alert(1)" → "" (no valid leading token) * "" → "" (empty input) * * @param mixed $value Raw input value. * @return string Sanitized formula string, or '' when no valid formula found. */ public static function sanitize_molecular_formula( $value ): string { // 1. Strip control characters (including newlines, tabs, null bytes). $value = preg_replace( '/[\x00-\x1F\x7F]/', '', (string) $value ) ?? ''; // 2. Strip HTML tags; then strip remaining unsafe text characters. $value = sanitize_text_field( wp_strip_all_tags( $value ) ); if ( '' === $value ) { return ''; } // 3. Extract the maximal leading run of valid element tokens and separators. // A valid run must start with an element token ([A-Z][a-z]?\d*), not a separator. $pattern = '/^((?:' . self::FORMULA_TOKEN . '|' . self::FORMULA_SEP . ')+)/u'; if ( preg_match( $pattern, $value, $m ) ) { return $m[1]; } return ''; } /** * Sanitize a molecular weight stored as a float string (for _pr_molecular_weight). * * Strips any trailing "Da" unit suffix, returns a float string. * Stored as string in post_meta to avoid float precision issues. * Returns empty string for invalid/zero inputs. * * @param mixed $value Raw input value (e.g., "1419.5" or "1419.5 Da"). * @return string Float string (e.g., "1419.5"), or "" on invalid input. */ public static function sanitize_molecular_weight_string( $value ): string { $clean = trim( preg_replace( '/\s*[Dd][Aa]\s*$/', '', trim( (string) $value ) ) ?? '' ); $f = (float) $clean; return $f > 0.0 ? (string) $f : ''; } /** * Sanitize a JSON array string (e.g., for legacy aliases field or _pr_aliases). * * Accepts a JSON string or PHP array. Sanitizes each element individually. * Input is UNTRUSTED. * * @param mixed $value Raw input (JSON string or array). * @return string JSON array of sanitized strings, or '[]'. */ public static function sanitize_json_array( $value ): string { if ( is_array( $value ) ) { $value = wp_json_encode( array_map( 'sanitize_text_field', $value ) ); } $decoded = json_decode( (string) $value, true ); if ( ! is_array( $decoded ) ) { return '[]'; } return wp_json_encode( array_values( array_map( 'sanitize_text_field', $decoded ) ) ); } /** * Sanitize FAQ items JSON (for _pr_faq_items). * * Expects a JSON array of {question: string, answer: string} objects. * Sanitizes each question and answer individually. * Input is UNTRUSTED — malformed entries are silently dropped. * * @param mixed $value Raw input (JSON string or PHP array). * @return string JSON array of sanitized FAQ item objects, or '[]'. */ public static function sanitize_faq_items( $value ): string { if ( is_string( $value ) ) { $value = json_decode( $value, true ); } if ( ! is_array( $value ) ) { return '[]'; } $clean = array(); foreach ( $value as $item ) { if ( ! is_array( $item ) ) { continue; } $question = sanitize_text_field( (string) ( $item['question'] ?? '' ) ); $answer = sanitize_textarea_field( (string) ( $item['answer'] ?? '' ) ); if ( '' !== $question && '' !== $answer ) { $clean[] = array( 'question' => $question, 'answer' => $answer, ); } } return wp_json_encode( $clean, JSON_UNESCAPED_UNICODE ) ?: '[]'; } }