From 98530b3f6d5d03ebd4dcdc54c626a3860ea460eb Mon Sep 17 00:00:00 2001
From: Mike Jolley <mike.jolley@me.com>
Date: Mon, 15 Oct 2012 20:25:48 +0100
Subject: [PATCH] [3.2.3] XSS #1575

---
 .../writepanels/variation-admin-html.php      |  54 +--
 .../writepanel-order_downloads.php            |   2 +-
 .../writepanel-product-type-variable.php      | 261 +++++++-------
 .../writepanels/writepanel-product_data.php   | 322 +++++++++---------
 4 files changed, 317 insertions(+), 322 deletions(-)

diff --git a/admin/post-types/writepanels/variation-admin-html.php b/admin/post-types/writepanels/variation-admin-html.php
index f0dfb46d3b3..470e0c4dd9e 100644
--- a/admin/post-types/writepanels/variation-admin-html.php
+++ b/admin/post-types/writepanels/variation-admin-html.php
@@ -3,9 +3,9 @@ if ( ! defined( 'ABSPATH' ) ) exit; // Exit if accessed directly
 ?>
 <div class="woocommerce_variation wc-metabox closed">
 	<h3>
-		<button type="button" class="remove_variation button" rel="<?php echo $variation_id; ?>"><?php _e( 'Remove', 'woocommerce' ); ?></button>
-		<div class="handlediv" title="<?php _e('Click to toggle', 'woocommerce'); ?>"></div>
-		<strong>#<?php echo $variation_id; ?> &mdash; </strong>
+		<button type="button" class="remove_variation button" rel="<?php echo esc_attr( $variation_id ); ?>"><?php _e( 'Remove', 'woocommerce' ); ?></button>
+		<div class="handlediv" title="<?php _e( 'Click to toggle', 'woocommerce' ); ?>"></div>
+		<strong>#<?php echo esc_html( $variation_id ); ?> &mdash; </strong>
 		<?php
 			foreach ( $parent_data['attributes'] as $attribute ) {
 
@@ -17,18 +17,18 @@ if ( ! defined( 'ABSPATH' ) ) exit; // Exit if accessed directly
 				$variation_selected_value = isset( $variation_data[ 'attribute_' . sanitize_title( $attribute['name'] ) ][0] ) ? $variation_data[ 'attribute_' . sanitize_title( $attribute['name'] ) ][0] : '';
 
 				// Name will be something like attribute_pa_color
-				echo '<select name="attribute_' . sanitize_title( $attribute['name'] ) . '[' . $loop . ']"><option value="">' . __( 'Any', 'woocommerce' ) . ' ' . $woocommerce->attribute_label( $attribute['name'] ) . '&hellip;</option>';
+				echo '<select name="attribute_' . sanitize_title( $attribute['name'] ) . '[' . $loop . ']"><option value="">' . __( 'Any', 'woocommerce' ) . ' ' . esc_html( $woocommerce->attribute_label( $attribute['name'] ) ) . '&hellip;</option>';
 
 				// Get terms for attribute taxonomy or value if its a custom attribute
 				if ( $attribute['is_taxonomy'] ) {
 					$post_terms = wp_get_post_terms( $parent_data['id'], $attribute['name'] );
 					foreach ( $post_terms as $term ) {
-						echo '<option ' . selected( $variation_selected_value, $term->slug, false ) . ' value="' . $term->slug . '">' . apply_filters( 'woocommerce_variation_option_name', $term->name ) . '</option>';
+						echo '<option ' . selected( $variation_selected_value, $term->slug, false ) . ' value="' . esc_attr( $term->slug ) . '">' . apply_filters( 'woocommerce_variation_option_name', esc_html( $term->name ) ) . '</option>';
 					}
 				} else {
 					$options = explode( '|', $attribute['value'] );
 					foreach ( $options as $option ) {
-						echo '<option ' . selected( $variation_selected_value, $option, false ) . ' value="' . $option . '">' . ucfirst( apply_filters( 'woocommerce_variation_option_name', $option ) ) . '</option>';
+						echo '<option ' . selected( $variation_selected_value, $option, false ) . ' value="' . esc_attr( $option ) . '">' . ucfirst( apply_filters( 'woocommerce_variation_option_name', esc_html( $option ) ) ) . '</option>';
 					}
 				}
 
@@ -44,9 +44,9 @@ if ( ! defined( 'ABSPATH' ) ) exit; // Exit if accessed directly
 				<td class="sku" colspan="2">
 					<?php if ( get_option( 'woocommerce_enable_sku', true ) !== 'no' ) : ?>
 						<label><?php _e( 'SKU', 'woocommerce' ); ?>: <a class="tips" data-tip="<?php _e( 'Enter a SKU for this variation or leave blank to use the parent product SKU.', 'woocommerce' ); ?>" href="#">[?]</a></label>
-						<input type="text" size="5" name="variable_sku[<?php echo $loop; ?>]" value="<?php if ( isset( $_sku ) ) echo $_sku; ?>" placeholder="<?php echo $parent_data['sku']; ?>" />
+						<input type="text" size="5" name="variable_sku[<?php echo $loop; ?>]" value="<?php if ( isset( $_sku ) ) echo esc_attr( $_sku ); ?>" placeholder="<?php echo esc_attr( $parent_data['sku'] ); ?>" />
 					<?php else : ?>
-						<input type="hidden" name="variable_sku[<?php echo $loop; ?>]" value="<?php if ( isset( $_sku ) ) echo $_sku; ?>" />
+						<input type="hidden" name="variable_sku[<?php echo $loop; ?>]" value="<?php if ( isset( $_sku ) ) echo esc_attr( $_sku ); ?>" />
 					<?php endif; ?>
 				</td>
 				<td class="data" rowspan="2">
@@ -55,7 +55,7 @@ if ( ! defined( 'ABSPATH' ) ) exit; // Exit if accessed directly
 							<tr>
 								<td>
 									<label><?php _e( 'Stock Qty:', 'woocommerce' ); ?> <a class="tips" data-tip="<?php _e( 'Enter a quantity to enable stock management for this variation, or leave blank to use the variable product stock options.', 'woocommerce' ); ?>" href="#">[?]</a></label>
-									<input type="text" size="5" name="variable_stock[<?php echo $loop; ?>]" value="<?php if ( isset( $_stock ) ) echo $_stock; ?>" />
+									<input type="text" size="5" name="variable_stock[<?php echo $loop; ?>]" value="<?php if ( isset( $_stock ) ) echo esc_attr( $_stock ); ?>" />
 								</td>
 								<td>&nbsp;</td>
 							</tr>
@@ -64,31 +64,31 @@ if ( ! defined( 'ABSPATH' ) ) exit; // Exit if accessed directly
 						<tr>
 							<td>
 								<label><?php _e( 'Price:', 'woocommerce' ); ?></label>
-								<input type="text" size="5" name="variable_regular_price[<?php echo $loop; ?>]" value="<?php if ( isset( $_regular_price ) ) echo $_regular_price; ?>" />
+								<input type="text" size="5" name="variable_regular_price[<?php echo $loop; ?>]" value="<?php if ( isset( $_regular_price ) ) echo esc_attr( $_regular_price ); ?>" />
 							</td>
 							<td>
 								<label><?php _e( 'Sale Price:', 'woocommerce' ); ?> <a href="#" class="sale_schedule"><?php _e( 'Schedule', 'woocommerce' ); ?></a><a href="#" class="cancel_sale_schedule" style="display:none"><?php _e( 'Cancel schedule', 'woocommerce' ); ?></a></label>
-								<input type="text" size="5" name="variable_sale_price[<?php echo $loop; ?>]" value="<?php if ( isset( $_sale_price ) ) echo $_sale_price; ?>" /> 
+								<input type="text" size="5" name="variable_sale_price[<?php echo $loop; ?>]" value="<?php if ( isset( $_sale_price ) ) echo esc_attr( $_sale_price ); ?>" /> 
 							</td>
 						</tr>
 						
 						<tr class="sale_price_dates_fields" style="display:none">
 							<td>
-								<label><?php _e('Sale start date:', 'woocommerce') ?></label>
-								<input type="text" name="variable_sale_price_dates_from[<?php echo $loop; ?>]" value="<?php echo ! empty( $_sale_price_dates_from ) ? date_i18n( 'Y-m-d', $_sale_price_dates_from ) : ''; ?>" placeholder="<?php echo _x('From&hellip;', 'placeholder', 'woocommerce') ?>" maxlength="10" />
+								<label><?php _e( 'Sale start date:', 'woocommerce' ) ?></label>
+								<input type="text" name="variable_sale_price_dates_from[<?php echo $loop; ?>]" value="<?php echo ! empty( $_sale_price_dates_from ) ? date_i18n( 'Y-m-d', $_sale_price_dates_from ) : ''; ?>" placeholder="<?php echo _x( 'From&hellip;', 'placeholder', 'woocommerce' ) ?>" maxlength="10" />
 							</td>
 							<td>
-								<label><?php _e('Sale end date:', 'woocommerce') ?></label>
+								<label><?php _e( 'Sale end date:', 'woocommerce' ) ?></label>
 								<input type="text" name="variable_sale_price_dates_to[<?php echo $loop; ?>]" value="<?php echo ! empty( $_sale_price_dates_to ) ? date_i18n( 'Y-m-d', $_sale_price_dates_to ) : ''; ?>" placeholder="<?php echo _x('To&hellip;', 'placeholder', 'woocommerce') ?>" maxlength="10" />
 							</td>
 						</tr>
 						
