Tweak: Added more escaping

[KingYes]

✨ PR Description

1. Problem & Context

Security audit: systematically escaping all user-facing output and sanitizing $_REQUEST/($_SERVER inputs across the codebase. Promotes EscapeOutput violations from warnings to CI errors.

2. What Changed (Where)

File	Changes
aryo-activity-log.php	Wrapped sprintf() calls in esc_html() for error messages
class-aal-activity-log-list-table.php	Added esc_attr() on nonce, esc_html() on export buttons, refactored filter dropdowns to use printf() with proper escaping
class-aal-admin-ui.php	Escaped page slug, changed _ex() to esc_html_x()
class-aal-api.php	Sanitized $_SERVER access with sanitize_text_field(wp_unslash())
class-aal-settings.php	Added nonce to AJAX, escaped all form outputs (inputs, textareas, labels), sanitized $_REQUEST keys
class-aal-maintenance.php, class-aal-notifications.php	Escaped error messages in wp_die(), trigger_error()
abstract-class-aal-notification-base.php	Escaped description output
ruleset.xml	Elevated WordPress.Security.EscapeOutput to error severity; other Security sniffs remain warnings

3. How It Works

Follows WordPress escaping hierarchy: context-specific functions (esc_html, esc_attr, esc_url, esc_js) for output; sanitize_* + wp_unslash for input. AJAX handlers validated with check_ajax_referer + permission checks. Refactored sprintf+echo patterns to printf with proper escaping to prevent double-escaping.

4. Risks

Low risk—primarily defensive hardening. Verify AJAX nonce flow (aalSettings.nonce injection in settings.js) matches handler expectations. Check that escaped output doesn't break any dynamic JS selectors or data attributes in filter dropdowns.

Generated by LinearB AI and added by gitStream.
_{AI-generated content may contain inaccuracies. Please verify before using.
💡 Tip: You can customize your AI Description using Guidelines Learn how}