From 6a29c3b1ee6d470e1d6f56d2522e3f1e257b6f6a Mon Sep 17 00:00:00 2001
From: savvasha <savvasha@hotmail.com>
Date: Sat, 6 Nov 2021 08:48:09 +0200
Subject: [PATCH] Escape output vars from admin meta-boxes (#2)

---
 .../class-sp-meta-box-event-results.php       | 14 ++++++-------
 .../class-sp-meta-box-event-shortcode.php     |  2 +-
 .../class-sp-meta-box-event-specs.php         |  4 ++--
 .../class-sp-meta-box-event-teams.php         |  2 +-
 .../class-sp-meta-box-event-video.php         |  2 +-
 .../class-sp-meta-box-list-data.php           | 20 +++++++++----------
 .../class-sp-meta-box-list-details.php        | 10 +++++-----
 .../class-sp-meta-box-list-format.php         |  2 +-
 .../class-sp-meta-box-metric-details.php      |  4 ++--
 .../class-sp-meta-box-outcome-details.php     |  8 ++++----
 .../class-sp-meta-box-performance-details.php |  8 ++++----
 .../class-sp-meta-box-player-columns.php      |  2 +-
 .../class-sp-meta-box-player-details.php      |  6 +++---
 .../class-sp-meta-box-player-metrics.php      |  4 ++--
 14 files changed, 44 insertions(+), 44 deletions(-)

diff --git a/includes/admin/post-types/meta-boxes/class-sp-meta-box-event-results.php b/includes/admin/post-types/meta-boxes/class-sp-meta-box-event-results.php
index 4acb820d..a76b4b45 100644
--- a/includes/admin/post-types/meta-boxes/class-sp-meta-box-event-results.php
+++ b/includes/admin/post-types/meta-boxes/class-sp-meta-box-event-results.php
@@ -243,14 +243,14 @@ class SP_Meta_Box_Event_Results {
 							<?php _e( 'Team', 'sportspress' ); ?>
 						</th>
 						<?php foreach ( $columns as $key => $label ): ?>
-							<th class="column-<?php echo $key; ?>">
+							<th class="column-<?php echo esc_attr( $key ); ?>">
 								<?php if ( $has_checkboxes ): ?>
-									<label for="sp_result_columns_<?php echo $key; ?>">
-										<input type="checkbox" name="sp_result_columns[]" value="<?php echo $key; ?>" id="sp_result_columns_<?php echo $key; ?>" <?php checked( ! is_array( $usecolumns ) || in_array( $key, $usecolumns ) ); ?>>
-										<?php echo $label; ?>
+									<label for="sp_result_columns_<?php echo esc_attr( $key ); ?>">
+										<input type="checkbox" name="sp_result_columns[]" value="<?php echo esc_attr( $key ); ?>" id="sp_result_columns_<?php echo esc_attr( $key ); ?>" <?php checked( ! is_array( $usecolumns ) || in_array( $key, $usecolumns ) ); ?>>
+										<?php echo esc_attr( $label ); ?>
 									</label>
 								<?php else: ?>
-									<?php echo $label; ?>
+									<?php echo esc_attr( $label ); ?>
 								<?php endif; ?>
 							</th>
 						<?php endforeach; ?>
@@ -265,14 +265,14 @@ class SP_Meta_Box_Event_Results {
 					foreach ( $data as $team_id => $team_results ):
 						if ( ! $team_id || -1 == $team_id ) continue;
 						?>
-						<tr class="sp-row sp-post<?php if ( $i % 2 == 0 ) echo ' alternate'; ?>" data-team="<?php echo $team_id; ?>">
+						<tr class="sp-row sp-post<?php if ( $i % 2 == 0 ) echo ' alternate'; ?>" data-team="<?php echo esc_attr( $team_id ); ?>">
 							<td>
 								<?php echo get_the_title( $team_id ); ?>
 							</td>
 							<?php foreach( $columns as $column => $label ):
 								$value = sp_array_value( $team_results, $column, '' );