-						<?php if ( get_option( 'woocommerce_enable_weight', true) !== 'no' || get_option( 'woocommerce_enable_dimensions', true ) !== 'no' ) : ?>
+						<?php if ( get_option( 'woocommerce_enable_weight', true ) !== 'no' || get_option( 'woocommerce_enable_dimensions', true ) !== 'no' ) : ?>
 							<tr>
 								<?php if ( get_option( 'woocommerce_enable_weight', true ) !== 'no' ) : ?>
 									<td class="hide_if_variation_virtual">
-										<label><?php _e( 'Weight', 'woocommerce' ) . ' (' . get_option( 'woocommerce_weight_unit' ) . '):'; ?> <a class="tips" data-tip="<?php _e( 'Enter a weight for this variation or leave blank to use the parent product weight.', 'woocommerce' ); ?>" href="#">[?]</a></label>
-										<input type="text" size="5" name="variable_weight[<?php echo $loop; ?>]" value="<?php if ( isset( $_weight ) ) echo $_weight; ?>" placeholder="<?php echo $parent_data['weight']; ?>" />
+										<label><?php _e( 'Weight', 'woocommerce' ) . ' (' . esc_html( get_option( 'woocommerce_weight_unit' ) ) . '):'; ?> <a class="tips" data-tip="<?php _e( 'Enter a weight for this variation or leave blank to use the parent product weight.', 'woocommerce' ); ?>" href="#">[?]</a></label>
+										<input type="text" size="5" name="variable_weight[<?php echo $loop; ?>]" value="<?php if ( isset( $_weight ) ) echo esc_attr( $_weight ); ?>" placeholder="<?php echo esc_attr( $parent_data['weight'] ); ?>" />
 									</td>
 								<?php else : ?>
 									<td>&nbsp;</td>
@@ -96,9 +96,9 @@ if ( ! defined( 'ABSPATH' ) ) exit; // Exit if accessed directly
 								<?php if ( get_option( 'woocommerce_enable_dimensions', true ) !== 'no' ) : ?>
 									<td class="dimensions_field hide_if_variation_virtual">
 										<label for"product_length"><?php echo __( 'Dimensions (L&times;W&times;H)', 'woocommerce' ); ?></label>
-										<input id="product_length" class="input-text" size="6" type="text" name="variable_length[<?php echo $loop; ?>]" value="<?php if ( isset( $_length ) ) echo $_length; ?>" placeholder="<?php echo $parent_data['length']; ?>" />
-										<input class="input-text" size="6" type="text" name="variable_width[<?php echo $loop; ?>]" value="<?php if ( isset( $_width ) ) echo $_width; ?>" placeholder="<?php echo $parent_data['width']; ?>" />
-										<input class="input-text last" size="6" type="text" name="variable_height[<?php echo $loop; ?>]" value="<?php if ( isset( $_height ) ) echo $_height; ?>" placeholder="<?php echo $parent_data['height']; ?>" />
+										<input id="product_length" class="input-text" size="6" type="text" name="variable_length[<?php echo $loop; ?>]" value="<?php if ( isset( $_length ) ) echo esc_attr( $_length ); ?>" placeholder="<?php echo esc_attr( $parent_data['length'] ); ?>" />
+										<input class="input-text" size="6" type="text" name="variable_width[<?php echo $loop; ?>]" value="<?php if ( isset( $_width ) ) echo esc_attr( $_width ); ?>" placeholder="<?php echo esc_attr( $parent_data['width'] ); ?>" />
+										<input class="input-text last" size="6" type="text" name="variable_height[<?php echo $loop; ?>]" value="<?php if ( isset( $_height ) ) echo esc_attr( $_height ); ?>" placeholder="<?php echo esc_attr( $parent_data['height'] ); ?>" />
 									</td>
 								<?php else : ?>
 									<td>&nbsp;</td>
@@ -113,7 +113,7 @@ if ( ! defined( 'ABSPATH' ) ) exit; // Exit if accessed directly
 									'show_option_all' 	=> __( 'Same as parent', 'woocommerce' ),
 									'name' 				=> 'variable_shipping_class[' . $loop . ']',
 									'id'				=> '',
-									'selected'			=> isset( $shipping_class ) ? $shipping_class : '',
+									'selected'			=> isset( $shipping_class ) ? esc_attr( $shipping_class ) : '',
 									'echo'				=> 0
 								);
 								
@@ -123,7 +123,7 @@ if ( ! defined( 'ABSPATH' ) ) exit; // Exit if accessed directly
 								<label><?php _e( 'Tax class:', 'woocommerce' ); ?></label> 
 								<select name="variable_tax_class[<?php echo $loop; ?>]"><?php
 									foreach ( $parent_data['tax_class_options'] as $key => $value )
-										echo '<option value="' . $key . '" ' . selected( $key, $_tax_class, false ) . '>' . $value . '</option>';
+										echo '<option value="' . esc_attr( $key ) . '" ' . selected( $key, $_tax_class, false ) . '>' . esc_html( $value ) . '</option>';
 								?></select>
 							</td>
 						</tr>
@@ -131,14 +131,14 @@ if ( ! defined( 'ABSPATH' ) ) exit; // Exit if accessed directly
 							<td rowspan="2">
 								<div class="file_path_field">
 									<label><?php _e( 'File paths:', 'woocommerce' ); ?> <a class="tips" data-tip="<?php _e( 'Enter one or more File Paths, one per line, to make this variation a downloadable product, or leave blank.', 'woocommerce' ); ?>" href="#">[?]</a></label>
-									<textarea style="float:left;" class="short file_paths" cols="20" rows="2" placeholder="<?php _e( 'File paths/URLs, one per line', 'woocommerce' ); ?>" name="variable_file_paths[<?php echo $loop; ?>]" wrap="off"><?php if ( isset( $_file_paths ) ) echo $_file_paths; ?></textarea> 
+									<textarea style="float:left;" class="short file_paths" cols="20" rows="2" placeholder="<?php _e( 'File paths/URLs, one per line', 'woocommerce' ); ?>" name="variable_file_paths[<?php echo $loop; ?>]" wrap="off"><?php if ( isset( $_file_paths ) ) echo esc_textarea( $_file_paths ); ?></textarea> 
 									<input type="button"  class="upload_file_button button" value="<?php _e( 'Upload a file', 'woocommerce' ); ?>" title="<?php _e( 'Upload', 'woocommerce' ); ?>" />
 								</div>
 							</td>
 							<td>
 								<div>
 									<label><?php _e( 'Download Limit:', 'woocommerce' ); ?> <a class="tips" data-tip="<?php _e( 'Leave blank for unlimited re-downloads.', 'woocommerce' ); ?>" href="#">[?]</a></label>
-									<input type="text" size="5" name="variable_download_limit[<?php echo $loop; ?>]" value="<?php if ( isset( $_download_limit ) ) echo $_download_limit; ?>" placeholder="<?php _e( 'Unlimited', 'woocommerce' ); ?>" />
+									<input type="text" size="5" name="variable_download_limit[<?php echo $loop; ?>]" value="<?php if ( isset( $_download_limit ) ) echo esc_attr( $_download_limit ); ?>" placeholder="<?php _e( 'Unlimited', 'woocommerce' ); ?>" />
 								</div>
 							</td>
 						</tr>
@@ -146,7 +146,7 @@ if ( ! defined( 'ABSPATH' ) ) exit; // Exit if accessed directly
 							<td>
 								<div>
 									<label><?php _e( 'Download Expiry:', 'woocommerce' ); ?> <a class="tips" data-tip="<?php _e( 'Enter the number of days before a download link expires, or leave blank.', 'woocommerce' ); ?>" href="#">[?]</a></label>
-									<input type="text" size="5" name="variable_download_expiry[<?php echo $loop; ?>]" value="<?php if ( isset( $_download_expiry ) ) echo $_download_expiry; ?>" placeholder="<?php _e( 'Unlimited', 'woocommerce' ); ?>" />
+									<input type="text" size="5" name="variable_download_expiry[<?php echo $loop; ?>]" value="<?php if ( isset( $_download_expiry ) ) echo esc_attr( $_download_expiry ); ?>" placeholder="<?php _e( 'Unlimited', 'woocommerce' ); ?>" />
 								</div>
 							</td>
 						</tr>
@@ -156,10 +156,10 @@ if ( ! defined( 'ABSPATH' ) ) exit; // Exit if accessed directly
 			</tr>
 			<tr>
 				<td class="upload_image">
-					<a href="#" class="upload_image_button <?php if ( $image_id > 0 ) echo 'remove'; ?>" rel="<?php echo $variation_id; ?>"><img src="<?php if ( ! empty( $image ) ) echo $image; else echo woocommerce_placeholder_img_src(); ?>" /><input type="hidden" name="upload_image_id[<?php echo $loop; ?>]" class="upload_image_id" value="<?php echo $image_id; ?>" /><span class="overlay"></span></a>
+					<a href="#" class="upload_image_button <?php if ( $image_id > 0 ) echo 'remove'; ?>" rel="<?php echo esc_attr( $variation_id ); ?>"><img src="<?php if ( ! empty( $image ) ) echo esc_attr( $image ); else echo esc_attr( woocommerce_placeholder_img_src() ); ?>" /><input type="hidden" name="upload_image_id[<?php echo $loop; ?>]" class="upload_image_id" value="<?php echo esc_attr( $image_id ); ?>" /><span class="overlay"></span></a>
 				</td>
 				<td class="options">
-					<label><input type="checkbox" class="checkbox" name="variable_enabled[<?php echo $loop; ?>]" <?php checked( $variation_post_status, 'publish' ); ?> /> <?php _e('Enabled', 'woocommerce'); ?></label>
+					<label><input type="checkbox" class="checkbox" name="variable_enabled[<?php echo $loop; ?>]" <?php checked( $variation_post_status, 'publish' ); ?> /> <?php _e( 'Enabled', 'woocommerce' ); ?></label>
 
 					<label><input type="checkbox" class="checkbox variable_is_downloadable" name="variable_is_downloadable[<?php echo $loop; ?>]" <?php checked( isset( $_downloadable ) ? $_downloadable : '', 'yes' ); ?> /> <?php _e( 'Downloadable', 'woocommerce' ); ?> <a class="tips" data-tip="<?php _e( 'Enable this option if access is given to a downloadable file upon purchase of a product', 'woocommerce' ); ?>" href="#">[?]</a></label>
 
diff --git a/admin/post-types/writepanels/writepanel-order_downloads.php b/admin/post-types/writepanels/writepanel-order_downloads.php
index 4509cdd170c..73490a5f343 100644
--- a/admin/post-types/writepanels/writepanel-order_downloads.php
+++ b/admin/post-types/writepanels/writepanel-order_downloads.php
@@ -35,7 +35,7 @@ function woocommerce_order_downloads_meta_box() {
 				");
 
