '';
2188	2368
2189	2369	if ( !is_numeric($maximum_rent) )
2190	2370	{
2191	2371	return $meta_query;
		@@ -2222,12 +2402,14 @@
2222	2402	public function negotiator_meta_query( ) {
2223	2403
2224	2404	$meta_query = array();
2225	2405
	2406	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
2226	2407	if ( isset( $_REQUEST['negotiator_id'] ) && $_REQUEST['negotiator_id'] != '' )
2227	2408	{
2228	2409	$meta_query = array(
2229	2410	'key' => '_negotiator_id',
	2411	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
2230	2412	'value' => (int)$_REQUEST['negotiator_id'],
2231	2413	'compare' => '='
2232	2414	);
2233	2415	}
		@@ -2245,13 +2427,15 @@
2245	2427	public function office_meta_query( ) {
2246	2428
2247	2429	$meta_query = array();
2248	2430
	2431	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
2249	2432	if ( isset( $_REQUEST['officeID'] ) && $_REQUEST['officeID'] != '' )
2250	2433	{
2251	2434	$meta_query = array(
2252	2435	'key' => '_office_id',
2253		- 'value' => ph_clean( (is_array($_REQUEST['officeID'])) ? $_REQUEST['officeID'] : array( $_REQUEST['officeID'] ) ),
	2436	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- The public property search reads a filter value and contributes query/meta/taxonomy arguments for the current request only; no persistent state-changing operation is reached. This exact annotation covers only NonceVerification.Recommended; retain all sanitizer and SQL-safety checks.
	2437	+ 'value' => ph_clean( wp_unslash( (array) $_REQUEST['officeID'] ) ),
2254	2438	'compare' => 'IN'
2255	2439	);
2256	2440	}
2257	2441
		@@ -2266,46 +2450,64 @@
2266	2450	*/
2267	2451	public function keyword_meta_query( ) {
2268	2452
2269	2453	$meta_query = array();
2270		-
2271		- if ( isset( $_REQUEST['keyword'] ) && $_REQUEST['keyword'] != '' )
	2454	+
	2455	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Public read-only search input; query construction does not change persistent state.
	2456	+ if ( isset( $_REQUEST['keyword'] ) && is_string( $_REQUEST['keyword'] ) && $_REQUEST['keyword'] != '' )
2272	2457	{
2273		- $_REQUEST['keyword'] = ph_clean( wp_unslash( $_REQUEST['keyword'] ) );
2274	2458
	2459	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Public read-only search input is type checked above.
	2460	+ $request_keyword = sanitize_text_field( wp_unslash( $_REQUEST['keyword'] ) );
	2461	+
2275	2462	// Remove country code from end (i.e. ', UK')
2276		- $_REQUEST['keyword'] = preg_replace('/\,\s?[A-Z][A-Z]$/', '', $_REQUEST['keyword']);
2277	2463
	2464	+ $request_keyword = preg_replace('/\,\s?[A-Z][A-Z]$/', '', $request_keyword);
	2465	+
2278	2466	// Extract postcode and use that if exists
2279	2467	$postcode_pattern = '/\b([A-Z]{1,2}[0-9][0-9A-Z]? ?[0-9]?[A-Z]{0,2})\b/i';
2280		- if ( preg_match($postcode_pattern, $_REQUEST['keyword'], $matches) )
	2468	+
	2469	+ if ( preg_match($postcode_pattern, $request_keyword, $matches) )
2281	2470	{
2282		- $_REQUEST['keyword'] = $matches[1];
	2471	+ $request_keyword = $matches[1];
2283	2472	}
2284	2473
2285		- $_REQUEST['keyword'] = trim($_REQUEST['keyword']);
	2474	+ $request_keyword = trim($request_keyword);
2286	2475
2287		- $keywords = array( $_REQUEST['keyword'] );
	2476	+ // Keep the normalized request value available to the existing excerpt query and extension filters.