 								?>
-								<td><input class="sp-team-<?php echo $column; ?>-input" type="text" name="sp_results[<?php echo $team_id; ?>][<?php echo $column; ?>]" value="<?php echo esc_attr( $value ); ?>"<?php if ( in_array( $column, $auto_columns ) ) { ?> placeholder="<?php _e( '(Auto)', 'sportspress' ); ?>"<?php } ?> /></td>
+								<td><input class="sp-team-<?php echo esc_attr( $column ); ?>-input" type="text" name="sp_results[<?php echo esc_attr( $team_id ); ?>][<?php echo esc_attr( $column ); ?>]" value="<?php echo esc_attr( $value ); ?>"<?php if ( in_array( $column, $auto_columns ) ) { ?> placeholder="<?php _e( '(Auto)', 'sportspress' ); ?>"<?php } ?> /></td>
 							<?php endforeach; ?>
 							<td>
 								<?php
diff --git a/includes/admin/post-types/meta-boxes/class-sp-meta-box-event-shortcode.php b/includes/admin/post-types/meta-boxes/class-sp-meta-box-event-shortcode.php
index 11cecc62..a3d275ab 100644
--- a/includes/admin/post-types/meta-boxes/class-sp-meta-box-event-shortcode.php
+++ b/includes/admin/post-types/meta-boxes/class-sp-meta-box-event-shortcode.php
@@ -35,7 +35,7 @@ class SP_Meta_Box_Event_Shortcode {
 		</p>
 		<?php foreach ( $shortcodes as $id => $label ) { ?>
 		<p>
-			<strong><?php echo $label; ?></strong>
+			<strong><?php echo esc_attr( $label ); ?></strong>
 		</p>
 		<p><input type="text" value="<?php sp_shortcode_template( $id, $post->ID ); ?>" readonly="readonly" class="code widefat"></p>
 		<?php } ?>
diff --git a/includes/admin/post-types/meta-boxes/class-sp-meta-box-event-specs.php b/includes/admin/post-types/meta-boxes/class-sp-meta-box-event-specs.php
index c3f3c54d..56fa82e8 100644
--- a/includes/admin/post-types/meta-boxes/class-sp-meta-box-event-specs.php
+++ b/includes/admin/post-types/meta-boxes/class-sp-meta-box-event-specs.php
@@ -35,8 +35,8 @@ class SP_Meta_Box_Event_Specs {
 		if ( $vars ):
 			foreach ( $vars as $var ):
 			?>
-			<p><strong><?php echo $var->post_title; ?></strong></p>
-			<p><input type="text" name="sp_specs[<?php echo $var->post_name; ?>]" value="<?php echo esc_attr( sp_array_value( $metrics, $var->post_name, '' ) ); ?>" /></p>
+			<p><strong><?php echo esc_attr( $var->post_title ); ?></strong></p>
+			<p><input type="text" name="sp_specs[<?php echo esc_attr( $var->post_name ); ?>]" value="<?php echo esc_attr( sp_array_value( $metrics, $var->post_name, '' ) ); ?>" /></p>
 			<?php
 			endforeach;
 		else:
diff --git a/includes/admin/post-types/meta-boxes/class-sp-meta-box-event-teams.php b/includes/admin/post-types/meta-boxes/class-sp-meta-box-event-teams.php
index d32e11a1..9c08d1b3 100644
--- a/includes/admin/post-types/meta-boxes/class-sp-meta-box-event-teams.php
+++ b/includes/admin/post-types/meta-boxes/class-sp-meta-box-event-teams.php
@@ -101,7 +101,7 @@ class SP_Meta_Box_Event_Teams {
 							$j = 0;
 							foreach ( $tabs as $slug => $tab ) {
 								?>
-								<li class="<?php if ( 0 == $j ) { ?>tabs<?php } ?>"><a href="#<?php echo $slug; ?>-all"><?php echo $tab['label']; ?></a></li>
+								<li class="<?php if ( 0 == $j ) { ?>tabs<?php } ?>"><a href="#<?php echo esc_attr( $slug ); ?>-all"><?php echo esc_attr( $tab['label'] ); ?></a></li>
 								<?php
 								$j++;
 							}
