From 5c1f7f43ce295a1adaa64be5053cc3f733acc836 Mon Sep 17 00:00:00 2001
From: Matt Batchelder <matt@buzzbee.dev>
Date: Sun, 5 Apr 2026 20:58:12 -0400
Subject: [PATCH] feat: Improve email link sanitization and refactor platform
 row rendering logic

---
 theme/blocks/index.php | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/theme/blocks/index.php b/theme/blocks/index.php
index d309b0b..c6e4d2c 100644
--- a/theme/blocks/index.php
+++ b/theme/blocks/index.php
@@ -1114,7 +1114,7 @@ function oribi_render_contact_section($a)
             <div class="contact-info">
                 <h2><?php echo wp_kses_post($a['heading']); ?></h2>
                 <p class="lead"><?php echo wp_kses_post($a['lead']); ?></p>
-                <div class="contact-method"><div class="contact-method-icon"><i class="fas fa-envelope" aria-hidden="true"></i></div><div><div class="contact-method-label">Email Us</div><div class="contact-method-value"><a href="mailto:<?php echo esc_attr($a['email']); ?>"><?php echo esc_html($a['email']); ?></a></div></div></div>
+                <div class="contact-method"><div class="contact-method-icon"><i class="fas fa-envelope" aria-hidden="true"></i></div><div><div class="contact-method-label">Email Us</div><div class="contact-method-value"><a href="<?php echo esc_url( 'mailto:' . sanitize_email( $a['email'] ) ); ?>"><?php echo esc_html($a['email']); ?></a></div></div></div>
                 <div class="contact-method"><div class="contact-method-icon"><i class="fas fa-headset" aria-hidden="true"></i></div><div><div class="contact-method-label">Existing Customer Support</div><div class="contact-method-value"><a href="<?php echo esc_url($a['supportUrl']); ?>" target="_blank" rel="noopener">Open a Support Ticket</a></div></div></div>
                 <div class="contact-method"><div class="contact-method-icon"><i class="fas fa-globe" aria-hidden="true"></i></div><div><div class="contact-method-label">Client Portal</div><div class="contact-method-value"><a href="<?php echo esc_url($a['portalUrl']); ?>" target="_blank" rel="noopener"><?php echo esc_html(wp_parse_url($a['portalUrl'], PHP_URL_HOST)); ?></a></div></div></div>
                 <div class="contact-method"><div class="contact-method-icon"><i class="fas fa-map-marker-alt" aria-hidden="true"></i></div><div><div class="contact-method-label">Location</div><div class="contact-method-value"><?php echo esc_html($a['location']); ?></div></div></div>
@@ -1844,7 +1844,7 @@ function oribi_render_platform_section($a, $content)
 /* ── Platform Row (child - renders one service row) ────────────────────────── */
 function oribi_render_camera_animation()
 {
-    return <<<'HTML'
+    ob_start(); ?>
 <div class="ve-stage" aria-hidden="true"><svg viewBox="0 0 540 360" xmlns="http://www.w3.org/2000/svg" class="ve-svg" role="img" aria-label="Animated video editor timeline">
   <defs>
     <clipPath id="ve-preview-clip">
@@ -2042,7 +2042,7 @@ function oribi_render_camera_animation()
   <!-- Timecode display -->
   <text id="ve-timecode" x="36" y="230" fill="#8a8e98" font-size="8" font-family="monospace">0:00</text>
 </svg></div>
-HTML;
+<?php return ob_get_clean();
 }
 
 
@@ -3625,6 +3625,14 @@ function oribi_render_platform_row($a)
         $visual_html = oribi_render_icon($a['visual'] ?? '');
         $visual_cls = 'platform-visual';
     }
+    return oribi_render_platform_row_html( $rev, $a, $visual_cls, $visual_html );
+}
+
+function oribi_render_platform_row_html( $rev, $a, $visual_cls, $visual_html ) {
+    ob_start(); ?>
+<div class="platform-row<?php echo esc_attr($rev); ?>">
+    <div class="platform-text">
+        <h3><?php echo wp_kses_post($a['heading']); ?></h3>
         <p><?php echo wp_kses_post($a['description']); ?></p>
         <?php if (!empty($a['btnUrl'])): ?>
         <a href="<?php echo esc_url($a['btnUrl']); ?>" class="btn btn-outline mt-3"><?php echo esc_html($a['btnText'] ?? 'Learn More'); ?> &rarr;</a>