: str_replace(): Passing null to parameter #2 ($replace) of type array|string is deprecated in
* @package WPSEO\Internals\Options
* This abstract class and its concrete classes implement defaults and value validation for
* all WPSEO options and subkeys within options.
* - Use the normal get_option() to retrieve an option. You will receive a complete array for the option.
* Any subkeys which were not set, will have their default values in place.
* - In other words, you will normally not have to check whether a subkey isset() as they will *always* be set.
* They will also *always* be of the correct variable type.
* The only exception to this are the options with variable option names based on post_type or taxonomy
* as those will not always be available before the taxonomy/post_type is registered.
* (they will be available if a value was set, they won't be if it wasn't as the class won't know
* that a default needs to be injected).
* [Updating/Adding options]
* - For multisite site_options, please use the WPSEO_Options::update_site_option() method.
* - For normal options, use the normal add/update_option() functions. As long as the classes here
* are instantiated, validation for all options and their subkeys will be automatic.
* - On (successful) update of a couple of options, certain related actions will be run automatically.
* - on change of wpseo[yoast_tracking], the cron schedule will be adjusted accordingly
* - on change of wpseo and wpseo_title, some caches will be cleared
* [Important information about add/updating/changing these classes]
* - Make sure that option array key names are unique across options. The WPSEO_Options::get_all()
* method merges most options together. If any of them have non-unique names, even if they
* are in a different option, they *will* overwrite each other.
* - When you add a new array key in an option: make sure you add proper defaults and add the key
* to the validation routine in the proper place or add a new validation case.
* You don't need to do any upgrading as any option returned will always be merged with the
* defaults, so new options will automatically be available.
* If the default value is a string which need translating, add this to the concrete class
* translate_defaults() method.
* - When you remove an array key from an option: if it's important that the option is really removed,
* add the WPSEO_Option::clean_up( $option_name ) method to the upgrade run.
* This will re-save the option and automatically remove the array key no longer in existence.
* - When you rename a sub-option: add it to the clean_option() routine and run that in the upgrade run.
* - When you change the default for an option sub-key, make sure you verify that the validation routine will
* still work the way it should.
* Example: changing a default from '' (empty string) to 'text' with a validation routine with tests
* for an empty string will prevent a user from saving an empty string as the real value. So the
* test for '' with the validation routine would have to be removed in that case.
* - If an option needs specific actions different from defined in this abstract class, you can just overrule
* a method by defining it in the concrete class.
* @todo [JRF => testers] Double check that validation will not cause errors when called
* from upgrade routine (some of the WP functions may not yet be available).
abstract class WPSEO_Option {
* Prefix for override option keys that allow or disallow the option key of the same name.
public const ALLOW_KEY_PREFIX = 'allow_';
* Option name - MUST be set in concrete class and set to public.
* Option group name for use in settings forms.
* Will be set automagically if not set in concrete class (i.e.
* if it conforms to the normal pattern 'yoast' . $option_name . 'options',
* only set in concrete class if it doesn't).
* Whether to include the option in the return for WPSEO_Options::get_all().
* Also determines which options are copied over for ms_(re)set_blog().
public $include_in_all = true;
* Whether this option is only for when the install is multisite.
public $multisite_only = false;
* Array of defaults for the option - MUST be set in concrete class.
* Shouldn't be requested directly, use $this->get_defaults();
* Array of variable option name patterns for the option - if any.
* Set this when the option contains array keys which vary based on post_type
protected $variable_array_key_patterns;
* Array of sub-options which should not be overloaded with multi-site defaults.
* Name for an option higher in the hierarchy to override setting access.
protected $override_option_name;
* Instance of this class.
protected static $instance;
/* *********** INSTANTIATION METHODS *********** */
* Add all the actions and filters for the option.
protected function __construct() {
/* Add filters which get applied to the get_options() results. */
$this->add_default_filters(); // Return defaults if option not set.
$this->add_option_filters(); // Merge with defaults if option *is* set.
if ( $this->multisite_only !== true ) {
* The option validation routines remove the default filters to prevent failing
* to insert an option if it's new. Let's add them back afterwards.
add_action( 'add_option', [ $this, 'add_default_filters_if_same_option' ] ); // Adding back after INSERT.
add_action( 'update_option', [ $this, 'add_default_filters_if_same_option' ] );
add_filter( 'pre_update_option', [ $this, 'add_default_filters_if_not_changed' ], PHP_INT_MAX, 3 );
// Refills the cache when the option has been updated.
add_action( 'update_option_' . $this->option_name, [ 'WPSEO_Options', 'clear_cache' ], 10 );
elseif ( is_multisite() ) {
* The option validation routines remove the default filters to prevent failing
* to insert an option if it's new. Let's add them back afterwards.
