fix: Refactor Update class and improve data sanitization in various classes

Author: Akash-Raj-ST

src/inc/api/class-part.php

@@ -263,19 +263,20 @@ public function run_save_process() {
 
 		$sanitize_input = $this->sanitize_data_input( $type, $this->id, $field_input );
 
-		$updated = new Update(
+		$update_obj = new Update();
+		$updated    = $update_obj->get_save_data(
 			$this->section->panel->page->slug, // Used to check nonce.
 			$this->data_api, // Doing this way to allow multi-api saving from single section down-the-road.
 			$this->id, // This is the data storage key in the database.
 			$sanitize_input, // Sanitized input (maybe empty, triggering delete).
 			isset( $this->obj_id ) ? $this->obj_id : null // Maybe an object ID needed for metadata API.
 		);
 
-		if ( $updated ) {
-			return $this->id;
+		if ( empty( $updated ) || is_wp_error( $updated ) ) {
+			return false;
 		}
 
-		return false;
+		return $this->id;
 	}
 
 	/**

src/inc/api/class-read.php

@@ -53,26 +53,21 @@ class Read {
 	/**
 	 * Read constructor.
 	 *
-	 * @param string $panel_id Panel ID is a string slug.
-	 * @param string $type     Type.
-	 * @param string $key      Key.
-	 * @param null   $default  Default.
-	 * @param null   $obj_id   Object ID.
-	 * @param bool   $single   Is single object type status.
-	 *
-	 * @return array|int|string|null|bool
+	 * @param string $panel_id     Panel ID is a string slug.
+	 * @param string $type         Type.
+	 * @param string $key          Key.
+	 * @param null   $default_val  Default.
+	 * @param null   $obj_id       Object ID.
+	 * @param bool   $single       Is single object type status.
 	 */
-	public function __construct( $panel_id, $type, $key, $default = null, $obj_id = null, $single = true ) {
+	public function __construct( $panel_id, $type, $key, $default_val = null, $obj_id = null, $single = true ) {
 		$this->type   = $type;
 		$this->key    = $key;
 		$this->obj_id = $obj_id;
 		$this->single = $single;
 
 		// 1. Data API switchboard
 		$this->get_data();
-
-		// 2. Return data for use by field.
-		return $this->response;
 	}
 
 	/**

src/inc/api/class-update.php

@@ -23,8 +23,10 @@ class Update {
 	 * @param string $value     Value.
 	 * @param null   $obj_id    Object ID.
 	 * @param bool   $autoload  Autoload status.
+	 *
+	 * @return bool|int|\WP_Error
 	 */
-	public function __construct( $page_slug, $type, $key, $value, $obj_id = null, $autoload = true ) {
+	public function get_save_data( $page_slug, $type, $key, $value, $obj_id = null, $autoload = true ) {
 		// Confirms both that POST is happening and that _wpnonce was sent, otherwise returns false to not try updates.
 		if ( ! isset( $_POST['_wpnonce'] ) ) {
 			return false;

src/inc/class-page.php

@@ -333,7 +333,7 @@ public function page_footer() {
 						do_action( 'wpop_page_footer' );
 						?>
 						<ul>
-							<li>Stored in: <code><?php echo esc_attr( $this->get_storage_table() ); ?></code></li>
+							<li>Stored in: <code><?php echo esc_html( $this->get_storage_table() ); ?></code></li>
 						</ul>
 					</div>
 				</div>

src/inc/fields/class-multiselect.php

@@ -87,19 +87,21 @@ public function run_save_process() {
 		$field_input = isset( $_POST[ $this->id ] ) ? filter_input( INPUT_POST, $this->id, FILTER_DEFAULT, FILTER_REQUIRE_ARRAY ) : false;
 
 		$sanitize_input = $this->sanitize_data_input( $type, $this->id, $field_input );
-		$updated        = new Update(
+
+		$update_obj = new Update();
+		$updated    = $update_obj->get_save_data(
 			$this->section->panel->page->slug, // Used to check nonce.
 			$this->data_api, // Doing this way to allow multi-api saving from single panel down-the-road.
 			$this->id, // This is the data storage key in the database.
 			$sanitize_input, // Sanitized input (maybe empty, triggering delete).
 			isset( $this->obj_id ) ? $this->obj_id : null // Maybe an object ID needed for metadata API.
 		);
 
-		if ( $updated ) {
-			return $this->id;
+		if ( empty( $updated ) || is_wp_error( $updated ) ) {
+			return false;
 		}
 
-		return false;
+		return $this->id;
 	}
 
 	/**

src/inc/page-parts/class-panel.php

@@ -160,7 +160,7 @@ public function content_sidebar() {
 				foreach ( $this->parts as $key => $section ) :
 					?>
 					<li id="<?php echo esc_attr( $section->slug . '-nav' ); ?>" class="pure-menu-item">
-						<a href="<?php echo esc_attr( '#' . $section->slug ); ?>" class="pure-menu-link">
+						<a href="<?php echo esc_url( '#' . $section->slug ); ?>" class="pure-menu-link">
 							<?php if ( ! empty( $section->dashicon ) ) : ?>
 								<span class="dashicons <?php echo sanitize_html_class( $section->dashicon ); ?> menu-icon"></span>
 							<?php endif; ?>
@@ -308,9 +308,9 @@ public function get_clean_classname() {
 	public function callback_footer_html() {
 		?>
 		<ul>
-			<li>Sections: <code><?php echo esc_attr( $this->section_count ); ?></code></li>
-			<li>Total Data Parts: <code><?php echo esc_attr( $this->data_count ); ?></code></li>
-			<li>Total Parts: <code><?php echo esc_attr( $this->part_count ); ?></code></li>
+			<li>Sections: <code><?php echo esc_html( $this->section_count ); ?></code></li>
+			<li>Total Data Parts: <code><?php echo esc_html( $this->data_count ); ?></code></li>
+			<li>Total Parts: <code><?php echo esc_html( $this->part_count ); ?></code></li>
 		</ul>
 		<?php
 	}