$v ) {
// Skip invalid attribute names, based on the rule WP_HTML_Tag_Processor uses.
// esc_attr() leaves spaces and "=" alone, which would let a name break out into extra attributes.
// The "u" flag also rejects invalid UTF-8, which esc_attr() would turn into an empty name.
if ( ! preg_match( '~^[^ "\'>&', acf_esc_attrs($attrs) );
// }
/**
* acf_hidden_input
*
* Renders the HTML of a hidden input.
*
* @date 3/02/2014
* @since 5.0.0
*
* @param array $attrs The array of attrs.
* @return string
*/
function acf_hidden_input( $attrs = array() ) {
echo acf_get_hidden_input( $attrs ); //phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- escaped by input generation function.
}
/**
* acf_get_hidden_input
*
* Returns the HTML of a hidden input.
*
* @date 3/02/2014
* @since 5.0.0
*
* @param array $attrs The array of attrs.
* @return string
*/
function acf_get_hidden_input( $attrs = array() ) {
return sprintf( '', acf_esc_attrs( $attrs ) );
}
/**
* acf_text_input
*
* Renders the HTML of a text input.
*
* @date 3/02/2014
* @since 5.0.0
*
* @param array $attrs The array of attrs.
* @return string
*/
function acf_text_input( $attrs = array() ) {
echo acf_get_text_input( $attrs ); //phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- escaped by input generation function.
}
/**
* acf_get_text_input
*
* Returns the HTML of a text input.
*
* @date 3/02/2014
* @since 5.0.0
*
* @param array $attrs The array of attrs.
* @return string
*/
function acf_get_text_input( $attrs = array() ) {
$attrs = wp_parse_args(
$attrs,
array(
'type' => 'text',
)
);
if ( isset( $attrs['value'] ) && is_string( $attrs['value'] ) ) {
$attrs['value'] = htmlspecialchars( $attrs['value'] );
}
return sprintf( '', acf_esc_attrs( $attrs ) );
}
/**
* acf_file_input
*
* Renders the HTML of a file input.
*
* @date 3/02/2014
* @since 5.0.0
*
* @param array $attrs The array of attrs.
* @return string
*/
function acf_file_input( $attrs = array() ) {
echo acf_get_file_input( $attrs ); //phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- escaped by input generation function.
}
/**
* Returns the nonce action of a basic uploader file input, bound to the object it is rendered for.
*
* @since 6.8.11
*
* @param string $render_id The render ID of the object, as from acf_get_current_render_id().
* @param string $field_key The field key.
* @return string
*/
function acf_get_file_uploader_nonce_action( $render_id, $field_key ) {
return 'acf/file_uploader_nonce/' . $render_id . '/' . $field_key;
}
/**
* acf_get_file_input
*
* Returns the HTML of a file input.
*
* @date 3/02/2014
* @since 5.0.0
*
* @param array $attrs The array of attrs.
* @return string
*/
function acf_get_file_input( $attrs = array() ) {
$field_key = isset( $attrs['key'] ) && is_string( $attrs['key'] ) ? $attrs['key'] : '';
$nonce_field = '';
/**
* If we don't have a field key (most likely because this was called by a third-party field),
* we have to try to guess the field key based on the field name.
*/
if ( '' === $field_key ) {
$parts = explode( '[', $attrs['name'] );
if ( is_array( $parts ) && ! empty( $parts[1] ) ) {
// Remove the trailing `]`.
$field_key = substr( end( $parts ), 0, -1 );
}
}
/**
* We only output the nonce if we have a field key, as it's possible to render
* the file input without a real field. But, basic uploaders that don't have any
* custom logic will likely fail to upload anyway if they don't have a field key.
*/
if ( '' !== $field_key ) {
$nonce_attrs = array(
'name' => 'acf[' . $field_key . '_file_nonce]',
'value' => wp_create_nonce( acf_get_file_uploader_nonce_action( acf_get_current_render_id(), $field_key ) ),
);
$nonce_field = sprintf(
'',
acf_esc_attrs( $nonce_attrs )
);
}
return sprintf(
'%2$s',
acf_esc_attrs( $attrs ),
$nonce_field
);
}
/**
* acf_textarea_input
*
* Renders the HTML of a textarea input.
*
* @date 3/02/2014
* @since 5.0.0
*
* @param array $attrs The array of attrs.
* @return string
*/
function acf_textarea_input( $attrs = array() ) {
echo acf_get_textarea_input( $attrs ); //phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- escaped by input generation function.
}
/**
* acf_get_textarea_input
*
* Returns the HTML of a textarea input.
*
* @date 3/02/2014
* @since 5.0.0
*
* @param array $attrs The array of attrs.
* @return string
*/
function acf_get_textarea_input( $attrs = array() ) {
$value = '';
if ( isset( $attrs['value'] ) ) {
$value = $attrs['value'];
unset( $attrs['value'] );
}
return sprintf( '', acf_esc_attrs( $attrs ), esc_textarea( $value ) );
}
/**
* acf_checkbox_input
*
* Renders the HTML of a checkbox input.
*
* @date 3/02/2014
* @since 5.0.0
*
* @param array $attrs The array of attrs.
* @return string
*/
function acf_checkbox_input( $attrs = array() ) {
echo acf_get_checkbox_input( $attrs ); //phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- escaped by input generation function.
}
/**
* acf_get_checkbox_input
*
* Returns the HTML of a checkbox input.