diff --git a/includes/admin/post-types/meta-boxes/class-sp-meta-box-event-video.php b/includes/admin/post-types/meta-boxes/class-sp-meta-box-event-video.php
index d642dd67..806a1826 100644
--- a/includes/admin/post-types/meta-boxes/class-sp-meta-box-event-video.php
+++ b/includes/admin/post-types/meta-boxes/class-sp-meta-box-event-video.php
@@ -29,7 +29,7 @@ class SP_Meta_Box_Event_Video {
 		<?php endif; ?>
 		<fieldset class="sp-video-field hidden">
 			<p><strong><?php _e( 'URL', 'sportspress' ); ?></strong></p>
-			<p><input class="widefat" type="text" name="sp_video" id="sp_video" value="<?php echo $video; ?>"></p>
+			<p><input class="widefat" type="text" name="sp_video" id="sp_video" value="<?php echo esc_url( $video ); ?>"></p>
 			<p><a href="#" class="sp-remove-video"><?php _e( 'Cancel', 'sportspress' ); ?></a></p>
 		</fieldset>
 		<fieldset class="sp-video-adder<?php if ( $video ): ?> hidden<?php endif; ?>">
diff --git a/includes/admin/post-types/meta-boxes/class-sp-meta-box-list-data.php b/includes/admin/post-types/meta-boxes/class-sp-meta-box-list-data.php
index aee140b6..4160fd9c 100644
--- a/includes/admin/post-types/meta-boxes/class-sp-meta-box-list-data.php
+++ b/includes/admin/post-types/meta-boxes/class-sp-meta-box-list-data.php
@@ -64,8 +64,8 @@ class SP_Meta_Box_List_Data {
 						<?php } ?>
 						<?php foreach ( $columns as $key => $label ): ?>
 							<?php if ( in_array( $key, array( 'number', 'team', 'position' ) ) ) continue; ?>
-							<th><label for="sp_columns_<?php echo $key; ?>">
-								<?php echo $label; ?>
+							<th><label for="sp_columns_<?php echo esc_attr( $key ); ?>">
+								<?php echo esc_attr( $label ); ?>
 							</label></th>
 						<?php endforeach; ?>
 					</tr>
@@ -89,7 +89,7 @@ class SP_Meta_Box_List_Data {
 									<td>
 										<?php
 										if ( 'number' == $orderby ) {
-											echo ( $number ? $number : '&nbsp;' );
+											echo ( $number ? esc_attr( $number ) : '&nbsp;' );
 										} else {
 											echo $i + 1;
 										}
@@ -99,11 +99,11 @@ class SP_Meta_Box_List_Data {
 								<td>
 									<?php if ( $show_player_photo ) echo get_the_post_thumbnail( $player_id, 'sportspress-fit-mini' ); ?>
 									<span class="sp-default-value">
-										<span class="sp-default-value-input"><?php echo $default_name; ?></span>
+										<span class="sp-default-value-input"><?php echo esc_attr( $default_name ); ?></span>
 										<a class="dashicons dashicons-edit sp-edit" title="<?php _e( 'Edit', 'sportspress' ); ?>"></a>
 									</span>
 									<span class="hidden sp-custom-value">
-										<input type="text" name="sp_players[<?php echo $player_id; ?>][name]" class="name sp-custom-value-input" value="<?php echo esc_attr( sp_array_value( $player_stats, 'name', '' ) ); ?>" placeholder="<?php echo esc_attr( get_the_title( $player_id ) ); ?>" size="6">
+										<input type="text" name="sp_players[<?php echo esc_attr( $player_id ); ?>][name]" class="name sp-custom-value-input" value="<?php echo esc_attr( sp_array_value( $player_stats, 'name', '' ) ); ?>" placeholder="<?php echo esc_attr( get_the_title( $player_id ) ); ?>" size="6">
 										<a class="button button-secondary sp-cancel"><?php _e( 'Cancel', 'sportspress' ); ?></a>
