Escape dynamic values in settings fields to prevent malformed HTML

[bookchiq]

This update ensures proper escaping of dynamic values in the plugin settings page to prevent malformed HTML output and improve compatibility with HTML content containing quotes or special characters.

Problem

The current implementation inserts unescaped values directly into input elements. When a user enters HTML containing quotes (e.g., class="sf-icon-star-empty"), the value attribute is prematurely terminated. This leads to malformed HTML in both the settings interface and the front-end rendering if the broken value is saved.

Solution

This update wraps dynamic values using esc_attr() for input fields. This function safely encodes content for use in the value attribute.

Benefits

• Prevents broken rendering in the admin UI and on the front end
• Preserves user input that includes HTML or special characters
• Follows WordPress best practices for data output in templates

Credits

• Thanks to squarestar for identifying the issue in the WP support forum post "Bug: Settings inputs not escaped causes malformed HTML on the frontend"