 				$product = null;
-				if ($download_permissions && sizeof($download_permissions)>0) foreach ($download_permissions as $download) :
+				if ( $download_permissions && sizeof( $download_permissions ) > 0 ) foreach ( $download_permissions as $download ) :
 
 					if ( ! $product || $product->id != $download->product_id ) :
 						$product = new WC_Product( $download->product_id );
diff --git a/admin/post-types/writepanels/writepanel-product-type-variable.php b/admin/post-types/writepanels/writepanel-product-type-variable.php
index 7fd38347b76..68a77a0ef1e 100644
--- a/admin/post-types/writepanels/writepanel-product-type-variable.php
+++ b/admin/post-types/writepanels/writepanel-product-type-variable.php
@@ -7,7 +7,7 @@
  * @author 		WooThemes
  * @category 	Admin
  * @package 	WooCommerce/Admin/WritePanels
- * @version     1.6.4
+ * @version     1.7.0
  */
 
 if ( ! defined( 'ABSPATH' ) ) exit; // Exit if accessed directly
@@ -20,11 +20,11 @@ if ( ! defined( 'ABSPATH' ) ) exit; // Exit if accessed directly
  */
 function variable_product_type_options_tab() {
 	?>
-	<li class="variations_tab show_if_variable variation_options"><a href="#variable_product_options" title="<?php _e('Variations for variable products are defined here.', 'woocommerce'); ?>"><?php _e('Variations', 'woocommerce'); ?></a></li>
+	<li class="variations_tab show_if_variable variation_options"><a href="#variable_product_options" title="<?php _e( 'Variations for variable products are defined here.', 'woocommerce' ); ?>"><?php _e( 'Variations', 'woocommerce' ); ?></a></li>
 	<?php
 }
 
-add_action('woocommerce_product_write_panel_tabs', 'variable_product_type_options_tab');
+add_action( 'woocommerce_product_write_panel_tabs', 'variable_product_type_options_tab' );
 
 
 /**
@@ -36,57 +36,57 @@ add_action('woocommerce_product_write_panel_tabs', 'variable_product_type_option
 function variable_product_type_options() {
 	global $post, $woocommerce;
 
-	$attributes = (array) maybe_unserialize( get_post_meta($post->ID, '_product_attributes', true) );
+	$attributes = maybe_unserialize( get_post_meta( $post->ID, '_product_attributes', true ) );
 
 	// See if any are set
 	$variation_attribute_found = false;
-	if ($attributes) foreach($attributes as $attribute){
-		if (isset($attribute['is_variation'])) :
+	if ( $attributes ) foreach( $attributes as $attribute ) {
+		if ( isset( $attribute['is_variation'] ) ) {
 			$variation_attribute_found = true;
 			break;
-		endif;
+		}
 	}
 
 	// Get tax classes
-	$tax_classes = array_filter(array_map('trim', explode("\n", get_option('woocommerce_tax_classes'))));
+	$tax_classes = array_filter( array_map('trim', explode( "\n", get_option( 'woocommerce_tax_classes' ) ) ) );
 	$tax_class_options = array();
-	$tax_class_options['parent'] =__('Same as parent', 'woocommerce');
-	$tax_class_options[''] = __('Standard', 'woocommerce');
-	if ($tax_classes) foreach ( $tax_classes as $class )
-		$tax_class_options[sanitize_title($class)] = $class;
-
+	$tax_class_options['parent'] = __( 'Same as parent', 'woocommerce' );
+	$tax_class_options[''] = __( 'Standard', 'woocommerce' );
+	if ( $tax_classes ) 
+		foreach ( $tax_classes as $class )
+			$tax_class_options[ sanitize_title( $class ) ] = esc_attr( $class );
 	?>
 	<div id="variable_product_options" class="panel wc-metaboxes-wrapper">
 
-		<?php if (!$variation_attribute_found) : ?>
+		<?php if ( ! $variation_attribute_found ) : ?>
 
 			<div id="message" class="inline woocommerce-message">
 				<div class="squeezer">
 					<h4><?php _e( 'Before adding variations, add and save some attributes on the <strong>Attributes</strong> tab.', 'woocommerce' ); ?></h4>
 
-					<p class="submit"><a class="button-primary" href="http://www.woothemes.com/woocommerce-docs/user-guide/product-variations/" target="_blank"><?php _e('Learn more', 'woocommerce'); ?></a></p>
+					<p class="submit"><a class="button-primary" href="http://www.woothemes.com/woocommerce-docs/user-guide/product-variations/" target="_blank"><?php _e( 'Learn more', 'woocommerce' ); ?></a></p>
 				</div>
 			</div>
 
 		<?php else : ?>
 
 			<p class="toolbar">
-				<a href="#" class="close_all"><?php _e('Close all', 'woocommerce'); ?></a><a href="#" class="expand_all"><?php _e('Expand all', 'woocommerce'); ?></a>
-				<strong><?php _e('Bulk edit:', 'woocommerce'); ?></strong>
+				<a href="#" class="close_all"><?php _e( 'Close all', 'woocommerce' ); ?></a><a href="#" class="expand_all"><?php _e( 'Expand all', 'woocommerce' ); ?></a>
+				<strong><?php _e( 'Bulk edit:', 'woocommerce' ); ?></strong>
 				<select id="field_to_edit">
-					<option value="variable_price"><?php _e('Prices', 'woocommerce'); ?></option>
-					<option value="variable_sale_price"><?php _e('Sale prices', 'woocommerce'); ?></option>
-					<option value="variable_stock"><?php _e('Stock', 'woocommerce'); ?></option>
-					<option value="variable_weight"><?php _e('Weight', 'woocommerce'); ?></option>
-					<option value="variable_length"><?php _e('Length', 'woocommerce'); ?></option>
-					<option value="variable_width"><?php _e('Width', 'woocommerce'); ?></option>
-					<option value="variable_height"><?php _e('Height', 'woocommerce'); ?></option>
-					<option value="variable_file_paths" rel="textarea"><?php _e('File Path', 'woocommerce'); ?></option>
-					<option value="variable_download_limit"><?php _e('Download limit', 'woocommerce'); ?></option>
-					<option value="variable_download_expiry"><?php _e('Download Expiry', 'woocommerce'); ?></option>
+					<option value="variable_price"><?php _e( 'Prices', 'woocommerce' ); ?></option>
+					<option value="variable_sale_price"><?php _e( 'Sale prices', 'woocommerce' ); ?></option>
+					<option value="variable_stock"><?php _e( 'Stock', 'woocommerce' ); ?></option>
+					<option value="variable_weight"><?php _e( 'Weight', 'woocommerce' ); ?></option>
+					<option value="variable_length"><?php _e( 'Length', 'woocommerce' ); ?></option>
+					<option value="variable_width"><?php _e( 'Width', 'woocommerce' ); ?></option>
+					<option value="variable_height"><?php _e( 'Height', 'woocommerce' ); ?></option>
+					<option value="variable_file_paths" rel="textarea"><?php _e( 'File Path', 'woocommerce' ); ?></option>
+					<option value="variable_download_limit"><?php _e( 'Download limit', 'woocommerce' ); ?></option>
+					<option value="variable_download_expiry"><?php _e( 'Download Expiry', 'woocommerce' ); ?></option>
 				</select>
-				<a class="button bulk_edit plus"><?php _e('Edit', 'woocommerce'); ?></a>
-				<a class="button toggle toggle_downloadable" href="#"><?php _e('Downloadable', 'woocommerce'); ?></a> <a class="button toggle toggle_virtual" href="#"><?php _e('Virtual', 'woocommerce'); ?></a> <a class="button toggle toggle_enabled" href="#"><?php _e('Enabled', 'woocommerce'); ?></a> <a href="#" class="button delete_variations"><?php _e('Delete all', 'woocommerce'); ?></a>
+				<a class="button bulk_edit plus"><?php _e( 'Edit', 'woocommerce' ); ?></a>
+				<a class="button toggle toggle_downloadable" href="#"><?php _e( 'Downloadable', 'woocommerce' ); ?></a> <a class="button toggle toggle_virtual" href="#"><?php _e( 'Virtual', 'woocommerce' ); ?></a> <a class="button toggle toggle_enabled" href="#"><?php _e( 'Enabled', 'woocommerce' ); ?></a> <a href="#" class="button delete_variations"><?php _e( 'Delete all', 'woocommerce' ); ?></a>
 			</p>
 
 			<div class="woocommerce_variations wc-metaboxes">
@@ -119,7 +119,7 @@ function variable_product_type_options() {
 				// Get variations
 				$args = array(
 					'post_type'		=> 'product_variation',
-					'post_status' 	=> array('private', 'publish'),
+					'post_status' 	=> array( 'private', 'publish' ),
 					'numberposts' 	=> -1,
 					'orderby' 		=> 'menu_order',
 					'order' 		=> 'asc',
@@ -129,9 +129,9 @@ function variable_product_type_options() {
 				$loop = 0;
 				if ( $variations ) foreach ( $variations as $variation ) {
 					
-					$variation_id = $variation->ID;
-					$variation_post_status = $variation->post_status;
-					$variation_data = get_post_custom( $variation_id );
+					$variation_id 			= absint( $variation->ID );
+					$variation_post_status 	= esc_attr( $variation->post_status );
+					$variation_data 		= get_post_custom( $variation_id );
 					$variation_data['variation_post_id'] = $variation_id;
 					
 					// Grab shipping classes
@@ -167,8 +167,8 @@ function variable_product_type_options() {
 						$_regular_price = $_price;
 						
