<form rel="<?php echo esc_attr( $display_type_name ); ?>"
		class="<?php echo esc_attr( $css_class ); ?>"
		method='POST'
		action='<?php echo esc_url( isset( $_SERVER['REQUEST_URI'] ) ? sanitize_text_field( wp_unslash( $_SERVER['REQUEST_URI'] ) ) : '' ); // esc_url + sanitize_text_field: REQUEST_URI is attacker-controllable; esc_url blocks javascript:/data: schemes and sanitize_text_field strips control chars before reflection. ?>'
		data-defaults="<?php print esc_attr( wp_json_encode( $defaults ) ); ?>">
	<?php
	// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Content is generated by internal form renderer
	echo $settings;
	?>
</form>