 										<a class="button button-primary sp-save"><?php _e( 'Save', 'sportspress' ); ?></a>
 									</span>
@@ -158,7 +158,7 @@ class SP_Meta_Box_List_Data {
 									$value = sp_array_value( $player_stats, $column, '' );
 									$placeholder = sp_array_value( sp_array_value( $placeholders, $player_id, array() ), $column, 0 );
 									?>
-									<td><input type="text" name="sp_players[<?php echo $player_id; ?>][<?php echo $column; ?>]" value="<?php echo esc_attr( $value ); ?>" placeholder="<?php echo esc_attr( $placeholder ); ?>" data-placeholder="<?php echo esc_attr( $placeholder ); ?>" data-matrix="<?php echo $player_id; ?>_<?php echo $column; ?>" data-adjustment="<?php echo sp_array_value( sp_array_value( $adjustments, $player_id, array() ), $column, 0 ); ?>" /></td>
+									<td><input type="text" name="sp_players[<?php echo esc_attr( $player_id ); ?>][<?php echo esc_attr( $column ); ?>]" value="<?php echo esc_attr( $value ); ?>" placeholder="<?php echo esc_attr( $placeholder ); ?>" data-placeholder="<?php echo esc_attr( $placeholder ); ?>" data-matrix="<?php echo esc_attr( $player_id ); ?>_<?php echo esc_attr( $column ); ?>" data-adjustment="<?php echo sp_array_value( sp_array_value( $adjustments, $player_id, array() ), $column, 0 ); ?>" /></td>
 								<?php endforeach; ?>
 							</tr>
 							<?php
@@ -167,7 +167,7 @@ class SP_Meta_Box_List_Data {
 					else:
 					?>
 					<tr class="sp-row alternate">
-						<td colspan="<?php $colspan = sizeof( $columns ) + ( apply_filters( 'sportspress_has_teams', true ) ? 3 : 2 ); echo $colspan; ?>">
+						<td colspan="<?php $colspan = sizeof( $columns ) + ( apply_filters( 'sportspress_has_teams', true ) ? 3 : 2 ); echo esc_attr( $colspan ); ?>">
 							<?php printf( __( 'Select %s', 'sportspress' ), __( 'Data', 'sportspress' ) ); ?>
 						</td>
 					</tr>
@@ -184,7 +184,7 @@ class SP_Meta_Box_List_Data {
 						<th>#</th>
 						<th><?php _e( 'Player', 'sportspress' ); ?></th>
 						<?php foreach ( $columns as $key => $label ): if ( in_array( $key, array( 'number', 'team', 'position' ) ) ) continue; ?>
-							<th><?php echo $label; ?></th>
+							<th><?php echo esc_attr( $label ); ?></th>
 						<?php endforeach; ?>
 					</tr>
 				</thead>
@@ -206,7 +206,7 @@ class SP_Meta_Box_List_Data {
 									if ( in_array( $column, array( 'number', 'team', 'position' ) ) ) continue;
 									$value = sp_array_value( sp_array_value( $adjustments, $player_id, array() ), $column, '' );
 									?>
-									<td><input type="text" name="sp_adjustments[<?php echo $player_id; ?>][<?php echo $column; ?>]" value="<?php echo esc_attr( $value ); ?>" placeholder="0" data-matrix="<?php echo $player_id; ?>_<?php echo $column; ?>" /></td>
+									<td><input type="text" name="sp_adjustments[<?php echo esc_attr( $player_id ); ?>][<?php echo esc_attr( $column ); ?>]" value="<?php echo esc_attr( $value ); ?>" placeholder="0" data-matrix="<?php echo esc_attr( $player_id ); ?>_<?php echo esc_attr( $column ); ?>" /></td>
 								<?php endforeach; ?>
 							</tr>
 							<?php
@@ -215,7 +215,7 @@ class SP_Meta_Box_List_Data {
 					else:
 					?>
 					<tr class="sp-row alternate">
-						<td colspan="<?php $colspan = sizeof( $columns ) + 3; echo $colspan; ?>">