 					// Get image
-					$image_id = absint( $_thumbnail_id );
 					$image = '';
+					$image_id = absint( $_thumbnail_id );
 					if ( $image_id )
 						$image = wp_get_attachment_url( $image_id );
 				
@@ -186,40 +186,38 @@ function variable_product_type_options() {
 
 			<p class="toolbar">
 
-				<button type="button" class="button button-primary add_variation" <?php disabled($variation_attribute_found, false); ?>><?php _e('Add Variation', 'woocommerce'); ?></button>
+				<button type="button" class="button button-primary add_variation" <?php disabled( $variation_attribute_found, false ); ?>><?php _e( 'Add Variation', 'woocommerce' ); ?></button>
 
-				<button type="button" class="button link_all_variations" <?php disabled($variation_attribute_found, false); ?>><?php _e('Link all variations', 'woocommerce'); ?></button>
+				<button type="button" class="button link_all_variations" <?php disabled( $variation_attribute_found, false ); ?>><?php _e( 'Link all variations', 'woocommerce' ); ?></button>
 
-				<strong><?php _e('Default selections:', 'woocommerce'); ?></strong>
+				<strong><?php _e( 'Default selections:', 'woocommerce' ); ?></strong>
 				<?php
-					$default_attributes = (array) maybe_unserialize(get_post_meta( $post->ID, '_default_attributes', true ));
-					foreach ($attributes as $attribute) :
+					$default_attributes = maybe_unserialize( get_post_meta( $post->ID, '_default_attributes', true ) );
+					foreach ( $attributes as $attribute ) {
 
 						// Only deal with attributes that are variations
-						if ( !$attribute['is_variation'] ) continue;
+						if ( ! $attribute['is_variation'] ) 
+							continue;
 
 						// Get current value for variation (if set)
-						$variation_selected_value = (isset($default_attributes[sanitize_title($attribute['name'])])) ? $default_attributes[sanitize_title($attribute['name'])] : '';
+						$variation_selected_value = isset( $default_attributes[ sanitize_title( $attribute['name'] ) ] ) ? $default_attributes[ sanitize_title( $attribute['name'] ) ] : '';
 
 						// Name will be something like attribute_pa_color
-						echo '<select name="default_attribute_' . sanitize_title($attribute['name']).'"><option value="">'.__('No default', 'woocommerce') . ' ' . $woocommerce->attribute_label($attribute['name']).'&hellip;</option>';
+						echo '<select name="default_attribute_' . sanitize_title( $attribute['name'] ) . '"><option value="">' . __( 'No default', 'woocommerce' ) . ' ' . esc_html( $woocommerce->attribute_label( $attribute['name'] ) ) . '&hellip;</option>';
 
 						// Get terms for attribute taxonomy or value if its a custom attribute
-						if ($attribute['is_taxonomy']) :
+						if ( $attribute['is_taxonomy'] ) {
 							$post_terms = wp_get_post_terms( $post->ID, $attribute['name'] );
-							foreach ($post_terms as $term) :
-								echo '<option '.selected($variation_selected_value, $term->slug, false).' value="'.$term->slug.'">'.$term->name.'</option>';
-							endforeach;
-						else :
-							$options = explode('|', $attribute['value']);
-							foreach ($options as $option) :
-								echo '<option '.selected($variation_selected_value, $option, false).' value="'.$option.'">'.ucfirst($option).'</option>';
-							endforeach;
-						endif;
+							foreach ( $post_terms as $term )
+								echo '<option ' . selected( $variation_selected_value, $term->slug, false ) . ' value="' . esc_attr( $term->slug ) . '">' . esc_html( $term->name ) . '</option>';
+						} else {
+							$options = explode( '|', $attribute['value'] );
+							foreach ( $options as $option )
+								echo '<option ' . selected( $variation_selected_value, $option, false ) . ' value="' . esc_attr( $option ) . '">' . ucfirst( esc_html( $option ) ) . '</option>';
+						}
 
 						echo '</select>';
-
-					endforeach;
+					}
 				?>
 			</p>
 
@@ -235,11 +233,11 @@ function variable_product_type_options() {
 	?>
 	jQuery(function(){
 
-		<?php if (!$attributes || (is_array($attributes) && sizeof($attributes)==0)) : ?>
+		<?php if ( ! $attributes || ( is_array( $attributes ) && sizeof( $attributes ) == 0 ) ) : ?>
 
 			jQuery('#variable_product_options').on('click', 'button.link_all_variations, button.add_variation', function(){
 
-				alert('<?php _e('You must add some attributes via the "Product Data" panel and save before adding a new variation.', 'woocommerce'); ?>');
+				alert('<?php _e( 'You must add some attributes via the "Product Data" panel and save before adding a new variation.', 'woocommerce' ); ?>');
 
 				return false;
 
@@ -283,7 +281,7 @@ function variable_product_type_options() {
 
 		jQuery('#variable_product_options').on('click', 'button.link_all_variations', function(){
 
-			var answer = confirm('<?php _e('Are you sure you want to link all variations? This will create a new variation for each and every possible combination of variation attributes (max 50 per run).', 'woocommerce'); ?>');
+			var answer = confirm('<?php _e( 'Are you sure you want to link all variations? This will create a new variation for each and every possible combination of variation attributes (max 50 per run).', 'woocommerce' ); ?>');
 
 			if (answer) {
 
@@ -304,11 +302,11 @@ function variable_product_type_options() {
 					}
 
 					if (count==1) {
-						alert( count + ' <?php _e("variation added", 'woocommerce'); ?>');
+						alert( count + ' <?php _e( "variation added", 'woocommerce' ); ?>');
 					} else if (count==0 || count>1) {
-						alert( count + ' <?php _e("variations added", 'woocommerce'); ?>');
+						alert( count + ' <?php _e( "variations added", 'woocommerce' ); ?>');
 					} else {
-						alert('<?php _e("No variations added", 'woocommerce'); ?>');
+						alert('<?php _e( "No variations added", 'woocommerce' ); ?>');
 					}
 
 					jQuery('#variable_product_options').unblock();
@@ -320,7 +318,7 @@ function variable_product_type_options() {
 
 		jQuery('#variable_product_options').on('click', 'button.remove_variation', function(e){
 			e.preventDefault();
-			var answer = confirm('<?php _e('Are you sure you want to remove this variation?', 'woocommerce'); ?>');
+			var answer = confirm('<?php _e( 'Are you sure you want to remove this variation?', 'woocommerce' ); ?>');
 			if (answer){
 
 				var el = jQuery(this).parent().parent();
@@ -355,10 +353,10 @@ function variable_product_type_options() {
 		});
 
 		jQuery('#variable_product_options').on('click', 'a.delete_variations', function(){
-			var answer = confirm('<?php _e('Are you sure you want to delete all variations? This cannot be undone.', 'woocommerce'); ?>');
+			var answer = confirm('<?php _e( 'Are you sure you want to delete all variations? This cannot be undone.', 'woocommerce' ); ?>');
 			if (answer){
 
-				var answer = confirm('<?php _e('Last warning, are you sure?', 'woocommerce'); ?>');
+				var answer = confirm('<?php _e( 'Last warning, are you sure?', 'woocommerce' ); ?>');
 
 				if (answer) {
 
@@ -396,7 +394,7 @@ function variable_product_type_options() {
 			var field_to_edit = jQuery('select#field_to_edit').val();
 			var input_tag = jQuery('select#field_to_edit :selected').attr('rel') ? jQuery('select#field_to_edit :selected').attr('rel') : 'input';
 			
-			var value = prompt("<?php _e('Enter a value', 'woocommerce'); ?>");
+			var value = prompt("<?php _e( 'Enter a value', 'woocommerce' ); ?>");
 			jQuery(input_tag + '[name^="' + field_to_edit + '"]').val( value );
 			return false;
 		});
@@ -537,7 +535,7 @@ add_action('woocommerce_product_write_panels', 'variable_product_type_options');
  * @return array
  */
 function variable_product_type_selector( $types, $product_type ) {
-	$types['variable'] = __('Variable product', 'woocommerce');
+	$types['variable'] = __( 'Variable product', 'woocommerce' );
 	return $types;
 }
 
@@ -556,65 +554,66 @@ function process_product_meta_variable( $post_id ) {
 
 	if ( isset( $_POST['variable_sku'] ) ) {
 
-		$variable_post_id 			= $_POST['variable_post_id'];
-		$variable_sku 				= $_POST['variable_sku'];
-		$variable_weight			= $_POST['variable_weight'];
-		$variable_length			= $_POST['variable_length'];
-		$variable_width				= $_POST['variable_width'];
-		$variable_height			= $_POST['variable_height'];
-		$variable_stock 			= $_POST['variable_stock'];
-		$variable_regular_price 	= $_POST['variable_regular_price'];
-		$variable_sale_price		= $_POST['variable_sale_price'];
-		$upload_image_id			= $_POST['upload_image_id'];
-		$variable_file_paths 		= $_POST['variable_file_paths'];
-		$variable_download_limit 	= $_POST['variable_download_limit'];
-		$variable_download_expiry   = $_POST['variable_download_expiry'];
-		$variable_shipping_class 	= $_POST['variable_shipping_class'];
-		$variable_tax_class			= $_POST['variable_tax_class'];
-		$variable_menu_order 		= $_POST['variation_menu_order'];
+		$variable_post_id 					= $_POST['variable_post_id'];
+		$variable_sku 						= $_POST['variable_sku'];
+		$variable_weight					= $_POST['variable_weight'];
+		$variable_length					= $_POST['variable_length'];
+		$variable_width						= $_POST['variable_width'];
+		$variable_height					= $_POST['variable_height'];
+		$variable_stock 					= $_POST['variable_stock'];
+		$variable_regular_price 			= $_POST['variable_regular_price'];
+		$variable_sale_price				= $_POST['variable_sale_price'];
+		$upload_image_id					= $_POST['upload_image_id'];
+		$variable_file_paths 				= $_POST['variable_file_paths'];
+		$variable_download_limit 			= $_POST['variable_download_limit'];
+		$variable_download_expiry   		= $_POST['variable_download_expiry'];
+		$variable_shipping_class 			= $_POST['variable_shipping_class'];
+		$variable_tax_class					= $_POST['variable_tax_class'];
+		$variable_menu_order 				= $_POST['variation_menu_order'];
 		$variable_sale_price_dates_from 	= $_POST['variable_sale_price_dates_from'];
 		$variable_sale_price_dates_to 		= $_POST['variable_sale_price_dates_to'];
 
