A:2V p P I Q7A:2V @ ? I v:2V P I TA:2V ` L s4>:2V ` ` L + 4A:2V B M v:2V M TA:2V P s4>:2V ` P + 4A:2V D Q v:2V Q TA:2V U s 3>:2V U 4>:2V U + A:2V 0 V Q>:2V V M ,?:2V ` V N A:2V J V p=:2V W = aA:2V P W u =:2V W < A:2V L W p=:2V P P Y = `=:2V @ P Y A A:2V 0 Y Rd>:2V ` Y A aA:2V p Y u A:2V 0 Y Qd>:2V 0 Y A =:2V @ Y < 3>:2V @ P Y 4>:2V P ` Y + @:2V P ` Z `X@:2V ` Z K =:2V V * @Z>:2V V TA:2V p ` s 3>:2V p ` 9>:2V ` . A:2V ` Q ?:2V ` >>:2V ` 4 4>:2V ` + 4A:2V 0 V a v:2V a p=:2V b = A:2V b Qd>:2V P b A A:2V
b Qd>:2V ` b A A:2V
b Qd>:2V p b A A:2V
b Qd>:2V b A A:2V P
b Qd>:2V b A =:2V b < `;A:2V W b v:2V b p=:2V f = Љ=:2V ^ f < p=:2V h = `=:2V P h A =:2V p @ h P >:2V @ ` P h Q?:2V P P ` h Gd>:2V ` ` h A =:2V p h < A:2V p c h =:2V j P >:2V j Q
?:2V j 4>:2V ` j + 0=:2V j =:2V @ j * 0=:2V ` j A:2V P h j `2A:2V 0 i l p=:2V m = A:2V m R>:2V m Rd>:2V P m A =:2V m < 4>:2V m + p=:2V
0 n = =:2V
n P >:2V p
0 n Qd>:2V 0 P n A =:2V @ n < @:2V @ P n G A:2V P q n A:2V p o Q>:2V p 8 o R A:2V 0 t o =:2V q * p=:2V P r = aA:2V 0 P r u =:2V r < A:2V @ v r A:2V @ X s R A:2V 0 x s @:2V y t " =:2V 0 q "p6>:2V q , 0MA:2V p x p p=:2V x = =:2V x P >:2V p x Qd>:2V P x A =:2V x < @:2V 0 x G >:2V 0 P x t A:2V ` x B Љ=:2V x < p=:2V z = Љ=:2V z < pJ=:2V p { > PA NA 1, 1, A жA A жA AA A жA A ۉA DA ,A PA AA 8>A uA ,A (A AA ully on the back-end.
*
* @since 5.0.0
*
* @param array $attributes {
* Associative array of tag names and tag values.
*
* @type string $value The attributes's value, keyed by name.
* }
* @param string $tag The element's tag-name.
* @param ?string|array $content The tag's content. Leave null to not render content.
* It will create a content-wrapping element when filled.
* When array, accepts keys 'content' and Boolean 'escape'.
*/
public static function render(
$attributes = self::DATA_DEFAULTS['attributes'],
$tag = self::DATA_DEFAULTS['tag'],
$content = self::DATA_DEFAULTS['content'] // php 8.0+, add trailing comma
) {
$attr = '';
foreach ( $attributes as $name => $value ) {
$name = trim( $name );
// Test lowercase for sanitization, but don't confuse devs in outputting it lowercase.
switch ( strtolower( $name ) ) {
case 'href':
case 'xlink:href':
case 'src':
// Perform discrete URL-encoding on resources that could bypass attributes, without mangling the URL.
// Ampersand is missing because that doesn't affect HTML attributes; plus, it's a struct for query parameters.
$_secure_attr_value = strtr(
\sanitize_url( $value ),
[
'"' => '%22',
"'" => '%27',
'<' => '%3C',
'>' => '%3E',
],
);
break;
default:
if (
/** @link */
0 === stripos( $name, 'on' )
) {
// phpcs:disable -- hint for when we need to get more specific.
// \in_array(
// $name,
// [ 'onabort', 'onblur', 'oncanplay', 'oncanplaythrough', 'onchange', 'onclick', 'oncontextmenu', 'oncuechange', 'ondblclick', 'ondrag', 'ondragend', 'ondragenter', 'ondragleave', 'ondragover', 'ondragstart', 'ondrop', 'ondurationchange', 'onemptied', 'onended', 'onerror', 'onfocus', 'oninput', 'oninvalid', 'onkeydown', 'onkeypress', 'onkeyup', 'onload', 'onloadeddata', 'onloadedmetadata', 'onloadstart', 'onmousedown', 'onmousemove', 'onmouseout', 'onmouseover', 'onmouseup', 'onmousewheel', 'onpause', 'onplay', 'onplaying', 'onprogress', 'onratechange', 'onreadystatechange', 'onreset', 'onscroll', 'onseeked', 'onseeking', 'onselect', 'onshow', 'onstalled', 'onsubmit', 'onsuspend', 'ontimeupdate', 'onvolumechange', 'onwaiting' ],
// true
// )
// phpcs:enable
// Nope. Not this function. Skip writing on-stuff.
continue 2;
}
// This replaces more than necessary -- may we wish to exchange it.
$_secure_attr_value = \esc_attr( $value );
}
$attr .= \sprintf(
' %s="%s"',
/**
* This will also strip "safe" characters outside of the alphabet, 0-9, and :_-.
* I don't want angry parents ringing me at home for their site didn't
* support proper UTF. We can afford empty tags in rare situations -- not here.
* So, we'll only allow ASCII 45~95 except 46, 47, 59~64, and 91~94.
*
* @link
*/
preg_replace( '/[^a-z\d:_-]+/i', '', $name ),
$_secure_attr_value,
);
}
// phpcs:disable WordPress.Security.EscapeOutput -- already escaped.
if ( isset( $content ) ) {
vprintf(
'<%1$s%2$s>%3$s',
[
/** @link */
preg_replace( '/[^a-z\d]+/i', '', $tag ), // phpcs:ignore WordPress.Security.EscapeOutput -- this escapes.
$attr,
\is_array( $content )
? (
( $content['escape'] ?? true )
? \esc_html( $content['content'] ) // Yes, we're filling the content with content.
: $content['content']
)
: \esc_html( $content ),
],
);
} else {
printf(
'<%s%s />', // XHTML compatible.
/** @link */
preg_replace( '/[^0-9a-zA-Z]+/', '', $tag ),
$attr,
);
}
// phpcs:enable WordPress.Security.EscapeOutput
echo "\n";
}
}