+						<td colspan="<?php $colspan = sizeof( $columns ) + 3; echo esc_attr( $colspan ); ?>">
 							<?php printf( __( 'Select %s', 'sportspress' ), __( 'Details', 'sportspress' ) ); ?>
 						</td>
 					</tr>
diff --git a/includes/admin/post-types/meta-boxes/class-sp-meta-box-list-details.php b/includes/admin/post-types/meta-boxes/class-sp-meta-box-list-details.php
index c80956f2..747501d4 100644
--- a/includes/admin/post-types/meta-boxes/class-sp-meta-box-list-details.php
+++ b/includes/admin/post-types/meta-boxes/class-sp-meta-box-list-details.php
@@ -56,9 +56,9 @@ class SP_Meta_Box_List_Details {
 				</p>
 				<div class="sp-date-range">
 					<p class="sp-date-range-absolute">
-						<input type="text" class="sp-datepicker-from" name="sp_date_from" value="<?php echo $date_from ? $date_from : date_i18n( 'Y-m-d' ); ?>" size="10">
+						<input type="text" class="sp-datepicker-from" name="sp_date_from" value="<?php echo $date_from ? esc_attr( $date_from ) : date_i18n( 'Y-m-d' ); ?>" size="10">
 						:
-						<input type="text" class="sp-datepicker-to" name="sp_date_to" value="<?php echo $date_to ? $date_to : date_i18n( 'Y-m-d' ); ?>" size="10">
+						<input type="text" class="sp-datepicker-to" name="sp_date_to" value="<?php echo $date_to ? esc_attr( $date_to ) : date_i18n( 'Y-m-d' ); ?>" size="10">
 					</p>
 
 					<p class="sp-date-range-relative">
@@ -106,9 +106,9 @@ class SP_Meta_Box_List_Details {
 				<select id="sp_nationality" name="sp_nationality[]" data-placeholder="<?php printf( __( 'Select %s', 'sportspress' ), __( 'Nationality', 'sportspress' ) ); ?>" class="widefat chosen-select<?php if ( is_rtl() ): ?> chosen-rtl<?php endif; ?>" multiple="multiple">
 					<option value=""></option>
 					<?php foreach ( $continents as $continent => $countries ): ?>
-						<optgroup label="<?php echo $continent; ?>">
+						<optgroup label="<?php echo esc_attr( $continent ); ?>">
 							<?php foreach ( $countries as $code => $country ): ?>
-								<option value="<?php echo $code; ?>" <?php selected ( in_array( $code, $nationalities ) ); ?>><?php echo $country; ?></option>
+								<option value="<?php echo esc_attr( $code ); ?>" <?php selected ( in_array( $code, $nationalities ) ); ?>><?php echo esc_attr( $country ); ?></option>
 							<?php endforeach; ?>
 						</optgroup>
 					<?php endforeach; ?>
@@ -173,7 +173,7 @@ class SP_Meta_Box_List_Details {
 			} else {
 				?>
 				<p><strong><?php _e( 'Display', 'sportspress' ); ?></strong></p>
-				<p><input name="sp_number" id="sp_number" type="number" step="1" min="0" class="small-text" placeholder="<?php _e( 'All', 'sportspress' ); ?>" value="<?php echo $number; ?>"> <?php _e( 'players', 'sportspress' ); ?></p>
+				<p><input name="sp_number" id="sp_number" type="number" step="1" min="0" class="small-text" placeholder="<?php _e( 'All', 'sportspress' ); ?>" value="<?php echo esc_attr( $number ); ?>"> <?php _e( 'players', 'sportspress' ); ?></p>
 				<?php
 			}
 			?>
diff --git a/includes/admin/post-types/meta-boxes/class-sp-meta-box-list-format.php b/includes/admin/post-types/meta-boxes/class-sp-meta-box-list-format.php
index 5b60cb70..824cdb3f 100644