-		if (isset($_POST['variable_enabled']))
-			$variable_enabled 			= $_POST['variable_enabled'];
+		if ( isset( $_POST['variable_enabled'] ) )
+			$variable_enabled 				= $_POST['variable_enabled'];
 
-		if (isset($_POST['variable_is_virtual']))
-			$variable_is_virtual		= $_POST['variable_is_virtual'];
+		if ( isset( $_POST['variable_is_virtual'] ) )
+			$variable_is_virtual			= $_POST['variable_is_virtual'];
 
-		if (isset($_POST['variable_is_downloadable']))
-			$variable_is_downloadable 	= $_POST['variable_is_downloadable'];
+		if ( isset( $_POST['variable_is_downloadable'] ) )
+			$variable_is_downloadable 		= $_POST['variable_is_downloadable'];
 
-		$attributes = (array) maybe_unserialize( get_post_meta($post_id, '_product_attributes', true) );
+		$attributes = (array) maybe_unserialize( get_post_meta( $post_id, '_product_attributes', true ) );
 
 		$max_loop = max( array_keys( $_POST['variable_post_id'] ) );
 
 		for ( $i = 0; $i <= $max_loop; $i ++ ) {
 
-			if ( ! isset( $variable_post_id[ $i ] ) ) continue;
+			if ( ! isset( $variable_post_id[ $i ] ) ) 
+				continue;
 
-			$variation_id = (int) $variable_post_id[ $i ];
+			$variation_id = absint( $variable_post_id[ $i ] );
 
 			// Virtal/Downloadable
-			if (isset($variable_is_virtual[ $i ])) $is_virtual = 'yes'; else $is_virtual = 'no';
-			if (isset($variable_is_downloadable[ $i ])) $is_downloadable = 'yes'; else $is_downloadable = 'no';
+			$is_virtual = isset( $variable_is_virtual[ $i ] ) ? 'yes' : 'no';
+			$is_downloadable = isset( $variable_is_downloadable[ $i ] ) ? 'yes' : 'no';
 
 			// Enabled or disabled
-			if (isset($variable_enabled[ $i ])) $post_status = 'publish'; else $post_status = 'private';
+			$post_status = isset( $variable_enabled[ $i ] ) ? 'publish' : 'private';
 
 			// Generate a useful post title
-			$variation_post_title = sprintf(__('Variation #%s of %s', 'woocommerce'), $variation_id, get_the_title($post_id));
+			$variation_post_title = sprintf( __( 'Variation #%s of %s', 'woocommerce' ), absint( $variation_id ), esc_html( get_the_title( $post_id ) ) );
 
 			// Update or Add post
 			if ( ! $variation_id ) {
 
 				$variation = array(
-					'post_title' => $variation_post_title,
-					'post_content' => '',
-					'post_status' => $post_status,
-					'post_author' => get_current_user_id(),
-					'post_parent' => $post_id,
-					'post_type' => 'product_variation',
-					'menu_order' => $variable_menu_order[ $i ]
+					'post_title' 	=> $variation_post_title,
+					'post_content' 	=> '',
+					'post_status' 	=> $post_status,
+					'post_author' 	=> get_current_user_id(),
+					'post_parent' 	=> $post_id,
+					'post_type' 	=> 'product_variation',
+					'menu_order' 	=> $variable_menu_order[ $i ]
 				);
 				$variation_id = wp_insert_post( $variation );
 
@@ -625,24 +624,24 @@ function process_product_meta_variable( $post_id ) {
 			}
 
 			// Update post meta
-			update_post_meta( $variation_id, '_sku', esc_html( $variable_sku[ $i ] ) );
-			update_post_meta( $variation_id, '_weight', $variable_weight[ $i ] );
+			update_post_meta( $variation_id, '_sku', esc_attr( $variable_sku[ $i ] ) );
+			update_post_meta( $variation_id, '_weight', esc_attr( $variable_weight[ $i ] ) );
 
-			update_post_meta( $variation_id, '_length', $variable_length[ $i ] );
-			update_post_meta( $variation_id, '_width', $variable_width[ $i ] );
-			update_post_meta( $variation_id, '_height', $variable_height[ $i ] );
+			update_post_meta( $variation_id, '_length', esc_attr( $variable_length[ $i ] ) );
+			update_post_meta( $variation_id, '_width', esc_attr( $variable_width[ $i ] ) );
+			update_post_meta( $variation_id, '_height', esc_attr( $variable_height[ $i ] ) );
 
-			update_post_meta( $variation_id, '_stock', $variable_stock[ $i ] );
-			update_post_meta( $variation_id, '_thumbnail_id', $upload_image_id[ $i ] );
+			update_post_meta( $variation_id, '_stock', esc_attr( $variable_stock[ $i ] ) );
+			update_post_meta( $variation_id, '_thumbnail_id', absint( $upload_image_id[ $i ] ) );
 
-			update_post_meta( $variation_id, '_virtual', $is_virtual );
-			update_post_meta( $variation_id, '_downloadable', $is_downloadable );
+			update_post_meta( $variation_id, '_virtual', esc_attr( $is_virtual ) );
+			update_post_meta( $variation_id, '_downloadable', esc_attr( $is_downloadable ) );
 			
 			// Price handling
-			$regular_price 	= $variable_regular_price[ $i ];
-			$sale_price 	= $variable_sale_price[ $i ];
-			$date_from 		= $variable_sale_price_dates_from[ $i ];
-			$date_to		= $variable_sale_price_dates_to[ $i ];
+			$regular_price 	= esc_attr( $variable_regular_price[ $i ] );
+			$sale_price 	= esc_attr( $variable_sale_price[ $i ] );
+			$date_from 		= esc_attr( $variable_sale_price_dates_from[ $i ] );
+			$date_to		= esc_attr( $variable_sale_price_dates_to[ $i ] );
 			
 			update_post_meta( $variation_id, '_regular_price', $regular_price );
 			update_post_meta( $variation_id, '_sale_price', $sale_price );
@@ -677,13 +676,13 @@ function process_product_meta_variable( $post_id ) {
 			}
 					
 			if ( $variable_tax_class[ $i ] !== 'parent' )
-				update_post_meta( $variation_id, '_tax_class', $variable_tax_class[ $i ] );
+				update_post_meta( $variation_id, '_tax_class', esc_attr( $variable_tax_class[ $i ] ) );
 			else
 				delete_post_meta( $variation_id, '_tax_class' );
 
 			if ( $is_downloadable == 'yes' ) {
-				update_post_meta( $variation_id, '_download_limit', $variable_download_limit[ $i ] );
-				update_post_meta( $variation_id, '_download_expiry', $variable_download_expiry[ $i ] );
+				update_post_meta( $variation_id, '_download_limit', esc_attr( $variable_download_limit[ $i ] ) );
+				update_post_meta( $variation_id, '_download_expiry', esc_attr( $variable_download_expiry[ $i ] ) );
 				
 				$_file_paths = array();
 				$file_paths = str_replace( "\r\n", "\n", esc_attr( $variable_file_paths[ $i ] ) );
@@ -711,8 +710,9 @@ function process_product_meta_variable( $post_id ) {
 			$variable_shipping_class[ $i ] = ( $variable_shipping_class[ $i ] ) ? (int) $variable_shipping_class[ $i ] : '';
 			wp_set_object_terms( $variation_id, $variable_shipping_class[ $i ], 'product_shipping_class');
 
-			// Remove old taxnomies attributes so data is kept up to date
-			if ($variation_id) $wpdb->query("DELETE FROM $wpdb->postmeta WHERE meta_key LIKE 'attribute_%' AND post_id = $variation_id;");
+			// Remove old taxonomies attributes so data is kept up to date
+			if ( $variation_id ) 
+				$wpdb->query( $wpdb->prepare( "DELETE FROM $wpdb->postmeta WHERE meta_key LIKE %s AND post_id = %d;", 'attribute_%', $variation_id ) );
 
 			// Update taxonomies
 			foreach ( $attributes as $attribute ) {
@@ -722,7 +722,6 @@ function process_product_meta_variable( $post_id ) {
 					$value = esc_attr( trim( $_POST[ 'attribute_' . sanitize_title( $attribute['name'] ) ][ $i ] ) );
 
 					update_post_meta( $variation_id, 'attribute_' . sanitize_title( $attribute['name'] ), $value );
-
 				}
 
 			}
@@ -744,8 +743,8 @@ function process_product_meta_variable( $post_id ) {
 
 	$lowest_price = $lowest_regular_price = $lowest_sale_price = $highest_price = $highest_regular_price = $highest_sale_price = '';
 
-	if ($children) {
-		foreach ($children as $child) {
+	if ( $children ) {
+		foreach ( $children as $child ) {
 
 			$child_price 			= get_post_meta( $child, '_price', true );
 			$child_regular_price 	= get_post_meta( $child, '_regular_price', true );
@@ -783,17 +782,15 @@ function process_product_meta_variable( $post_id ) {
 	// Update default attribute options setting
 	$default_attributes = array();
 
-	foreach ($attributes as $attribute) :
-		if ( $attribute['is_variation'] ) :
-			$value = esc_attr(trim($_POST[ 'default_attribute_' . sanitize_title($attribute['name']) ]));
-			if ($value) :
-				$default_attributes[sanitize_title($attribute['name'])] = $value;
-			endif;
-		endif;
-	endforeach;
+	foreach ( $attributes as $attribute ) {
+		if ( $attribute['is_variation'] ) {
+			$value = esc_attr( trim( $_POST[ 'default_attribute_' . sanitize_title( $attribute['name'] ) ] ) );
+			if ( $value )
+				$default_attributes[ sanitize_title( $attribute['name'] ) ] = $value;
+		}
+	}
 
 	update_post_meta( $post_parent, '_default_attributes', $default_attributes );
-
 }
 
