: str_replace(): Passing null to parameter #2 ($replace) of type array|string is deprecated in
* Adds a line in the meta box.
* @todo [JRF] Check if $class is added appropriately everywhere.
* @param string[] $meta_field_def Contains the vars based on which output is generated.
* @param string $key Internal key (without prefix).
public function do_meta_box( $meta_field_def, $key = '' ) {
$esc_form_key = esc_attr( WPSEO_Meta::$form_prefix . $key );
$meta_value = WPSEO_Meta::get_value( $key, $this->get_metabox_post()->ID );
if ( isset( $meta_field_def['class'] ) && $meta_field_def['class'] !== '' ) {
$class = ' ' . $meta_field_def['class'];
if ( isset( $meta_field_def['placeholder'] ) && $meta_field_def['placeholder'] !== '' ) {
$placeholder = $meta_field_def['placeholder'];
if ( isset( $meta_field_def['description'] ) ) {
$aria_describedby = ' aria-describedby="' . $esc_form_key . '-desc"';
$description = '<p id="' . $esc_form_key . '-desc" class="yoast-metabox__description">' . $meta_field_def['description'] . '</p>';
// Add a hide_on_pages option that returns nothing when the field is rendered on a page.
if ( isset( $meta_field_def['hide_on_pages'] ) && $meta_field_def['hide_on_pages'] && get_post_type() === 'page' ) {
switch ( $meta_field_def['type'] ) {
if ( isset( $meta_field_def['autocomplete'] ) && $meta_field_def['autocomplete'] === false ) {
$ac = 'autocomplete="off" ';
if ( $placeholder !== '' ) {
$placeholder = ' placeholder="' . esc_attr( $placeholder ) . '"';
$content .= '<input type="text"' . $placeholder . ' id="' . $esc_form_key . '" ' . $ac . 'name="' . $esc_form_key . '" value="' . esc_attr( $meta_value ) . '" class="large-text' . $class . '"' . $aria_describedby . '/>';
if ( $placeholder !== '' ) {
$placeholder = ' placeholder="' . esc_attr( $placeholder ) . '"';
$content .= '<input type="url"' . $placeholder . ' id="' . $esc_form_key . '" name="' . $esc_form_key . '" value="' . esc_attr( urldecode( $meta_value ) ) . '" class="large-text' . $class . '"' . $aria_describedby . '/>';
if ( isset( $meta_field_def['rows'] ) && $meta_field_def['rows'] > 0 ) {
$rows = $meta_field_def['rows'];
$content .= '<textarea class="large-text' . $class . '" rows="' . esc_attr( $rows ) . '" id="' . $esc_form_key . '" name="' . $esc_form_key . '"' . $aria_describedby . '>' . esc_textarea( $meta_value ) . '</textarea>';
if ( isset( $meta_field_def['default'] ) ) {
$default = sprintf( ' data-default="%s"', esc_attr( $meta_field_def['default'] ) );
$content .= '<input type="hidden" id="' . $esc_form_key . '" name="' . $esc_form_key . '" value="' . esc_attr( $meta_value ) . '"' . $default . '/>' . "\n";
if ( isset( $meta_field_def['options'] ) && is_array( $meta_field_def['options'] ) && $meta_field_def['options'] !== [] ) {
$content .= '<select name="' . $esc_form_key . '" id="' . $esc_form_key . '" class="yoast' . $class . '">';
foreach ( $meta_field_def['options'] as $val => $option ) {
$selected = selected( $meta_value, $val, false );
$content .= '<option ' . $selected . ' value="' . esc_attr( $val ) . '">' . esc_html( $option ) . '</option>';
unset( $val, $option, $selected );
if ( isset( $meta_field_def['options'] ) && is_array( $meta_field_def['options'] ) && $meta_field_def['options'] !== [] ) {
// Set $meta_value as $selected_arr.
$selected_arr = $meta_value;
// If the multiselect field is 'meta-robots-adv' we should explode on ,.