--- a/includes/admin/post-types/meta-boxes/class-sp-meta-box-list-format.php
+++ b/includes/admin/post-types/meta-boxes/class-sp-meta-box-list-format.php
@@ -24,7 +24,7 @@ class SP_Meta_Box_List_Format {
 		?>
 		<div id="post-formats-select">
 			<?php foreach ( SP()->formats->list as $key => $format ): ?>
-				<input type="radio" name="sp_format" class="post-format" id="post-format-<?php echo $key; ?>" value="<?php echo $key; ?>" <?php checked( true, ( $key == 'list' && ! $the_format ) || $the_format == $key ); ?>> <label for="post-format-<?php echo $key; ?>" class="post-format-icon post-format-<?php echo $key; ?>"><?php echo $format; ?></label><br>
+				<input type="radio" name="sp_format" class="post-format" id="post-format-<?php echo esc_attr( $key ); ?>" value="<?php echo esc_attr( $key ); ?>" <?php checked( true, ( $key == 'list' && ! $the_format ) || $the_format == $key ); ?>> <label for="post-format-<?php echo esc_attr( $key ); ?>" class="post-format-icon post-format-<?php echo esc_attr( $key ); ?>"><?php echo esc_attr( $format ); ?></label><br>
 			<?php endforeach; ?>
 		</div>
 		<?php
diff --git a/includes/admin/post-types/meta-boxes/class-sp-meta-box-metric-details.php b/includes/admin/post-types/meta-boxes/class-sp-meta-box-metric-details.php
index 13e82214..42187d42 100644
--- a/includes/admin/post-types/meta-boxes/class-sp-meta-box-metric-details.php
+++ b/includes/admin/post-types/meta-boxes/class-sp-meta-box-metric-details.php
@@ -28,8 +28,8 @@ class SP_Meta_Box_Metric_Details extends SP_Meta_Box_Config {
 		?>
 		<p><strong><?php _e( 'Variable', 'sportspress' ); ?></strong></p>
 		<p>
-			<input name="sp_default_key" type="hidden" id="sp_default_key" value="<?php echo $post->post_name; ?>">
-			<input name="sp_key" type="text" id="sp_key" value="<?php echo $post->post_name; ?>">
+			<input name="sp_default_key" type="hidden" id="sp_default_key" value="<?php echo esc_attr( $post->post_name ); ?>">
+			<input name="sp_key" type="text" id="sp_key" value="<?php echo esc_attr( $post->post_name ); ?>">
 		</p>
 		<p>
 			<strong><?php _e( 'Visible', 'sportspress' ); ?></strong>
diff --git a/includes/admin/post-types/meta-boxes/class-sp-meta-box-outcome-details.php b/includes/admin/post-types/meta-boxes/class-sp-meta-box-outcome-details.php
index b30e05fd..8e44d26a 100644
--- a/includes/admin/post-types/meta-boxes/class-sp-meta-box-outcome-details.php
+++ b/includes/admin/post-types/meta-boxes/class-sp-meta-box-outcome-details.php
@@ -40,17 +40,17 @@ class SP_Meta_Box_Outcome_Details extends SP_Meta_Box_Config {
 		?>
 		<p><strong><?php _e( 'Variable', 'sportspress' ); ?></strong></p>
 		<p>
-			<input name="sp_default_key" type="hidden" id="sp_default_key" value="<?php echo $post->post_name; ?>">
-			<input name="sp_key" type="text" id="sp_key" value="<?php echo $post->post_name; ?>"<?php if ( $readonly ) { ?> readonly="readonly"<?php } ?>>
+			<input name="sp_default_key" type="hidden" id="sp_default_key" value="<?php echo esc_attr( $post->post_name ); ?>">
+			<input name="sp_key" type="text" id="sp_key" value="<?php echo esc_attr( $post->post_name ); ?>"<?php if ( $readonly ) { ?> readonly="readonly"<?php } ?>>
 		</p>
 		<p><strong><?php _e( 'Abbreviation', 'sportspress' ); ?></strong></p>
