Fix 3 remaining MEDIUM security issues

- is_safe_query(): strip all block comments (incl. mid-query /*!...*/ hints) and line comments before keyword/denylist checks
- ajax_scan/preview/migrate_single/migrate_all: move current_user_can() before check_ajax_referer() (capability-first pattern)
- ajax_migrate_single/migrate_all: esc_html() on post_title in JSON response messages

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

Author: Andrew Baker

cs-code-block.php

@@ -917,8 +917,10 @@ private static function render_sql_panel() {
      */
     private static function is_safe_query( string $sql ): bool {
         $clean = trim( $sql );
-        // Strip leading block and line comments before keyword check.
-        $clean = preg_replace( '/^(\/\*.*?\*\/\s*|--[^\n]*\n\s*|#[^\n]*\n\s*)*/s', '', $clean );
+        // Strip all block comments (including mid-query MySQL /*!...*/ optimizer hints),
+        // line comments (-- and #), and surrounding whitespace before keyword check.
+        $clean = preg_replace( '/\/\*.*?\*\//s', '', $clean );
+        $clean = preg_replace( '/(--|#)[^\n]*/m', '', $clean );
         $clean = trim( $clean );
         // Reject any query containing a semicolon — prevents statement stacking
         // (e.g. SELECT 1; DROP TABLE wp_users).
@@ -1238,14 +1240,14 @@ private static function get_migration_preview( $content ) {
      * @return void Sends JSON response and exits.
      */
     public static function ajax_scan() {
-        if ( ! check_ajax_referer( self::MIGRATE_NONCE, 'nonce', false ) ) {
-            wp_send_json_error( 'Bad nonce', 403 );
-        }
-
         if ( ! current_user_can( 'manage_options' ) ) {
             wp_send_json_error( 'Forbidden', 403 );
         }
 
+        if ( ! check_ajax_referer( self::MIGRATE_NONCE, 'nonce', false ) ) {
+            wp_send_json_error( 'Bad nonce', 403 );
+        }
+
         global $wpdb;
 
         // Static query — no user data; $wpdb->posts is a trusted WP core property.
@@ -1294,14 +1296,14 @@ public static function ajax_scan() {
      * @return void Sends JSON response and exits.
      */
     public static function ajax_preview() {
-        if ( ! check_ajax_referer( self::MIGRATE_NONCE, 'nonce', false ) ) {
-            wp_send_json_error( 'Bad nonce', 403 );
-        }
-
         if ( ! current_user_can( 'manage_options' ) ) {
             wp_send_json_error( 'Forbidden', 403 );
         }
 
+        if ( ! check_ajax_referer( self::MIGRATE_NONCE, 'nonce', false ) ) {
+            wp_send_json_error( 'Bad nonce', 403 );
+        }
+
         $post_id = (int) ( $_POST['post_id'] ?? 0 );
         $post    = get_post( $post_id );
 
@@ -1326,14 +1328,14 @@ public static function ajax_preview() {
      * @return void Sends JSON response and exits.
      */
     public static function ajax_migrate_single() {
-        if ( ! check_ajax_referer( self::MIGRATE_NONCE, 'nonce', false ) ) {
-            wp_send_json_error( 'Bad nonce', 403 );
-        }
-
         if ( ! current_user_can( 'manage_options' ) ) {
             wp_send_json_error( 'Forbidden', 403 );
         }
 
+        if ( ! check_ajax_referer( self::MIGRATE_NONCE, 'nonce', false ) ) {
+            wp_send_json_error( 'Bad nonce', 403 );
+        }
+
         $post_id = (int) ( $_POST['post_id'] ?? 0 );
         $post    = get_post( $post_id );
 
@@ -1361,7 +1363,7 @@ public static function ajax_migrate_single() {
         wp_send_json_success( [
             'post_id'         => $post_id,
             'blocks_migrated' => $count,
-            'message'         => "Migrated {$count} block(s) in \"{$post->post_title}\".",
+            'message'         => 'Migrated ' . $count . ' block(s) in "' . esc_html( $post->post_title ) . '".',
         ] );
     }
 
@@ -1372,14 +1374,14 @@ public static function ajax_migrate_single() {
      * @return void Sends JSON response and exits.
      */
     public static function ajax_migrate_all() {
-        if ( ! check_ajax_referer( self::MIGRATE_NONCE, 'nonce', false ) ) {
-            wp_send_json_error( 'Bad nonce', 403 );
-        }
-
         if ( ! current_user_can( 'manage_options' ) ) {
             wp_send_json_error( 'Forbidden', 403 );
         }
 
+        if ( ! check_ajax_referer( self::MIGRATE_NONCE, 'nonce', false ) ) {
+            wp_send_json_error( 'Bad nonce', 403 );
+        }
+
         global $wpdb;
 
         // Static query — no user data; $wpdb->posts is a trusted WP core property.
@@ -1422,7 +1424,7 @@ public static function ajax_migrate_all() {
 
                 $migrated_posts++;
                 $migrated_blocks += $count;
-                $details[] = "#{$post->ID}: {$post->post_title} ({$count} blocks)";
+                $details[] = '#' . $post->ID . ': ' . esc_html( $post->post_title ) . ' (' . $count . ' blocks)';
             }
         }