if ( $key === 'meta-robots-adv' ) {
$selected_arr = explode( ',', $meta_value );
if ( ! is_array( $selected_arr ) ) {
$selected_arr = (array) $selected_arr;
$options_count = count( $meta_field_def['options'] );
$content .= '<select multiple="multiple" size="' . esc_attr( $options_count ) . '" name="' . $esc_form_key . '[]" id="' . $esc_form_key . '" class="yoast' . $class . '"' . $aria_describedby . '>';
foreach ( $meta_field_def['options'] as $val => $option ) {
if ( in_array( $val, $selected_arr, true ) ) {
$selected = ' selected="selected"';
$content .= '<option ' . $selected . ' value="' . esc_attr( $val ) . '">' . esc_html( $option ) . '</option>';
unset( $val, $option, $selected, $selected_arr, $options_count );
$checked = checked( $meta_value, 'on', false );
$expl = ( isset( $meta_field_def['expl'] ) ) ? esc_html( $meta_field_def['expl'] ) : '';
$content .= '<input type="checkbox" id="' . $esc_form_key . '" name="' . $esc_form_key . '" ' . $checked . ' value="on" class="yoast' . $class . '"' . $aria_describedby . '/> <label for="' . $esc_form_key . '">' . $expl . '</label>';
unset( $checked, $expl );
if ( isset( $meta_field_def['options'] ) && is_array( $meta_field_def['options'] ) && $meta_field_def['options'] !== [] ) {
foreach ( $meta_field_def['options'] as $val => $option ) {
$checked = checked( $meta_value, $val, false );
$content .= '<input type="radio" ' . $checked . ' id="' . $esc_form_key . '_' . esc_attr( $val ) . '" name="' . $esc_form_key . '" value="' . esc_attr( $val ) . '"/> <label for="' . $esc_form_key . '_' . esc_attr( $val ) . '">' . esc_html( $option ) . '</label> ';
unset( $val, $option, $checked );
. ' id="' . $esc_form_key . '"'
. ' class="' . $class . '"'
. ' name="' . $esc_form_key . '"'
. ' value="' . esc_attr( $meta_value ) . '"' . $aria_describedby
. ' id="' . esc_attr( $esc_form_key ) . '_button"'
. ' class="wpseo_image_upload_button button"'
. ' data-target="' . esc_attr( $esc_form_key ) . '"'
. ' data-target-id="' . esc_attr( $esc_form_key ) . '-id"'
. ' value="' . esc_attr__( 'Upload Image', 'wordpress-seo' ) . '"'
. ' class="wpseo_image_remove_button button"'
. ' value="' . esc_attr__( 'Clear Image', 'wordpress-seo' ) . '"'
$content = apply_filters( 'wpseo_do_meta_box_field_' . $key, $content, $meta_value, $esc_form_key, $meta_field_def, $key );
$title = esc_html( $meta_field_def['title'] );
// By default, use the field title as a label element.
$label = '<label for="' . $esc_form_key . '">' . $title . '</label>';
// Set the inline help and help panel, if any.
if ( isset( $meta_field_def['help'] ) && $meta_field_def['help'] !== '' ) {
$help = new WPSEO_Admin_Help_Panel( $key, $meta_field_def['help-button'], $meta_field_def['help'] );
$help_button = $help->get_button_html();
$help_panel = $help->get_panel_html();
// If it's a set of radio buttons, output proper fieldset and legend.
if ( $meta_field_def['type'] === 'radio' ) {
return '<fieldset><legend>' . $title . '</legend>' . $help_button . $help_panel . $content . $description . '</fieldset>';
// If it's a single checkbox, ignore the title.
if ( $meta_field_def['type'] === 'checkbox' ) {
// Other meta box content or form fields.
if ( $meta_field_def['type'] === 'hidden' ) {
$html = $label . $description . $help_button . $help_panel . $content;
* Saves the WP SEO metadata for posts.
* {@internal $_POST parameters are validated via sanitize_post_meta().}}
* @param int $post_id Post ID.
* @return bool|void Boolean false if invalid save post request.
public function save_postdata( $post_id ) {
// Bail if this is a multisite installation and the site has been switched.
if ( is_multisite() && ms_is_switched() ) {
if ( $post_id === null ) {
// phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Sanitized in wp_verify_none.
if ( ! isset( $_POST['yoast_free_metabox_nonce'] ) || ! wp_verify_nonce( wp_unslash( $_POST['yoast_free_metabox_nonce'] ), 'yoast_free_metabox' ) ) {
if ( wp_is_post_revision( $post_id ) ) {
$post_id = wp_is_post_revision( $post_id );
* Determine we're not accidentally updating a different post.