 		<p>
-			<input name="sp_abbreviation" type="text" id="sp_abbreviation" value="<?php echo $abbreviation; ?>" placeholder="<?php echo sp_substr( $post->post_title, 0, 1 ); ?>">
+			<input name="sp_abbreviation" type="text" id="sp_abbreviation" value="<?php echo esc_attr( $abbreviation ); ?>" placeholder="<?php echo sp_substr( $post->post_title, 0, 1 ); ?>">
 		</p>
 		<p><strong><?php _e( 'Color', 'sportspress' ); ?></strong></p>
 		<p>
 			<div class="sp-color-box">
-				<input name="sp_color" id="sp_color" type="text" value="<?php echo $color; ?>" class="colorpick">
+				<input name="sp_color" id="sp_color" type="text" value="<?php echo esc_attr( $color ); ?>" class="colorpick">
 				<div id="sp_color" class="colorpickdiv"></div>
 		    </div>
 		</p>
diff --git a/includes/admin/post-types/meta-boxes/class-sp-meta-box-performance-details.php b/includes/admin/post-types/meta-boxes/class-sp-meta-box-performance-details.php
index f6a4383d..4ce0b90b 100644
--- a/includes/admin/post-types/meta-boxes/class-sp-meta-box-performance-details.php
+++ b/includes/admin/post-types/meta-boxes/class-sp-meta-box-performance-details.php
@@ -55,12 +55,12 @@ class SP_Meta_Box_Performance_Details extends SP_Meta_Box_Config {
 		?>
 		<p><strong><?php _e( 'Variable', 'sportspress' ); ?></strong></p>
 		<p>
-			<input name="sp_default_key" type="hidden" id="sp_default_key" value="<?php echo $post->post_name; ?>">
-			<input name="sp_key" type="text" id="sp_key" value="<?php echo $post->post_name; ?>"<?php if ( $readonly ) { ?> readonly="readonly"<?php } ?>>
+			<input name="sp_default_key" type="hidden" id="sp_default_key" value="<?php echo esc_attr( $post->post_name ); ?>">
+			<input name="sp_key" type="text" id="sp_key" value="<?php echo esc_attr( $post->post_name ); ?>"<?php if ( $readonly ) { ?> readonly="readonly"<?php } ?>>
 		</p>
 		<p><strong><?php _e( 'Singular', 'sportspress' ); ?></strong></p>
 		<p>
-			<input name="sp_singular" type="text" id="sp_singular" placeholder="<?php echo $post->post_title; ?>" value="<?php echo $singular; ?>">
+			<input name="sp_singular" type="text" id="sp_singular" placeholder="<?php echo esc_attr( $post->post_title ); ?>" value="<?php echo esc_attr( $singular ); ?>">
 		</p>
 		<p><strong><?php _e( 'Category', 'sportspress' ); ?></strong></p>
 		<p class="sp-section-selector">
@@ -87,7 +87,7 @@ class SP_Meta_Box_Performance_Details extends SP_Meta_Box_Config {
 		<div id="sp_precisiondiv">
 			<p><strong><?php _e( 'Decimal Places', 'sportspress' ); ?></strong></p>
 			<p>
-				<input name="sp_precision" type="text" size="4" id="sp_precision" value="<?php echo $precision; ?>" placeholder="0">
+				<input name="sp_precision" type="text" size="4" id="sp_precision" value="<?php echo esc_attr( $precision ); ?>" placeholder="0">
 			</p>
 		</div>
 		<div id="sp_timeddiv">
diff --git a/includes/admin/post-types/meta-boxes/class-sp-meta-box-player-columns.php b/includes/admin/post-types/meta-boxes/class-sp-meta-box-player-columns.php
index 0047a46e..ee50b94f 100644
--- a/includes/admin/post-types/meta-boxes/class-sp-meta-box-player-columns.php
+++ b/includes/admin/post-types/meta-boxes/class-sp-meta-box-player-columns.php
@@ -26,7 +26,7 @@ class SP_Meta_Box_Player_Columns {