	2477	+ $_REQUEST['keyword'] = $request_keyword;
	2478	+ self::$normalized_keyword = $request_keyword;
2288	2479
2289		- if ( strpos( $_REQUEST['keyword'], ' ' ) !== FALSE )
	2480	+ $keywords = array( $request_keyword );
	2481	+
	2482	+ if ( strpos( $request_keyword, ' ' ) !== FALSE )
2290	2483	{
2291		- $keywords[] = str_replace(" ", "-", ph_clean($_REQUEST['keyword']));
	2484	+
	2485	+ $keywords[] = str_replace(" ", "-", ph_clean($request_keyword));
2292	2486	}
2293		- if ( strpos( $_REQUEST['keyword'], '-' ) !== FALSE )
	2487	+
	2488	+ if ( strpos( $request_keyword, '-' ) !== FALSE )
2294	2489	{
2295		- $keywords[] = str_replace("-", " ", ph_clean($_REQUEST['keyword']));
	2490	+
	2491	+ $keywords[] = str_replace("-", " ", ph_clean($request_keyword));
2296	2492	}
2297		- if ( strpos( $_REQUEST['keyword'], '.' ) !== FALSE )
	2493	+
	2494	+ if ( strpos( $request_keyword, '.' ) !== FALSE )
2298	2495	{
2299		- $keywords[] = str_replace(".", "", ph_clean($_REQUEST['keyword']));
	2496	+
	2497	+ $keywords[] = str_replace(".", "", ph_clean($request_keyword));
2300	2498	}
2301		- if ( stripos( $_REQUEST['keyword'], 'st ' ) !== FALSE )
	2499	+
	2500	+ if ( stripos( $request_keyword, 'st ' ) !== FALSE )
2302	2501	{
2303		- $keywords[] = str_ireplace("st ", "st. ", ph_clean($_REQUEST['keyword']));
	2502	+
	2503	+ $keywords[] = str_ireplace("st ", "st. ", ph_clean($request_keyword));
2304	2504	}
2305		- if ( strpos( $_REQUEST['keyword'], '\'' ) !== FALSE )
	2505	+
	2506	+ if ( strpos( $request_keyword, '\'' ) !== FALSE )
2306	2507	{
2307		- $keywords[] = str_replace("'", "", ph_clean($_REQUEST['keyword']));
	2508	+
	2509	+ $keywords[] = str_replace("'", "", ph_clean($request_keyword));
2308	2510	}
2309	2511
2310	2512	$meta_query = array( 'relation' => 'OR' );
2311	2513
		@@ -2336,13 +2538,15 @@
2336	2538	}
2337	2539	}
2338	2540	if ( in_array('_address_postcode', $fields_to_query) )
2339	2541	{
2340		- if ( strlen($_REQUEST['keyword']) <= 4 )
	2542	+
	2543	+ if ( strlen($request_keyword) <= 4 )
2341	2544	{
2342	2545	$meta_query[] = array(
2343	2546	'key' => '_address_postcode',
2344		- 'value' => ph_clean( $_REQUEST['keyword'] ),
	2547	+
	2548	+ 'value' => ph_clean( $request_keyword ),
2345	2549	'compare' => '='
2346	2550	);
2347	2551	// Run regex match where given keyword is at the start of the postcode ^
2348	2552	// followed by one or zero letters (for WC2E-style postcodes) [a-zA-Z]?
		@@ -2348,16 +2552,18 @@
2348	2552	// followed by one or zero letters (for WC2E-style postcodes) [a-zA-Z]?
2349	2553	// then a single space [ ]
2350	2554	$meta_query[] = array(
2351	2555	'key' => '_address_postcode',
2352		- 'value' => '^' . ph_clean( $_REQUEST['keyword'] ) . '[a-zA-Z]?[ ]',
	2556	+
	2557	+ 'value' => '^' . ph_clean( $request_keyword ) . '[a-zA-Z]?[ ]',
2353	2558	'compare' => 'RLIKE'
2354	2559	);
2355	2560	}
2356	2561	else
2357	2562	{
2358		- $postcode = ph_clean( $_REQUEST['keyword'] );
2359	2563
	2564	+ $postcode = ph_clean( $request_keyword );
	2565	+
2360	2566	if ( preg_match('#^(GIR ?0AA|[A-PR-UWYZ]([0-9]{1,2}|([A-HK-Y][0-9]([0-9ABEHMNPRV-Y])?)|[0-9][A-HJKPS-UW])[0-9][ABD-HJLNP-UW-Z]{2})$#i', $postcode) )
2361	2567	{
2362	2568	// UK postcode found with no space
2363	2569
		@@ -2405,19 +2611,29 @@
2405	2611	public function get_tax_query( $tax_query = array() ) {
2406	2612	if ( ! is_array( $tax_query ) )
2407	2613	$tax_query = array();
2408	2614
	2615	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Public read-only taxonomy search; this does not authorize a write.
2409	2616	if ( isset($_REQUEST) && !empty($_REQUEST) )
2410	2617	{
	2618	+
	2619	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Public read-only taxonomy search; each value is validated and sanitized below.
2411	2620	foreach ( $_REQUEST as $key => $value )
2412	2621	{
2413		- if ( taxonomy_exists($key) && isset( $_REQUEST[$key] ) && !empty($_REQUEST[$key]) && $this->taxonomy_allowed_for_department( $key ) )
	2622	+
	2623	+ if ( taxonomy_exists($key) && !empty($value) && $this->taxonomy_allowed_for_department( $key ) )
2414	2624	{
	2625	+ $terms = (array) $value;
	2626	+ foreach ( $terms as $term ) {
	2627	+ if ( ! is_string( $term ) && ! is_int( $term ) ) {
	2628	+ continue 2;
	2629	+ }
	2630	+ }
2415	2631	$operator = $key == 'property_feature' ? 'AND' : 'IN';
2416	2632
2417	2633	$tax_query[] = array(
2418	2634	'taxonomy' => $key,
2419		- 'terms' => ph_clean( (is_array($value)) ? $value : array( $value ) ),
	2635	+ 'terms' => ph_clean( wp_unslash( $terms ) ),
2420	2636	'operator' => $operator,
2421	2637	);
2422	2638	}
2423	2639	}
		@@ -2427,11 +2643,13 @@
2427	2643	}
2428	2644
2429	2645	private function taxonomy_allowed_for_department( $taxonomy )
2430	2646	{
2431		- if ( isset( $_REQUEST['department'] ) && $_REQUEST['department'] != '' )
	2647	+ $request_department = $this->get_requested_department();
	2648	+
	2649	+ if ( isset( $request_department ) && $request_department != '' )
2432	2650	{
2433		- $department = ph_clean($_REQUEST['department']);
	2651	+ $department = ph_clean($request_department);
2434	2652	}
2435	2653	else
2436	2654	{
2437	2655	$department = get_option( 'propertyhive_primary_department', 'residential-sales' );