From 4b04b22161782f5b18ffdc00093a810073f6fab7 Mon Sep 17 00:00:00 2001
From: peptiderepo <peptiderepo@users.noreply.github.com>
Date: Sun, 12 Apr 2026 16:22:48 +0700
Subject: [PATCH] fix: escape get_search_query() output to prevent XSS in
 search forms

Wrapped get_search_query() with esc_attr() in 404.php, front-page.php,
and searchform.php. Without this, a crafted search query can inject
arbitrary HTML attributes into the search input value field.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 404.php        |  72 ++++++++++-----------
 front-page.php | 170 ++++++++++++++++++++++++-------------------------
 searchform.php |  54 ++++++++--------
 3 files changed, 148 insertions(+), 148 deletions(-)

diff --git a/404.php b/404.php
index 7a92bc8..ba29ea2 100644
--- a/404.php
+++ b/404.php
@@ -1,36 +1,36 @@
-<?php
-/**
- * The 404 template
- *
- * @package peptide-starter
- */
-
-get_header();
-?>
-
-<main id="main" class="site-main">
-	<div class="ps-container">
-		<div class="error-404 not-found">
-			<h1><?php esc_html_e( '404 - Page Not Found', 'peptide-starter' ); ?></h1>
-			<p><?php esc_html_e( "Sorry, the page you're looking for doesn't exist. It might have been moved or deleted.", 'peptide-starter' ); ?></p>
-
-			<form role="search" method="get" class="search-form ps-404-search-form" action="<?php echo esc_url( home_url( '/' ) ); ?>">
-				<label>
-					<span class="screen-reader-text"><?php esc_html_e( 'Search for:', 'peptide-starter' ); ?></span>
-					<input type="search" class="search-submit" placeholder="<?php esc_attr_e( 'Search peptides...', 'peptide-starter' ); ?>" value="<?php echo get_search_query(); ?>" name="s" title="<?php esc_attr_e( 'Search for:', 'peptide-starter' ); ?>" />
-				</label>
-			</form>
-
-			<div class="ps-404-cta-group">
-				<a href="<?php echo esc_url( home_url( '/' ) ); ?>" class="ps-btn ps-btn-primary">
-					<?php esc_html_e( 'Back to Home', 'peptide-starter' ); ?>
-				</a>
-				<a href="<?php echo esc_url( home_url( '/peptides' ) ); ?>" class="ps-btn ps-btn-secondary">
-					<?php esc_html_e( 'Browse Peptides', 'peptide-starter' ); ?>
-				</a>
-			</div>
-		</div>
-	</div>
-</main>
-
-<?php get_footer(); ?>
+<?php
+/**
+ * The 404 template
+ *
+ * @package peptide-starter
+ */
+
+get_header();
+?>
+
+<main id="main" class="site-main">
+	<div class="ps-container">
+		<div class="error-404 not-found">
+			<h1><?php esc_html_e( '404 - Page Not Found', 'peptide-starter' ); ?></h1>
+			<p><?php esc_html_e( "Sorry, the page you're looking for doesn't exist. It might have been moved or deleted.", 'peptide-starter' ); ?></p>
+
+			<form role="search" method="get" class="search-form ps-404-search-form" action="<?php echo esc_url( home_url( '/' ) ); ?>">
+				<label>
+					<span class="screen-reader-text"><?php esc_html_e( 'Search for:', 'peptide-starter' ); ?></span>
+					<input type="search" class="search-submit" placeholder="<?php esc_attr_e( 'Search peptides...', 'peptide-starter' ); ?>" value="<?php echo esc_attr( get_search_query() ); ?>" name="s" title="<?php esc_attr_e( 'Search for:', 'peptide-starter' ); ?>" />
+				</label>
+			</form>
+
+			<div class="ps-404-cta-group">
+				<a href="<?php echo esc_url( home_url( '/' ) ); ?>" class="ps-btn ps-btn-primary">
+					<?php esc_html_e( 'Back to Home', 'peptide-starter' ); ?>
+				</a>
+				<a href="<?php echo esc_url( home_url( '/peptides' ) ); ?>" class="ps-btn ps-btn-secondary">
+					<?php esc_html_e( 'Browse Peptides', 'peptide-starter' ); ?>
+				</a>
+			</div>
+		</div>
+	</div>
+</main>
+
+<?php get_footer(); ?>
diff --git a/front-page.php b/front-page.php
index 9cdeb40..c763181 100644
--- a/front-page.php
+++ b/front-page.php
@@ -1,85 +1,85 @@
-<?php
-/**
- * The front page template
- *
- * @package peptide-starter
- */
-
-get_header();
-?>
-
-<main id="main" class="site-main">
-	<!-- Hero Section -->