-add_action('woocommerce_process_product_meta_variable', 'process_product_meta_variable');
\ No newline at end of file
+add_action( 'woocommerce_process_product_meta_variable', 'process_product_meta_variable' );
\ No newline at end of file
diff --git a/admin/post-types/writepanels/writepanel-product_data.php b/admin/post-types/writepanels/writepanel-product_data.php
index ae5d1823711..6eda70c6eec 100644
--- a/admin/post-types/writepanels/writepanel-product_data.php
+++ b/admin/post-types/writepanels/writepanel-product_data.php
@@ -49,14 +49,14 @@ function woocommerce_product_data_box() {
 		'virtual' => array(
 			'id' => '_virtual',
 			'wrapper_class' => 'show_if_simple',
-			'label' => __('Virtual', 'woocommerce'),
-			'description' => __('Virtual products are intangible and aren\'t shipped.', 'woocommerce')
+			'label' => __( 'Virtual', 'woocommerce' ),
+			'description' => __( 'Virtual products are intangible and aren\'t shipped.', 'woocommerce' )
 		),
 		'downloadable' => array(
 			'id' => '_downloadable',
 			'wrapper_class' => 'show_if_simple',
-			'label' => __('Downloadable', 'woocommerce'),
-			'description' => __('Downloadable products give access to a file upon purchase.', 'woocommerce')
+			'label' => __( 'Downloadable', 'woocommerce' ),
+			'description' => __( 'Downloadable products give access to a file upon purchase.', 'woocommerce' )
 		)
 	) );
 
@@ -72,19 +72,19 @@ function woocommerce_product_data_box() {
 
 		<ul class="product_data_tabs wc-tabs" style="display:none;">
 
-			<li class="active general_options hide_if_grouped"><a href="#general_product_data"><?php _e('General', 'woocommerce'); ?></a></li>
+			<li class="active general_options hide_if_grouped"><a href="#general_product_data"><?php _e( 'General', 'woocommerce' ); ?></a></li>
 
-			<li class="tax_tab show_if_simple show_if_variable tax_options"><a href="#tax_product_data"><?php _e('Taxes', 'woocommerce'); ?></a></li>
+			<li class="tax_tab show_if_simple show_if_variable tax_options"><a href="#tax_product_data"><?php _e( 'Taxes', 'woocommerce' ); ?></a></li>
 
-			<li class="inventory_tab show_if_simple show_if_variable show_if_grouped inventory_options"><a href="#inventory_product_data"><?php _e('Inventory', 'woocommerce'); ?></a></li>
+			<li class="inventory_tab show_if_simple show_if_variable show_if_grouped inventory_options"><a href="#inventory_product_data"><?php _e( 'Inventory', 'woocommerce' ); ?></a></li>
 
-			<li class="shipping_tab hide_if_virtual shipping_options hide_if_grouped hide_if_external"><a href="#shipping_product_data"><?php _e('Shipping', 'woocommerce'); ?></a></li>
+			<li class="shipping_tab hide_if_virtual shipping_options hide_if_grouped hide_if_external"><a href="#shipping_product_data"><?php _e( 'Shipping', 'woocommerce' ); ?></a></li>
 
-			<li class="related_product_tab related_product_options"><a href="#related_product_data"><?php _e('Related Products', 'woocommerce'); ?></a></li>
+			<li class="related_product_tab related_product_options"><a href="#related_product_data"><?php _e( 'Related Products', 'woocommerce' ); ?></a></li>
 
-			<li class="attributes_tab attribute_options"><a href="#woocommerce_attributes"><?php _e('Attributes', 'woocommerce'); ?></a></li>
+			<li class="attributes_tab attribute_options"><a href="#woocommerce_attributes"><?php _e( 'Attributes', 'woocommerce' ); ?></a></li>
 
-			<li class="advanced_tab advanced_options"><a href="#advanced_product_data"><?php _e('Advanced', 'woocommerce'); ?></a></li>
+			<li class="advanced_tab advanced_options"><a href="#advanced_product_data"><?php _e( 'Advanced', 'woocommerce' ); ?></a></li>
 
 			<?php do_action( 'woocommerce_product_write_panel_tabs' ); ?>
 
@@ -95,7 +95,7 @@ function woocommerce_product_data_box() {
 
 				// SKU
 				if( get_option('woocommerce_enable_sku', true) !== 'no' )
-					woocommerce_wp_text_input( array( 'id' => '_sku', 'label' => '<abbr title="'. __('Stock Keeping Unit', 'woocommerce') .'">' . __('SKU', 'woocommerce') . '</abbr>', 'desc_tip' => 'true', 'description' => __('SKU refers to a Stock-keeping unit, a unique identifier for each distinct product and service that can be purchased.', 'woocommerce') ) );
+					woocommerce_wp_text_input( array( 'id' => '_sku', 'label' => '<abbr title="'. __( 'Stock Keeping Unit', 'woocommerce' ) .'">' . __( 'SKU', 'woocommerce' ) . '</abbr>', 'desc_tip' => 'true', 'description' => __( 'SKU refers to a Stock-keeping unit, a unique identifier for each distinct product and service that can be purchased.', 'woocommerce' ) ) );
 				else
 					echo '<input type="hidden" name="_sku" value="' . esc_attr( get_post_meta( $thepostid, '_sku', true ) ) . '" />';
 
@@ -106,20 +106,20 @@ function woocommerce_product_data_box() {
 			echo '<div class="options_group show_if_external">';
 
 				// External URL
-				woocommerce_wp_text_input( array( 'id' => '_product_url', 'label' => __('Product URL', 'woocommerce'), 'placeholder' => 'http://', 'description' => __('Enter the external URL to the product.', 'woocommerce') ) );
+				woocommerce_wp_text_input( array( 'id' => '_product_url', 'label' => __( 'Product URL', 'woocommerce' ), 'placeholder' => 'http://', 'description' => __( 'Enter the external URL to the product.', 'woocommerce' ) ) );
 
 				// Button text
-				woocommerce_wp_text_input( array( 'id' => '_button_text', 'label' => __('Button text', 'woocommerce'), 'placeholder' => _x('Buy product', 'placeholder', 'woocommerce'), 'description' => __('This text will be shown on the button linking to the external product.', 'woocommerce') ) );
+				woocommerce_wp_text_input( array( 'id' => '_button_text', 'label' => __( 'Button text', 'woocommerce' ), 'placeholder' => _x('Buy product', 'placeholder', 'woocommerce'), 'description' => __( 'This text will be shown on the button linking to the external product.', 'woocommerce' ) ) );
 
 			echo '</div>';
 
 			echo '<div class="options_group pricing show_if_simple show_if_external">';
 
 				// Price
-				woocommerce_wp_text_input( array( 'id' => '_regular_price', 'class' => 'wc_input_price short', 'label' => __('Regular Price', 'woocommerce') . ' ('.get_woocommerce_currency_symbol().')' ) );
+				woocommerce_wp_text_input( array( 'id' => '_regular_price', 'class' => 'wc_input_price short', 'label' => __( 'Regular Price', 'woocommerce' ) . ' ('.get_woocommerce_currency_symbol().')' ) );
 
 				// Special Price
-				woocommerce_wp_text_input( array( 'id' => '_sale_price', 'class' => 'wc_input_price short', 'label' => __('Sale Price', 'woocommerce') . ' ('.get_woocommerce_currency_symbol().')', 'description' => '<a href="#" class="sale_schedule">' . __('Schedule', 'woocommerce') . '</a>' ) );
+				woocommerce_wp_text_input( array( 'id' => '_sale_price', 'class' => 'wc_input_price short', 'label' => __( 'Sale Price', 'woocommerce' ) . ' ('.get_woocommerce_currency_symbol().')', 'description' => '<a href="#" class="sale_schedule">' . __( 'Schedule', 'woocommerce' ) . '</a>' ) );
 
 				// Special Price date range
 				$sale_price_dates_from 	= ( $date = get_post_meta( $thepostid, '_sale_price_dates_from', true ) ) ? date_i18n( 'Y-m-d', $date ) : '';
@@ -143,7 +143,7 @@ function woocommerce_product_data_box() {
 				if ( is_array( $file_paths ) ) 
 					$file_paths = implode( "\n", $file_paths );
 				
-				echo '<p class="form-field"><label for="_file_paths">' . __('File paths (one per line)', 'woocommerce' ) . ':</label>
+				echo '<p class="form-field"><label for="_file_paths">' . __( 'File paths (one per line)', 'woocommerce' ) . ':</label>
 					<textarea style="float:left;height:5em;" id="_file_paths" class="short file_paths" cols="20" rows="3" placeholder="' . __( 'File paths/URLs, one per line', 'woocommerce' ) . '" name="_file_paths" wrap="off">' . esc_textarea( $file_paths ) . '</textarea>
 					<input type="button" class="upload_file_button button" value="' . __( 'Upload a file', 'woocommerce' ) . '" />
 				</p>';
@@ -191,14 +191,14 @@ function woocommerce_product_data_box() {
 			if (get_option('woocommerce_manage_stock')=='yes') {
 
 				// manage stock
-				woocommerce_wp_checkbox( array( 'id' => '_manage_stock', 'wrapper_class' => 'show_if_simple show_if_variable', 'label' => __('Manage stock?', 'woocommerce') ) );
+				woocommerce_wp_checkbox( array( 'id' => '_manage_stock', 'wrapper_class' => 'show_if_simple show_if_variable', 'label' => __('Manage stock?', 'woocommerce' ) ) );
 
 				do_action('woocommerce_product_options_stock');
 
 				echo '<div class="stock_fields show_if_simple show_if_variable">';
 