* We can't use filter_input here as the ID isn't available at this point, other than in the $_POST data.
if ( ! isset( $_POST['ID'] ) || $post_id !== (int) $_POST['ID'] ) {
clean_post_cache( $post_id );
$post = get_post( $post_id );
if ( ! is_object( $post ) ) {
do_action( 'wpseo_save_compare_data', $post );
if ( $this->social_is_enabled ) {
$social_fields = WPSEO_Meta::get_meta_field_defs( 'social' );
$meta_boxes = apply_filters( 'wpseo_save_metaboxes', [] );
$meta_boxes = array_merge(
WPSEO_Meta::get_meta_field_defs( 'general', $post->post_type ),
WPSEO_Meta::get_meta_field_defs( 'advanced' ),
WPSEO_Meta::get_meta_field_defs( 'schema', $post->post_type )
foreach ( $meta_boxes as $key => $meta_box ) {
// If analysis is disabled remove that analysis score value from the DB.
if ( $this->is_meta_value_disabled( $key ) ) {
WPSEO_Meta::delete( $key, $post_id );
$field_name = WPSEO_Meta::$form_prefix . $key;
if ( $meta_box['type'] === 'checkbox' ) {
$data = isset( $_POST[ $field_name ] ) ? 'on' : 'off';
if ( isset( $_POST[ $field_name ] ) ) {
// phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- We're preparing to do just that.
$data = wp_unslash( $_POST[ $field_name ] );
if ( is_array( $data ) ) {
$data = array_map( [ 'WPSEO_Utils', 'sanitize_text_field' ], $data );
if ( is_string( $data ) ) {
$data = ( $key !== 'canonical' ) ? WPSEO_Utils::sanitize_text_field( $data ) : WPSEO_Utils::sanitize_url( $data );
// Reset options when no entry is present with multiselect - only applies to `meta-robots-adv` currently.
if ( ! isset( $_POST[ $field_name ] ) && ( $meta_box['type'] === 'multiselect' ) ) {
WPSEO_Meta::set_value( $key, $data, $post_id );
do_action( 'wpseo_saved_postdata' );
* Determines if the given meta value key is disabled.
* @param string $key The key of the meta value.
* @return bool Whether the given meta value key is disabled.
public function is_meta_value_disabled( $key ) {
if ( $key === 'linkdex' && ! $this->seo_analysis->is_enabled() ) {
if ( $key === 'content_score' && ! $this->readability_analysis->is_enabled() ) {
if ( $key === 'inclusive_language_score' && ! $this->inclusive_language_analysis->is_enabled() ) {
* Enqueues all the needed JS and CSS.
* @todo [JRF => whomever] Create css/metabox-mp6.css file and add it to the below allowed colors array when done.
public function enqueue() {
$asset_manager = new WPSEO_Admin_Asset_Manager();
$is_editor = self::is_post_overview( $pagenow ) || self::is_post_edit( $pagenow );
if ( self::is_post_overview( $pagenow ) ) {
$asset_manager->enqueue_style( 'edit-page' );
$asset_manager->enqueue_script( 'edit-page' );
/* Filter 'wpseo_always_register_metaboxes_on_admin' documented in wpseo-main.php */
if ( ( $is_editor === false && apply_filters( 'wpseo_always_register_metaboxes_on_admin', false ) === false ) || $this->display_metabox() === false ) {
$post_id = get_queried_object_id();
// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Reason: We are not processing form information.
if ( empty( $post_id ) && isset( $_GET['post'] ) && is_string( $_GET['post'] ) ) {
// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Reason: We are not processing form information.
$post_id = sanitize_text_field( wp_unslash( $_GET['post'] ) );
// Enqueue files needed for upload functionality.
wp_enqueue_media( [ 'post' => $post_id ] );
$asset_manager->enqueue_style( 'metabox-css' );
$asset_manager->enqueue_style( 'scoring' );
$asset_manager->enqueue_style( 'monorepo' );
$asset_manager->enqueue_style( 'ai-generator' );
$is_block_editor = WP_Screen::get()->is_block_editor();
$post_edit_handle = 'post-edit';
if ( ! $is_block_editor ) {
$post_edit_handle = 'post-edit-classic';
$asset_manager->enqueue_script( $post_edit_handle );
$asset_manager->enqueue_style( 'admin-css' );
* Removes the emoji script as it is incompatible with both React and any
* contenteditable fields.