* For site_options, this method is not foolproof as these actions are not fired
* on an insert/update failure. Please use the WPSEO_Options::update_site_option() method
* for updating site options to make sure the filters are in place.
add_action( 'add_site_option_' . $this->option_name, [ $this, 'add_default_filters' ] );
add_action( 'update_site_option_' . $this->option_name, [ $this, 'add_default_filters' ] );
add_filter( 'pre_update_site_option_' . $this->option_name, [ $this, 'add_default_filters_if_not_changed' ], PHP_INT_MAX, 3 );
// Refills the cache when the option has been updated.
add_action( 'update_site_option_' . $this->option_name, [ 'WPSEO_Options', 'clear_cache' ], 1, 0 );
* Make sure the option will always get validated, independently of register_setting()
* (only available on back-end).
add_filter( 'sanitize_option_' . $this->option_name, [ $this, 'validate' ] );
/* Register our option for the admin pages */
add_action( 'admin_init', [ $this, 'register_setting' ] );
/* Set option group name if not given */
if ( ! isset( $this->group_name ) || $this->group_name === '' ) {
$this->group_name = 'yoast_' . $this->option_name . '_options';
/* Translate some defaults as early as possible - textdomain is loaded in init on priority 1. */
if ( method_exists( $this, 'translate_defaults' ) ) {
add_action( 'init', [ $this, 'translate_defaults' ], 2 );
* Enrich defaults once custom post types and taxonomies have been registered
* which is normally done on the init action.
* @todo [JRF/testers] Verify that none of the options which are only available after
* enrichment are used before the enriching.
if ( method_exists( $this, 'enrich_defaults' ) ) {
add_action( 'init', [ $this, 'enrich_defaults' ], 99 );
* All concrete classes *must* contain the get_instance method.
* {@internal Unfortunately I can't define it as an abstract as it also *has* to be static...}}
* abstract protected static function get_instance();
* Concrete classes *may* contain a translate_defaults method.
* abstract public function translate_defaults();
* Concrete classes *may* contain an enrich_defaults method to add additional defaults once
* all post_types and taxonomies have been registered.
* abstract public function enrich_defaults();
/* *********** METHODS INFLUENCING get_option() *********** */
* Add filters to make sure that the option default is returned if the option is not set.
public function add_default_filters() {
// Don't change, needs to check for false as could return prio 0 which would evaluate to false.
if ( has_filter( 'default_option_' . $this->option_name, [ $this, 'get_defaults' ] ) === false ) {
add_filter( 'default_option_' . $this->option_name, [ $this, 'get_defaults' ] );
* Adds back the default filters that were removed during validation if the option was changed.
* Checks if this option was changed to prevent constantly checking if filters are present.
* @param string $option_name The option name.
public function add_default_filters_if_same_option( $option_name ) {
if ( $option_name === $this->option_name ) {
$this->add_default_filters();
* Adds back the default filters that were removed during validation if the option was not changed.
* This is because in that case the latter actions are not called and thus the filters are never
* @param mixed $value The current value.
* @param string $option_name The option name.
* @param mixed $old_value The old value.
* @return string The current value.
public function add_default_filters_if_not_changed( $value, $option_name, $old_value ) {
if ( $option_name !== $this->option_name ) {
if ( $value === $old_value || maybe_serialize( $value ) === maybe_serialize( $old_value ) ) {
$this->add_default_filters();
* Validate webmaster tools & Pinterest verification strings.
* @param string $key Key to check, by type of service.
* @param array $dirty Dirty data with the new values.
* @param array $old Old data.
* @param array $clean Clean data by reference, normally the default values.
public function validate_verification_string( $key, $dirty, $old, &$clean ) {
if ( isset( $dirty[ $key ] ) && $dirty[ $key ] !== '' ) {
if ( strpos( $meta, 'content=' ) ) {
// Make sure we only have the real key, not a complete meta tag.
preg_match( '`content=([\'"])?([^\'"> ]+)(?:\1|[ />])`', $meta, $match );
if ( isset( $match[2] ) ) {
$meta = sanitize_text_field( $meta );
$regex = '`^[A-Fa-f0-9_-]+$`';
$regex = '`^[A-Za-z0-9_-]+$`';
$service = 'Baidu Webmaster tools';
$regex = '`^[A-Za-z0-9_-]+$`';
$service = 'Google Webmaster tools';
$service = 'Bing Webmaster tools';
$service = 'Yandex Webmaster tools';
if ( preg_match( $regex, $meta ) ) {
// Restore the previous value, if any.
if ( isset( $old[ $key ] ) && preg_match( $regex, $old[ $key ] ) ) {
$clean[ $key ] = $old[ $key ];
if ( function_exists( 'add_settings_error' ) ) {
$this->group_name, // Slug title of the setting.