 				// Stock
-				woocommerce_wp_text_input( array( 'id' => '_stock', 'label' => __('Stock Qty', 'woocommerce'), 'desc_tip' => true, 'description' => __('Stock quantity. If this is a variable product this value will be used to control stock for all variations, unless you define stock at variation level.', 'woocommerce') ) );
+				woocommerce_wp_text_input( array( 'id' => '_stock', 'label' => __( 'Stock Qty', 'woocommerce' ), 'desc_tip' => true, 'description' => __( 'Stock quantity. If this is a variable product this value will be used to control stock for all variations, unless you define stock at variation level.', 'woocommerce' ) ) );
 
 				do_action('woocommerce_product_options_stock_fields');
 
@@ -207,21 +207,21 @@ function woocommerce_product_data_box() {
 			}
 
 			// Stock status
-			woocommerce_wp_select( array( 'id' => '_stock_status', 'label' => __('Stock status', 'woocommerce'), 'options' => array(
-				'instock' => __('In stock', 'woocommerce'),
-				'outofstock' => __('Out of stock', 'woocommerce')
-			), 'desc_tip' => true, 'description' => __('Controls whether or not the product is listed as "in stock" or "out of stock" on the frontend.', 'woocommerce') ) );
+			woocommerce_wp_select( array( 'id' => '_stock_status', 'label' => __( 'Stock status', 'woocommerce' ), 'options' => array(
+				'instock' => __( 'In stock', 'woocommerce' ),
+				'outofstock' => __( 'Out of stock', 'woocommerce' )
+			), 'desc_tip' => true, 'description' => __( 'Controls whether or not the product is listed as "in stock" or "out of stock" on the frontend.', 'woocommerce' ) ) );
 
 			if (get_option('woocommerce_manage_stock')=='yes') {
 
 				echo '<div class="show_if_simple show_if_variable">';
 
 				// Backorders?
-				woocommerce_wp_select( array( 'id' => '_backorders', 'label' => __('Allow Backorders?', 'woocommerce'), 'options' => array(
-					'no' => __('Do not allow', 'woocommerce'),
-					'notify' => __('Allow, but notify customer', 'woocommerce'),
-					'yes' => __('Allow', 'woocommerce')
-				), 'desc_tip' => true, 'description' => __('If managing stock, this controls whether or not backorders are allowed for this product and variations. If enabled, stock quantity can go below 0.', 'woocommerce') ) );
+				woocommerce_wp_select( array( 'id' => '_backorders', 'label' => __( 'Allow Backorders?', 'woocommerce' ), 'options' => array(
+					'no' => __( 'Do not allow', 'woocommerce' ),
+					'notify' => __( 'Allow, but notify customer', 'woocommerce' ),
+					'yes' => __( 'Allow', 'woocommerce' )
+				), 'desc_tip' => true, 'description' => __( 'If managing stock, this controls whether or not backorders are allowed for this product and variations. If enabled, stock quantity can go below 0.', 'woocommerce' ) ) );
 
 				echo '</div>';
 
@@ -239,7 +239,7 @@ function woocommerce_product_data_box() {
 				
 				// Weight
 				if( get_option('woocommerce_enable_weight', true) !== 'no' ) :
-					woocommerce_wp_text_input( array( 'id' => '_weight', 'label' => __('Weight', 'woocommerce') . ' ('.get_option('woocommerce_weight_unit').')', 'placeholder' => '0.00', 'description' => __('Weight in decimal form', 'woocommerce') ) );
+					woocommerce_wp_text_input( array( 'id' => '_weight', 'label' => __( 'Weight', 'woocommerce' ) . ' ('.get_option('woocommerce_weight_unit').')', 'placeholder' => '0.00', 'description' => __( 'Weight in decimal form', 'woocommerce' ) ) );
 				else:
 					echo '<input type="hidden" name="_weight" value="' . esc_attr( get_post_meta( $thepostid, '_weight', true ) ) . '" />';
 				endif;
@@ -274,7 +274,7 @@ function woocommerce_product_data_box() {
 				$args = array(
 					'taxonomy' 			=> 'product_shipping_class',
 					'hide_empty'		=> 0,
-					'show_option_none' 	=> __('No shipping class', 'woocommerce'),
+					'show_option_none' 	=> __( 'No shipping class', 'woocommerce' ),
 					'name' 				=> 'product_shipping_class',
 					'id'				=> 'product_shipping_class',
 					'selected'			=> $current_shipping_class,
@@ -311,81 +311,80 @@ function woocommerce_product_data_box() {
 				    		$attribute_taxonomy_name = $woocommerce->attribute_taxonomy_name( $tax->attribute_name );
 
 				    		// Ensure it exists
-				    		if ( ! taxonomy_exists($attribute_taxonomy_name ) ) continue;
+				    		if ( ! taxonomy_exists( $attribute_taxonomy_name ) ) continue;
 
 				    		// Get product data values for current taxonomy - this contains ordering and visibility data
-				    		if ( isset( $attributes[$attribute_taxonomy_name] ) ) $attribute = $attributes[$attribute_taxonomy_name];
+				    		if ( isset( $attributes[ $attribute_taxonomy_name ] ) ) 
+				    			$attribute = $attributes[ $attribute_taxonomy_name ];
 
-				    		$position = ( isset( $attribute['position'] ) ) ? $attribute['position'] : 0;
+				    		$position = empty( $attribute['position'] ) ? 0 : absint( $attribute['position'] );
 
 				    		// Get terms of this taxonomy associated with current product
 				    		$post_terms = wp_get_post_terms( $thepostid, $attribute_taxonomy_name );
 
 				    		// Any set?
 				    		$has_terms = ( is_wp_error( $post_terms ) || ! $post_terms || sizeof( $post_terms ) == 0 ) ? 0 : 1;
-
 				    		?>
-				    		<div class="woocommerce_attribute wc-metabox closed taxonomy <?php echo $attribute_taxonomy_name; ?>" rel="<?php echo $position; ?>" <?php if (!$has_terms) echo 'style="display:none"'; ?>>
+				    		<div class="woocommerce_attribute wc-metabox closed taxonomy <?php echo $attribute_taxonomy_name; ?>" rel="<?php echo $position; ?>" <?php if ( ! $has_terms ) echo 'style="display:none"'; ?>>
 								<h3>
-									<button type="button" class="remove_row button"><?php _e('Remove', 'woocommerce'); ?></button>
-									<div class="handlediv" title="<?php _e('Click to toggle', 'woocommerce'); ?>"></div>
-									<strong class="attribute_name"><?php echo apply_filters( 'woocommerce_attribute_label', ($tax->attribute_label) ? $tax->attribute_label : $tax->attribute_name, $tax->attribute_name ); ?></strong>
+									<button type="button" class="remove_row button"><?php _e( 'Remove', 'woocommerce' ); ?></button>
+									<div class="handlediv" title="<?php _e( 'Click to toggle', 'woocommerce' ); ?>"></div>
+									<strong class="attribute_name"><?php echo apply_filters( 'woocommerce_attribute_label', $tax->attribute_label ? $tax->attribute_label : $tax->attribute_name, $tax->attribute_name ); ?></strong>
 								</h3>
 								<table cellpadding="0" cellspacing="0" class="woocommerce_attribute_data wc-metabox-content">
 									<tbody>
 										<tr>
 											<td class="attribute_name">
-												<label><?php _e('Name', 'woocommerce'); ?>:</label>
-												<strong><?php echo ($tax->attribute_label) ? $tax->attribute_label : $tax->attribute_name; ?></strong>
+												<label><?php _e( 'Name', 'woocommerce' ); ?>:</label>
+												<strong><?php echo $tax->attribute_label ? $tax->attribute_label : $tax->attribute_name; ?></strong>
 
 												<input type="hidden" name="attribute_names[<?php echo $i; ?>]" value="<?php echo esc_attr( $attribute_taxonomy_name ); ?>" />
 												<input type="hidden" name="attribute_position[<?php echo $i; ?>]" class="attribute_position" value="<?php echo esc_attr( $position ); ?>" />
 												<input type="hidden" name="attribute_is_taxonomy[<?php echo $i; ?>]" value="1" />
 											</td>
 											<td rowspan="3">
-												<label><?php _e('Value(s)', 'woocommerce'); ?>:</label>
-												<?php if ($tax->attribute_type=="select") : ?>
-													<select multiple="multiple" data-placeholder="<?php _e('Select terms', 'woocommerce'); ?>" class="multiselect attribute_values" name="attribute_values[<?php echo $i; ?>][]">
+												<label><?php _e( 'Value(s)', 'woocommerce' ); ?>:</label>
+												<?php if ( $tax->attribute_type == "select" ) : ?>
+													<select multiple="multiple" data-placeholder="<?php _e( 'Select terms', 'woocommerce' ); ?>" class="multiselect attribute_values" name="attribute_values[<?php echo $i; ?>][]">
 														<?php
 							        					$all_terms = get_terms( $attribute_taxonomy_name, 'orderby=name&hide_empty=0' );
-						        						if ($all_terms) :
-							        						foreach ($all_terms as $term) :
-							        							$has_term = ( has_term( $term->slug, $attribute_taxonomy_name, $thepostid ) ) ? 1 : 0;
-							        							echo '<option value="'.$term->slug.'" '.selected($has_term, 1, false).'>'.$term->name.'</option>';
-															endforeach;
-														endif;
+						        						if ( $all_terms ) {
+							        						foreach ( $all_terms as $term ) {
+							        							$has_term = has_term( $term->slug, $attribute_taxonomy_name, $thepostid ) ? 1 : 0;
+							        							echo '<option value="' . $term->slug . '" ' . selected( $has_term, 1, false ) . '>' . $term->name . '</option>';
+															}
+														}
 														?>
 													</select>
 
-													<button class="button plus select_all_attributes"><?php _e('Select all', 'woocommerce'); ?></button> <button class="button minus select_no_attributes"><?php _e('Select none', 'woocommerce'); ?></button>
+													<button class="button plus select_all_attributes"><?php _e( 'Select all', 'woocommerce' ); ?></button> <button class="button minus select_no_attributes"><?php _e( 'Select none', 'woocommerce' ); ?></button>
 
