[Summary view] [Print] [Text view]

   1  <?php
   2  /**
   3   * Custom CSS
   4   *
   5   * @package WordPress
   6   * @subpackage Twenty_Twenty_One
   7   * @since Twenty Twenty-One 1.0
   8   */
   9  
  10  /**
  11   * Generate CSS.
  12   *
  13   * @since Twenty Twenty-One 1.0
  14   *
  15   * @param string $selector The CSS selector.
  16   * @param string $style    The CSS style.
  17   * @param string $value    The CSS value.
  18   * @param string $prefix   The CSS prefix.
  19   * @param string $suffix   The CSS suffix.
  20   * @param bool   $display  Print the styles.
  21   * @return string
  22   */
  23  function twenty_twenty_one_generate_css( $selector, $style, $value, $prefix = '', $suffix = '', $display = true ) {
  24  
  25      // Bail early if there is no $selector elements or properties and $value.
  26      if ( ! $value || ! $selector ) {
  27          return '';
  28      }
  29  
  30      $css = sprintf( '%s { %s: %s; }', $selector, $style, $prefix . $value . $suffix );
  31  
  32      if ( $display ) {
  33          /*
  34           * Note to reviewers: $css contains auto-generated CSS.
  35           * It is included inside <style> tags and can only be interpreted as CSS on the browser.
  36           * Using wp_strip_all_tags() here is sufficient escaping to avoid
  37           * malicious attempts to close </style> and open a <script>.
  38           */
  39          echo wp_strip_all_tags( $css ); // phpcs:ignore WordPress.Security.EscapeOutput
  40      }
  41      return $css;
  42  }