-	<section class="hero-section">
-		<div class="hero-content">
-			<h1 class="hero-title"><?php echo esc_html( peptide_starter_get_hero_title() ); ?></h1>
-			<p class="hero-subtitle"><?php echo esc_html( peptide_starter_get_hero_subtitle() ); ?></p>
-
-			<!-- Hero Search (Peptide Search AI) -->
-			<div class="hero-search">
-				<?php
-				if ( shortcode_exists( 'peptide_search' ) ) {
-					echo do_shortcode( '[peptide_search placeholder="' . esc_attr( peptide_starter_get_search_placeholder() ) . '"]' );
-				} else {
-					?>
-					<form class="ps-search-form" method="get" action="<?php echo esc_url( home_url( '/' ) ); ?>">
-						<input
-							type="search"
-							name="s"
-							class="ps-search-input"
-							placeholder="<?php echo esc_attr( peptide_starter_get_search_placeholder() ); ?>"
-							value="<?php echo get_search_query(); ?>"
-						>
-					</form>
-					<?php
-				}
-				?>
-			</div>
-
-			<!-- Hero CTAs -->
-			<div class="hero-ctas">
-				<a href="<?php echo esc_url( home_url( '/peptides' ) ); ?>" class="ps-btn ps-btn-primary">
-					<?php esc_html_e( 'Browse Peptides', 'peptide-starter' ); ?>
-				</a>
-				<a href="<?php echo esc_url( home_url( '/about' ) ); ?>" class="ps-btn ps-btn-secondary">
-					<?php esc_html_e( 'Learn More', 'peptide-starter' ); ?>
-				</a>
-			</div>
-		</div>
-	</section>
-
-	<!-- PRAutoBlogger Posts Widget -->
-	<?php
-	if ( shortcode_exists( 'prautoblogger_posts' ) ) {
-		echo do_shortcode( '[prautoblogger_posts count="6" title="' . esc_attr__( 'Latest Research & Insights', 'peptide-starter' ) . '" subtitle="' . esc_attr__( 'Evidence-based articles on peptides, protocols, and emerging research', 'peptide-starter' ) . '"]' );
-	}
-	?>
-
-	<!-- News Feed Section -->
-	<?php
-	// Display the Peptide News plugin shortcode if available
-	if ( shortcode_exists( 'peptide_news' ) ) {
-		?>
-		<section class="news-feed-section">
-			<div class="ps-container">
-				<div class="news-feed-header">
-					<h2 class="news-feed-title"><?php esc_html_e( 'Latest Peptide Research', 'peptide-starter' ); ?></h2>
-					<p class="news-feed-description">
-						<?php esc_html_e( 'Stay updated with the latest developments in peptide science and research.', 'peptide-starter' ); ?>
-					</p>
-				</div>
-				<?php echo do_shortcode( '[peptide_news]' ); ?>
-			</div>
-		</section>
-		<?php
-	}
-	?>
-
-	<?php
-	// Note: The front page layout is handled entirely by this template.
-	// Old page content (e.g. from Elementor) is intentionally NOT rendered here
-	// to avoid duplicate hero sections and empty space.
-	?>
-</main>
-
-<?php get_footer(); ?>
+<?php
+/**
+ * The front page template
+ *
+ * @package peptide-starter
+ */
+
+get_header();
+?>
+
+<main id="main" class="site-main">
+	<!-- Hero Section -->
+	<section class="hero-section">
+		<div class="hero-content">
+			<h1 class="hero-title"><?php echo esc_html( peptide_starter_get_hero_title() ); ?></h1>
+			<p class="hero-subtitle"><?php echo esc_html( peptide_starter_get_hero_subtitle() ); ?></p>
+
+			<!-- Hero Search (Peptide Search AI) -->
+			<div class="hero-search">
+				<?php
+				if ( shortcode_exists( 'peptide_search' ) ) {
+					echo do_shortcode( '[peptide_search placeholder="' . esc_attr( peptide_starter_get_search_placeholder() ) . '"]' );
+				} else {
+					?>
+					<form class="ps-search-form" method="get" action="<?php echo esc_url( home_url( '/' ) ); ?>">
+						<input
+							type="search"
+							name="s"
+							class="ps-search-input"
+							placeholder="<?php echo esc_attr( peptide_starter_get_search_placeholder() ); ?>"
+							value="<?php echo esc_attr( get_search_query() ); ?>"
+						>
+					</form>
+					<?php
+				}
+				?>
+			</div>
+
+			<!-- Hero CTAs -->
+			<div class="hero-ctas">
+				<a href="<?php echo esc_url( home_url( '/peptides' ) ); ?>" class="ps-btn ps-btn-primary">
