@@ -306,19 +306,19 @@ function es_optimizer_render_checkbox_option( $options, $option_name, $title, $d
306306 <td>
307307 <label>
308308 <input type="checkbox" name="<?php
309- // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
309+ // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
310310
311- /*
312- * Using printf with esc_attr for attribute name which cannot be avoided.
313- * The $option_name values are hardcoded strings from render functions, not user input.
314- * This is a controlled environment where these values are defined within the plugin.
315- */
316- printf ( 'es_optimizer_options[%s] ' , esc_attr ( $ option_name ) );
317- ?> " value="1"
311+ /*
312+ * Using printf with esc_attr for attribute name which cannot be avoided.
313+ * The $option_name values are hardcoded strings from render functions, not user input.
314+ * This is a controlled environment where these values are defined within the plugin.
315+ */
316+ printf ( 'es_optimizer_options[%s] ' , esc_attr ( $ option_name ) );
317+ ?> " value="1"
318318 <?php checked ( 1 , isset ( $ options [ $ option_name ] ) ? $ options [ $ option_name ] : 0 ); ?> />
319319 <?php
320- // Using esc_html for secure output of descriptions.
321- echo esc_html ( $ description );
320+ // Using esc_html for secure output of descriptions.
321+ echo esc_html ( $ description );
322322 ?>
323323 </label>
324324 </td>
@@ -356,16 +356,19 @@ function es_optimizer_render_textarea_option( $options, $option_name, $title, $d
356356 ?>
357357 </small></p>
358358 <textarea name="<?php
359- // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
360- /*
361- * Using printf with esc_attr for attribute name which cannot be avoided.
362- * The $option_name values are hardcoded strings from render functions, not user input.
363- * This is a controlled environment where these values are defined within the plugin.
364- */
365- printf ( 'es_optimizer_options[%s] ' , esc_attr ( $ option_name ) );
366- ?> " rows="5" cols="50" class="large-text code"><?php
359+ // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
360+
361+ /*
362+ * Using printf with esc_attr for attribute name which cannot be avoided.
363+ * The $option_name values are hardcoded strings from render functions, not user input.
364+ * This is a controlled environment where these values are defined within the plugin.
365+ */
366+ printf ( 'es_optimizer_options[%s] ' , esc_attr ( $ option_name ) );
367+ ?> " rows="5" cols="50" class="large-text code">
368+ <?php
367369 if ( isset ( $ options [ $ option_name ] ) ) {
368370 // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
371+
369372 /*
370373 * Using printf with esc_textarea is the most appropriate approach.
371374 * esc_textarea already properly escapes content for use inside textarea elements.
0 commit comments