*
* @date 3/02/2014
* @since 5.0.0
*
* @param array $attrs The array of attrs.
* @return string
*/
function acf_get_checkbox_input( $attrs = array() ) {
// Allow radio or checkbox type.
$attrs = wp_parse_args(
$attrs,
array(
'type' => 'checkbox',
)
);
// Get label.
$label = '';
if ( isset( $attrs['label'] ) ) {
$label = $attrs['label'];
unset( $attrs['label'] );
}
// Render.
$checked = isset( $attrs['checked'] );
// Build label attributes array for accessibility and consistency.
$label_attrs = array();
if ( $checked ) {
$label_attrs['class'] = 'selected';
}
if ( ! empty( $attrs['button_group'] ) ) {
unset( $attrs['button_group'] );
// If tabindex is provided, use it for the label; otherwise, use checked-based default.
if ( isset( $attrs['tabindex'] ) ) {
$label_attrs['tabindex'] = (string) $attrs['tabindex'];
unset( $attrs['tabindex'] );
} else {
$label_attrs['tabindex'] = $checked ? '0' : '-1';
}
$label_attrs['role'] = 'radio';
$label_attrs['aria-checked'] = $checked ? 'true' : 'false';
}
return ' ' . acf_esc_html( $label ) . '';
}
/**
* acf_radio_input
*
* Renders the HTML of a radio input.
*
* @date 3/02/2014
* @since 5.0.0
*
* @param array $attrs The array of attrs.
* @return string
*/
function acf_radio_input( $attrs = array() ) {
echo acf_get_radio_input( $attrs ); //phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- escaped by input generation function.
}
/**
* acf_get_radio_input
*
* Returns the HTML of a radio input.
*
* @date 3/02/2014
* @since 5.0.0
*
* @param array $attrs The array of attrs.
* @return string
*/
function acf_get_radio_input( $attrs = array() ) {
$attrs['type'] = 'radio';
return acf_get_checkbox_input( $attrs );
}
/**
* acf_select_input
*
* Renders the HTML of a select input.
*
* @date 3/02/2014
* @since 5.0.0
*
* @param array $attrs The array of attrs.
* @return string
*/
function acf_select_input( $attrs = array() ) {
echo acf_get_select_input( $attrs ); //phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- escaped by input generation function.
}
/**
* acf_select_input
*
* Returns the HTML of a select input.
*
* @date 3/02/2014
* @since 5.0.0
*
* @param array $attrs The array of attrs.
* @return string
*/
function acf_get_select_input( $attrs = array() ) {
$value = (array) acf_extract_var( $attrs, 'value' );
$choices = (array) acf_extract_var( $attrs, 'choices' );
return sprintf(
'',
acf_esc_attrs( $attrs ),
acf_walk_select_input( $choices, $value )
);
}
/**
* acf_walk_select_input
*
* Returns the HTML of a select input's choices.
*
* @date 27/6/17
* @since 5.6.0
*
* @param array $choices The choices to walk through.
* @param array $values The selected choices.
* @param array $depth The current walk depth.
* @return string
*/
function acf_walk_select_input( $choices = array(), $values = array(), $depth = 0 ) {
$html = '';
// Sanitize values for 'selected' matching (only once).
if ( $depth == 0 ) {
$values = array_map( 'esc_attr', $values );
}
// Loop over choices and append to html.
if ( $choices ) {
foreach ( $choices as $value => $label ) {
// Multiple (optgroup)
if ( is_array( $label ) ) {
$html .= sprintf(
'',
esc_attr( $value ),
acf_walk_select_input( $label, $values, $depth + 1 )
);
// single (option)
} else {
$attrs = array(
'value' => $value,
);
// If is selected.
$pos = array_search( esc_attr( $value ), $values );
if ( $pos !== false ) {
$attrs['selected'] = 'selected';
$attrs['data-i'] = $pos;
}
$html .= sprintf( '', acf_esc_attrs( $attrs ), esc_html( $label ) );
}
}
}
return $html;
}
/**
* acf_clean_atts
*
* See acf_filter_attrs().
*
* @date 3/10/17
* @since 5.6.3
*
* @param array $attrs The array of attrs.
* @return string
*/
function acf_clean_atts( $attrs ) {
return acf_filter_attrs( $attrs );
}
/**
* acf_esc_atts
*
* See acf_esc_attrs().
*
* @date 27/6/17
* @since 5.6.0
*
* @param array $attrs The array of attrs.
* @return string
*/
function acf_esc_atts( $attrs ) {
return acf_esc_attrs( $attrs );
}
/**
* acf_esc_attr
*
* @date 13/6/19
* @since 5.8.1
* @deprecated 5.6.0
* @see acf_esc_attrs().
*
* @param array $attrs The array of attrs.
* @return string
*/
function acf_esc_attr( $attrs ) {
return acf_esc_attrs( $attrs );
}
/**
* acf_esc_attr_e
*
* See acf_esc_attrs().
*
* @date 13/6/19
* @since 5.8.1
* @deprecated 5.6.0
*
* @param array $attrs The array of attrs.
*/
function acf_esc_attr_e( $attrs ) {
echo acf_esc_attrs( $attrs );
}
/**
* acf_esc_atts_e
*
* See acf_esc_attrs().
*
* @date 13/6/19
* @since 5.8.1
* @deprecated 5.6.0
*
* @param array $attrs The array of attrs.
*/
function acf_esc_atts_e( $attrs ) {
echo acf_esc_attrs( $attrs );
}