+					<?php esc_html_e( 'Browse Peptides', 'peptide-starter' ); ?>
+				</a>
+				<a href="<?php echo esc_url( home_url( '/about' ) ); ?>" class="ps-btn ps-btn-secondary">
+					<?php esc_html_e( 'Learn More', 'peptide-starter' ); ?>
+				</a>
+			</div>
+		</div>
+	</section>
+
+	<!-- PRAutoBlogger Posts Widget -->
+	<?php
+	if ( shortcode_exists( 'prautoblogger_posts' ) ) {
+		echo do_shortcode( '[prautoblogger_posts count="6" title="' . esc_attr__( 'Latest Research & Insights', 'peptide-starter' ) . '" subtitle="' . esc_attr__( 'Evidence-based articles on peptides, protocols, and emerging research', 'peptide-starter' ) . '"]' );
+	}
+	?>
+
+	<!-- News Feed Section -->
+	<?php
+	// Display the Peptide News plugin shortcode if available
+	if ( shortcode_exists( 'peptide_news' ) ) {
+		?>
+		<section class="news-feed-section">
+			<div class="ps-container">
+				<div class="news-feed-header">
+					<h2 class="news-feed-title"><?php esc_html_e( 'Latest Peptide Research', 'peptide-starter' ); ?></h2>
+					<p class="news-feed-description">
+						<?php esc_html_e( 'Stay updated with the latest developments in peptide science and research.', 'peptide-starter' ); ?>
+					</p>
+				</div>
+				<?php echo do_shortcode( '[peptide_news]' ); ?>
+			</div>
+		</section>
+		<?php
+	}
+	?>
+
+	<?php
+	// Note: The front page layout is handled entirely by this template.
+	// Old page content (e.g. from Elementor) is intentionally NOT rendered here
+	// to avoid duplicate hero sections and empty space.
+	?>
+</main>
+
+<?php get_footer(); ?>
diff --git a/searchform.php b/searchform.php
index 3608a11..b5e6793 100644
--- a/searchform.php
+++ b/searchform.php
@@ -1,27 +1,27 @@
-<?php
-/**
- * The search form template
- *
- * @package peptide-starter
- */
-
-?>
-<form role="search" method="get" class="ps-search-form" action="<?php echo esc_url( home_url( '/' ) ); ?>">
-	<label for="search" class="sr-only"><?php esc_html_e( 'Search', 'peptide-starter' ); ?></label>
-	<div style="position: relative;">
-		<input
-			type="search"
-			id="search"
-			name="s"
-			class="ps-search-input"
-			placeholder="<?php esc_attr_e( 'Search...', 'peptide-starter' ); ?>"
-			value="<?php echo get_search_query(); ?>"
-		>
-		<button type="submit" class="ps-btn ps-btn-primary" style="position: absolute; right: 0; top: 0; border-radius: 0 var(--radius-lg) var(--radius-lg) 0;">
-			<svg width="20" height="20" viewBox="0 0 20 20" fill="currentColor" xmlns="http://www.w3.org/2000/svg">
-				<path d="M9 17C13.4183 17 17 13.4183 17 9C17 4.58172 13.4183 1 9 1C4.58172 1 1 4.58172 1 9C1 13.4183 4.58172 17 9 17Z" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
-				<path d="M19 19L14.65 14.65" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
-			</svg>
-		</button>
-	</div>
-</form>
+<?php
+/**
+ * The search form template
+ *
+ * @package peptide-starter
+ */
+
+?>
+<form role="search" method="get" class="ps-search-form" action="<?php echo esc_url( home_url( '/' ) ); ?>">
+	<label for="search" class="sr-only"><?php esc_html_e( 'Search', 'peptide-starter' ); ?></label>
+	<div style="position: relative;">
+		<input
+			type="search"
+			id="search"
+			name="s"
+			class="ps-search-input"
+			placeholder="<?php esc_attr_e( 'Search...', 'peptide-starter' ); ?>"
+			value="<?php echo esc_attr( get_search_query() ); ?>"
+		>
+		<button type="submit" class="ps-btn ps-btn-primary" style="position: absolute; right: 0; top: 0; border-radius: 0 var(--radius-lg) var(--radius-lg) 0;">
+			<svg width="20" height="20" viewBox="0 0 20 20" fill="currentColor" xmlns="http://www.w3.org/2000/svg">
+				<path d="M9 17C13.4183 17 17 13.4183 17 9C17 4.58172 13.4183 1 9 1C4.58172 1 1 4.58172 1 9C1 13.4183 4.58172 17 9 17Z" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
+				<path d="M19 19L14.65 14.65" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
+			</svg>
+		</button>
+	</div>
+</form>