$key, // Suffix-ID for the error message box. WordPress prepends `setting-error-`.
/* translators: 1: Verification string from user input; 2: Service name. */
sprintf( __( '%1$s does not seem to be a valid %2$s verification string. Please correct.', 'wordpress-seo' ), '<strong>' . esc_html( $meta ) . '</strong>', $service ), // The error message.
'error' // CSS class for the WP notice, either the legacy 'error' / 'updated' or the new `notice-*` ones.
Yoast_Input_Validation::add_dirty_value_to_settings_errors( $key, $meta );
* Validates an option as a valid URL. Prints out a WordPress settings error
* notice if the URL is invalid.
* @param string $key Key to check, by type of URL setting.
* @param array $dirty Dirty data with the new values.
* @param array $old Old data.
* @param array $clean Clean data by reference, normally the default values.
public function validate_url( $key, $dirty, $old, &$clean ) {
if ( isset( $dirty[ $key ] ) && $dirty[ $key ] !== '' ) {
$submitted_url = trim( $dirty[ $key ] );
$validated_url = filter_var( WPSEO_Utils::sanitize_url( $submitted_url ), FILTER_VALIDATE_URL );
if ( $validated_url === false ) {
if ( function_exists( 'add_settings_error' ) ) {
// Slug title of the setting.
// Suffix-ID for the error message box. WordPress prepends `setting-error-`.
/* translators: %s expands to an invalid URL. */
__( '%s does not seem to be a valid url. Please correct.', 'wordpress-seo' ),
'<strong>' . esc_url( $submitted_url ) . '</strong>'
// Restore the previous URL value, if any.
if ( isset( $old[ $key ] ) && $old[ $key ] !== '' ) {
$url = WPSEO_Utils::sanitize_url( $old[ $key ] );
Yoast_Input_Validation::add_dirty_value_to_settings_errors( $key, $submitted_url );
// The URL format is valid, let's sanitize it.
$url = WPSEO_Utils::sanitize_url( $validated_url );
* Remove the default filters.
* Called from the validate() method to prevent failure to add new options.
public function remove_default_filters() {
remove_filter( 'default_option_' . $this->option_name, [ $this, 'get_defaults' ] );
* Get the enriched default value for an option.
* Checks if the concrete class contains an enrich_defaults() method and if so, runs it.
* {@internal The enrich_defaults method is used to set defaults for variable array keys
* in an option, such as array keys depending on post_types and/or taxonomies.}}
public function get_defaults() {
if ( method_exists( $this, 'translate_defaults' ) ) {
$this->translate_defaults();
if ( method_exists( $this, 'enrich_defaults' ) ) {
$this->enrich_defaults();
return apply_filters( 'wpseo_defaults', $this->defaults, $this->option_name );
* Add filters to make sure that the option is merged with its defaults before being returned.
public function add_option_filters() {
// Don't change, needs to check for false as could return prio 0 which would evaluate to false.
if ( has_filter( 'option_' . $this->option_name, [ $this, 'get_option' ] ) === false ) {
add_filter( 'option_' . $this->option_name, [ $this, 'get_option' ] );
* Remove the option filters.
* Called from the clean_up methods to make sure we retrieve the original old option.
public function remove_option_filters() {
remove_filter( 'option_' . $this->option_name, [ $this, 'get_option' ] );
* Merge an option with its default values.
* This method should *not* be called directly!!! It is only meant to filter the get_option() results.
* @param mixed $options Option value.
* @return mixed Option merged with the defaults for that option.
public function get_option( $options = null ) {
$filtered = $this->array_filter_merge( $options );
* If the option contains variable option keys, make sure we don't remove those settings
* - even if the defaults are not complete yet.
* Unfortunately this means we also won't be removing the settings for post types or taxonomies
* which are no longer in the WP install, but rather that than the other way around.
if ( isset( $this->variable_array_key_patterns ) ) {
$filtered = $this->retain_variable_keys( $options, $filtered );
It is recommended that you Edit text format, this type of Fix handles quite a lot in one request
