<?php
/**
 * FormShield Safe HTML Helper Class
 * 
 * Provides secure HTML sanitization for badge content
 * 
 * @package FormShield
 * @since 1.0.1
 */

// Prevent direct access
if (!defined('ABSPATH')) {
    die('You are not allowed to call this page directly.');
}

class FormShield_Safe {
    
    /**
     * Allowed HTML tags for badge content
     * 
     * @return array Allowed tags and attributes
     */
    public static function allowed_badge_tags() {
        return array(
            'div' => array(
                'id' => true,
                'class' => true,
                'data-formshield' => true,
                'title' => true,
            ),
            'span' => array(
                'class' => true,
                'data-formshield' => true,
                'title' => true,
            ),
            'a' => array(
                'href' => true,
                'class' => true,
                'rel' => true,
                'target' => true,
                'title' => true,
            ),
            'img' => array(
                'src' => true,
                'alt' => true,
                'class' => true,
                'width' => true,
                'height' => true,
                'loading' => true,
            ),
            'strong' => array(),
            'em' => array(),
            'b' => array(),
            'i' => array(),
        );
    }

    /**
     * Get sanitized badge HTML for JavaScript output
     * 
     * @param string $context Form context (e.g., 'Contact Form 7', 'WPForms')
     * @return string Sanitized HTML
     */
    public static function badge_html_for_js( $context ) {
        $html = FormShield::badge_html( $context );
        return wp_kses( $html, self::allowed_badge_tags() );
    }

    /**
     * Get sanitized badge HTML for general output
     * 
     * @param string $context Form context
     * @return string Sanitized HTML
     */
    public static function badge_html_safe( $context ) {
        return self::badge_html_for_js( $context );
    }
}