remove_action( 'admin_print_scripts', 'print_emoji_detection_script' );
$asset_manager->localize_script( $post_edit_handle, 'wpseoAdminL10n', WPSEO_Utils::get_admin_l10n() );
'no_parent_text' => __( '(no parent)', 'wordpress-seo' ),
'replace_vars' => $this->get_replace_vars(),
'hidden_replace_vars' => $this->get_hidden_replace_vars(),
'recommended_replace_vars' => $this->get_recommended_replace_vars(),
'scope' => $this->determine_scope(),
'has_taxonomies' => $this->current_post_type_has_taxonomies(),
'wpseo_shortcode_tags' => $this->get_valid_shortcode_tags(),
'wpseo_filter_shortcodes_nonce' => wp_create_nonce( 'wpseo-filter-shortcodes' ),
'url' => YoastSEO()->helpers->asset->get_asset_url( 'yoast-seo-analysis-worker' ),
'dependencies' => YoastSEO()->helpers->asset->get_dependency_urls_by_handle( 'yoast-seo-analysis-worker' ),
'keywords_assessment_url' => YoastSEO()->helpers->asset->get_asset_url( 'yoast-seo-used-keywords-assessment' ),
'log_level' => WPSEO_Utils::get_analysis_worker_log_level(),
$alert_dismissal_action = YoastSEO()->classes->get( Alert_Dismissal_Action::class );
$dismissed_alerts = $alert_dismissal_action->all_dismissed();
$woocommerce_conditional = new WooCommerce_Conditional();
$woocommerce_active = $woocommerce_conditional->is_met();
$wpseo_plugin_availability_checker = new WPSEO_Plugin_Availability();
$woocommerce_seo_file = 'wpseo-woocommerce/wpseo-woocommerce.php';
$woocommerce_seo_active = $wpseo_plugin_availability_checker->is_active( $woocommerce_seo_file );
// @todo replace this translation with JavaScript translations.
'media' => [ 'choose_image' => __( 'Use Image', 'wordpress-seo' ) ],
'metabox' => $this->get_metabox_script_data(),
'userLanguageCode' => WPSEO_Language_Utils::get_language( get_user_locale() ),
'isBlockEditor' => $is_block_editor,
'postStatus' => get_post_status( $post_id ),
'postType' => get_post_type( $post_id ),
'usedKeywordsNonce' => wp_create_nonce( 'wpseo-keyword-usage-and-post-types' ),
'plugins' => $plugins_script_data,
'worker' => $worker_script_data,
'dismissedAlerts' => $dismissed_alerts,
'currentPromotions' => YoastSEO()->classes->get( Promotion_Manager::class )->get_current_promotions(),
'webinarIntroBlockEditorUrl' => WPSEO_Shortlinker::get( 'https://yoa.st/webinar-intro-block-editor' ),
'blackFridayBlockEditorUrl' => ( YoastSEO()->classes->get( Promotion_Manager::class )->is( 'black-friday-2023-checklist' ) ) ? WPSEO_Shortlinker::get( 'https://yoa.st/black-friday-checklist' ) : '',
'isJetpackBoostActive' => ( $is_block_editor ) ? YoastSEO()->classes->get( Jetpack_Boost_Active_Conditional::class )->is_met() : false,
'isJetpackBoostNotPremium' => ( $is_block_editor ) ? YoastSEO()->classes->get( Jetpack_Boost_Not_Premium_Conditional::class )->is_met() : false,
'isWooCommerceSeoActive' => $woocommerce_seo_active,
'isWooCommerceActive' => $woocommerce_active,
'woocommerceUpsell' => get_post_type( $post_id ) === 'product' && ! $woocommerce_seo_active && $woocommerce_active,
'linkParams' => WPSEO_Shortlinker::get_query_params(),
'pluginUrl' => plugins_url( '', WPSEO_FILE ),
'wistiaEmbedPermission' => YoastSEO()->classes->get( Wistia_Embed_Permission_Repository::class )->get_value_for_user( get_current_user_id() ),
if ( post_type_supports( get_post_type(), 'thumbnail' ) ) {
$asset_manager->enqueue_style( 'featured-image' );
// @todo replace this translation with JavaScript translations.
$script_data['featuredImage'] = [
'featured_image_notice' => __( 'SEO issue: The featured image should be at least 200 by 200 pixels to be picked up by Facebook and other social media sites.', 'wordpress-seo' ),
$asset_manager->localize_script( $post_edit_handle, 'wpseoScriptData', $script_data );
$asset_manager->enqueue_user_language_script();
* Returns post in metabox context.
* @return WP_Post|array<string|int|bool>
protected function get_metabox_post() {
if ( $this->post !== null ) {
// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Reason: We are not processing form information.
if ( isset( $_GET['post'] ) && is_string( $_GET['post'] ) ) {
// phpcs:ignore WordPress.Security.NonceVerification.Recommended,WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Reason: We are not processing form information, Sanitization happens in the validate_int function.
$post_id = (int) WPSEO_Utils::validate_int( wp_unslash( $_GET['post'] ) );
$this->post = get_post( $post_id );
if ( isset( $GLOBALS['post'] ) ) {
$this->post = $GLOBALS['post'];
* Returns an array with shortcode tags for all registered shortcodes.
private function get_valid_shortcode_tags() {
foreach ( $GLOBALS['shortcode_tags'] as $tag => $description ) {
$shortcode_tags[] = $tag;