 			<?php if ( $tabs ) { ?>
 			<ul id="sp_column-tabs" class="sp-tab-bar category-tabs">
 				<?php foreach ( $tabs as $index => $post_type ) { $object = get_post_type_object( $post_type ); ?>
-				<li class="<?php if ( 0 == $index ) { ?>tabs<?php } ?>"><a href="#<?php echo $post_type; ?>-all"><?php echo $object->labels->menu_name; ?></a></li>
+				<li class="<?php if ( 0 == $index ) { ?>tabs<?php } ?>"><a href="#<?php echo esc_attr( $post_type ); ?>-all"><?php echo esc_attr( $object->labels->menu_name ); ?></a></li>
 				<?php } ?>
 			</ul>
 			<?php
diff --git a/includes/admin/post-types/meta-boxes/class-sp-meta-box-player-details.php b/includes/admin/post-types/meta-boxes/class-sp-meta-box-player-details.php
index 8574e48f..129ea771 100644
--- a/includes/admin/post-types/meta-boxes/class-sp-meta-box-player-details.php
+++ b/includes/admin/post-types/meta-boxes/class-sp-meta-box-player-details.php
@@ -77,15 +77,15 @@ class SP_Meta_Box_Player_Details {
 		?>
 
 		<p><strong><?php _e( 'Squad Number', 'sportspress' ); ?></strong></p>
-		<p><input type="text" size="4" id="sp_number" name="sp_number" value="<?php echo $number; ?>"></p>
+		<p><input type="text" size="4" id="sp_number" name="sp_number" value="<?php echo esc_attr( $number ); ?>"></p>
 
 		<p><strong><?php _e( 'Nationality', 'sportspress' ); ?></strong></p>
 		<p><select id="sp_nationality" name="sp_nationality[]" data-placeholder="<?php printf( __( 'Select %s', 'sportspress' ), __( 'Nationality', 'sportspress' ) ); ?>" class="widefat chosen-select<?php if ( is_rtl() ): ?> chosen-rtl<?php endif; ?>" multiple="multiple">
 			<option value=""></option>
 			<?php foreach ( $continents as $continent => $countries ): ?>
-				<optgroup label="<?php echo $continent; ?>">
+				<optgroup label="<?php echo esc_attr( $continent ); ?>">
 					<?php foreach ( $countries as $code => $country ): ?>
-						<option value="<?php echo $code; ?>" <?php selected ( in_array( $code, $nationalities ) ); ?>><?php echo $country; ?></option>
+						<option value="<?php echo esc_attr( $code ); ?>" <?php selected ( in_array( $code, $nationalities ) ); ?>><?php echo esc_attr( $country ); ?></option>
 					<?php endforeach; ?>
 				</optgroup>
 			<?php endforeach; ?>
diff --git a/includes/admin/post-types/meta-boxes/class-sp-meta-box-player-metrics.php b/includes/admin/post-types/meta-boxes/class-sp-meta-box-player-metrics.php
index 5d9e1367..7aba3b34 100644
--- a/includes/admin/post-types/meta-boxes/class-sp-meta-box-player-metrics.php
+++ b/includes/admin/post-types/meta-boxes/class-sp-meta-box-player-metrics.php
@@ -35,8 +35,8 @@ class SP_Meta_Box_Player_Metrics {
 		if ( $vars ):
 			foreach ( $vars as $var ):
 			?>
-			<p><strong><?php echo $var->post_title; ?></strong></p>
-			<p><input type="text" name="sp_metrics[<?php echo $var->post_name; ?>]" value="<?php echo esc_attr( sp_array_value( $metrics, $var->post_name, '' ) ); ?>" /></p>
+			<p><strong><?php echo esc_attr( $var->post_title ); ?></strong></p>
+			<p><input type="text" name="sp_metrics[<?php echo esc_attr( $var->post_name ); ?>]" value="<?php echo esc_attr( sp_array_value( $metrics, $var->post_name, '' ) ); ?>" /></p>
 			<?php
 			endforeach;
 		else: