Automattic\WooCommerce\Blocks\Shipping

PickupLocationsRestController::sanitize_pickup_location_settings │ private │ WC 1.0

Sanitize the pickup_location_settings payload before persisting.

The WP REST dispatcher only auto-sanitizes top-level args, so nested object properties need to be cleaned here as defense in depth against stored HTML/JS in admin surfaces.

Method of the class: PickupLocationsRestController{}

No Hooks.

Returns

array. Sanitized settings payload.

Usage

// private - for code of main (parent) class only
$result = $this->sanitize_pickup_location_settings( $settings ): array;

$settings(array) (required)

Raw settings payload.

PickupLocationsRestController::sanitize_pickup_location_settings() PickupLocationsRestController::sanitize pickup location settings code ^{WC 11.2.1}

private function sanitize_pickup_location_settings( array $settings ): array {
	$sanitized = array();

	if ( isset( $settings['enabled'] ) ) {
		$sanitized['enabled'] = in_array( $settings['enabled'], array( 'yes', 'no' ), true )
			? $settings['enabled']
			: 'no';
	}

	if ( isset( $settings['title'] ) ) {
		$sanitized['title'] = sanitize_text_field( (string) $settings['title'] );
	}

	if ( isset( $settings['tax_status'] ) ) {
		$sanitized['tax_status'] = in_array( $settings['tax_status'], array( 'taxable', 'none' ), true )
			? $settings['tax_status']
			: 'none';
	}

	if ( isset( $settings['cost'] ) ) {
		// Cost may be a math expression (e.g. "5 + 1.50"), so strip HTML
		// without coercing to float — floatval would break formula syntax.
		$sanitized['cost'] = wp_strip_all_tags( (string) $settings['cost'] );
	}

	return $sanitized;
}