Improve <select> element escaping.

pronamic · Oct 30, 2023 · 1c1adab · 1c1adab
1 parent 6a01e75
commit 1c1adab
Showing 1 changed file with 15 additions and 5 deletions.
diff --git a/views/meta-box-gateway-settings.php b/views/meta-box-gateway-settings.php
@@ -351,11 +351,21 @@ function ( $section ) {
 
 									break;
 								case 'select':
-									printf(
-										'<select %s>%s</select>',
-										Util::array_to_html_attributes( $attributes ),
-										Util::select_options_grouped( $field['options'], $value )
-									);
+									$element = new Element( 'select', $attributes );
+
+									foreach ( $field['options'] as $key => $label ) {
+										$option = new Element( 'option', [ 'value' => $key ] );
+
+										$option->children[] = $label;
+
+										if ( $value === $key ) {
+											$option->attributes['selected'] = 'selected';
+										}
+
+										$element->children[] = $option;
+									}
+
+									$element->output();
 
 									break;
 								case 'optgroup':