-													<button class="button fr plus add_new_attribute" data-attribute="<?php echo $attribute_taxonomy_name; ?>"><?php _e('Add new', 'woocommerce'); ?></button>
+													<button class="button fr plus add_new_attribute" data-attribute="<?php echo $attribute_taxonomy_name; ?>"><?php _e( 'Add new', 'woocommerce' ); ?></button>
 
-												<?php elseif ($tax->attribute_type=="text") : ?>
+												<?php elseif ( $tax->attribute_type == "text" ) : ?>
 													<input type="text" name="attribute_values[<?php echo $i; ?>]" value="<?php
 
 														// Text attributes should list terms pipe separated
-														if ($post_terms) :
+														if ( $post_terms ) {
 															$values = array();
-															foreach ($post_terms as $term) :
+															foreach ( $post_terms as $term )
 																$values[] = $term->name;
-															endforeach;
-															echo implode('|', $values);
-														endif;
+															echo implode( '|', $values );
+														}
 
-													?>" placeholder="<?php _e('Pipe separate terms', 'woocommerce'); ?>" />
+													?>" placeholder="<?php _e( 'Pipe separate terms', 'woocommerce' ); ?>" />
 												<?php endif; ?>
 											</td>
 										</tr>
 										<tr>
 											<td>
-												<label><input type="checkbox" class="checkbox" <?php if (isset($attribute['is_visible'])) checked($attribute['is_visible'], 1); ?> name="attribute_visibility[<?php echo $i; ?>]" value="1" /> <?php _e('Visible on the product page', 'woocommerce'); ?></label>
+												<label><input type="checkbox" class="checkbox" <?php checked( $attribute['is_visible'], 1 ); ?> name="attribute_visibility[<?php echo $i; ?>]" value="1" /> <?php _e( 'Visible on the product page', 'woocommerce' ); ?></label>
 											</td>
 										</tr>
 										<tr>
 											<td>
 												<div class="enable_variation show_if_variable">
-												<label><input type="checkbox" class="checkbox" <?php if (isset($attribute['is_variation'])) checked($attribute['is_variation'], 1); ?> name="attribute_variation[<?php echo $i; ?>]" value="1" /> <?php _e('Used for variations', 'woocommerce'); ?></label>
+												<label><input type="checkbox" class="checkbox" <?php checked( $attribute['is_variation'], 1 ); ?> name="attribute_variation[<?php echo $i; ?>]" value="1" /> <?php _e( 'Used for variations', 'woocommerce' ); ?></label>
 												</div>
 											</td>
 										</tr>
@@ -397,43 +396,42 @@ function woocommerce_product_data_box() {
 				    }
 
 					// Custom Attributes
-					if ($attributes && sizeof($attributes)>0) foreach ($attributes as $attribute) :
-						if ($attribute['is_taxonomy']) continue;
+					if ( ! empty( $attributes ) ) foreach ( $attributes as $attribute ) {
+						if ( $attribute['is_taxonomy'] ) continue;
 
 						$i++;
 
-			    		$position = (isset($attribute['position'])) ? $attribute['position'] : 0;
-
+			    		$position = empty( $attribute['position'] ) ? 0 : absint( $attribute['position'] );
 						?>
 			    		<div class="woocommerce_attribute wc-metabox closed" rel="<?php echo $position; ?>">
 							<h3>
-								<button type="button" class="remove_row button"><?php _e('Remove', 'woocommerce'); ?></button>
-								<div class="handlediv" title="<?php _e('Click to toggle', 'woocommerce'); ?>"></div>
-								<strong class="attribute_name"><?php echo apply_filters( 'woocommerce_attribute_label', esc_attr( $attribute['name'] ), esc_attr( $attribute['name'] ) ); ?></strong>
+								<button type="button" class="remove_row button"><?php _e( 'Remove', 'woocommerce' ); ?></button>
+								<div class="handlediv" title="<?php _e( 'Click to toggle', 'woocommerce' ); ?>"></div>
+								<strong class="attribute_name"><?php echo apply_filters( 'woocommerce_attribute_label', esc_html( $attribute['name'] ), esc_html( $attribute['name'] ) ); ?></strong>
 							</h3>
 							<table cellpadding="0" cellspacing="0" class="woocommerce_attribute_data wc-metabox-content">
 								<tbody>
 									<tr>
 										<td class="attribute_name">
-											<label><?php _e('Name', 'woocommerce'); ?>:</label>
+											<label><?php _e( 'Name', 'woocommerce' ); ?>:</label>
 											<input type="text" class="attribute_name" name="attribute_names[<?php echo $i; ?>]" value="<?php echo esc_attr( $attribute['name'] ); ?>" />
 											<input type="hidden" name="attribute_position[<?php echo $i; ?>]" class="attribute_position" value="<?php echo esc_attr( $position ); ?>" />
 											<input type="hidden" name="attribute_is_taxonomy[<?php echo $i; ?>]" value="0" />
 										</td>
 										<td rowspan="3">
-											<label><?php _e('Value(s)', 'woocommerce'); ?>:</label>
-											<textarea name="attribute_values[<?php echo $i; ?>]" cols="5" rows="5" placeholder="<?php _e('Enter some text, or some attributes by pipe (|) separating values.', 'woocommerce'); ?>"><?php echo esc_textarea( $attribute['value'] ); ?></textarea>
+											<label><?php _e( 'Value(s)', 'woocommerce' ); ?>:</label>
+											<textarea name="attribute_values[<?php echo $i; ?>]" cols="5" rows="5" placeholder="<?php _e( 'Enter some text, or some attributes by pipe (|) separating values.', 'woocommerce' ); ?>"><?php echo esc_textarea( $attribute['value'] ); ?></textarea>
 										</td>
 									</tr>
 									<tr>
 										<td>
-											<label><input type="checkbox" class="checkbox" <?php checked($attribute['is_visible'], 1); ?> name="attribute_visibility[<?php echo $i; ?>]" value="1" /> <?php _e('Visible on the product page', 'woocommerce'); ?></label>
+											<label><input type="checkbox" class="checkbox" <?php checked( $attribute['is_visible'], 1 ); ?> name="attribute_visibility[<?php echo $i; ?>]" value="1" /> <?php _e( 'Visible on the product page', 'woocommerce' ); ?></label>
 										</td>
 									</tr>
 									<tr>
 										<td>
 											<div class="enable_variation show_if_variable">
-											<label><input type="checkbox" class="checkbox" <?php checked($attribute['is_variation'], 1); ?> name="attribute_variation[<?php echo $i; ?>]" value="1" /> <?php _e('Used for variations', 'woocommerce'); ?></label>
+											<label><input type="checkbox" class="checkbox" <?php checked( $attribute['is_variation'], 1 ); ?> name="attribute_variation[<?php echo $i; ?>]" value="1" /> <?php _e( 'Used for variations', 'woocommerce' ); ?></label>
 											</div>
 										</td>
 									</tr>
@@ -441,69 +439,72 @@ function woocommerce_product_data_box() {
 							</table>
 						</div>
 						<?php
-					endforeach;
+					}
 				?>
 			</div>
 
 			<p class="toolbar">
-				<button type="button" class="button button-primary add_attribute"><?php _e('Add', 'woocommerce'); ?></button>
+				<button type="button" class="button button-primary add_attribute"><?php _e( 'Add', 'woocommerce' ); ?></button>
 				<select name="attribute_taxonomy" class="attribute_taxonomy">
-					<option value=""><?php _e('Custom product attribute', 'woocommerce'); ?></option>
+					<option value=""><?php _e( 'Custom product attribute', 'woocommerce' ); ?></option>
 					<?php
-						if ( $attribute_taxonomies ) :
-					    	foreach ($attribute_taxonomies as $tax) :
-					    		$attribute_taxonomy_name = $woocommerce->attribute_taxonomy_name($tax->attribute_name);
-					    		$label = ($tax->attribute_label) ? $tax->attribute_label : $tax->attribute_name;
-					    		echo '<option value="'.$attribute_taxonomy_name.'">'.$label.'</option>';
-					    	endforeach;
-					    endif;
+						if ( $attribute_taxonomies ) {
+					    	foreach ( $attribute_taxonomies as $tax ) {
+					    		$attribute_taxonomy_name = $woocommerce->attribute_taxonomy_name( $tax->attribute_name );
+					    		$label = $tax->attribute_label ? $tax->attribute_label : $tax->attribute_name;
+					    		echo '<option value="' . esc_attr( $attribute_taxonomy_name ) . '">' . esc_html( $label ) . '</option>';
+					    	}
+					    }
 					?>
 				</select>
 			</p>
-
 			<div class="clear"></div>
 		</div>
 		<div id="related_product_data" class="panel woocommerce_options_panel">
 
-			<p class="form-field"><label for="upsell_ids"><?php _e('Up-Sells', 'woocommerce'); ?></label>
-			<select id="upsell_ids" name="upsell_ids[]" class="ajax_chosen_select_products" multiple="multiple" data-placeholder="<?php _e('Search for a product&hellip;', 'woocommerce'); ?>">
+			<p class="form-field"><label for="upsell_ids"><?php _e( 'Up-Sells', 'woocommerce' ); ?></label>
+			<select id="upsell_ids" name="upsell_ids[]" class="ajax_chosen_select_products" multiple="multiple" data-placeholder="<?php _e( 'Search for a product&hellip;', 'woocommerce' ); ?>">
 				<?php
-					$product_ids = get_post_meta( $post->ID, '_upsell_ids', true );
-					if ($product_ids) {
-						foreach ($product_ids as $product_id) {
-							$title 	= get_the_title($product_id);
-							$sku 	= get_post_meta($product_id, '_sku', true);
+					$product_ids = array_map( 'absint', get_post_meta( $post->ID, '_upsell_ids', true ) );
+					if ( $product_ids ) {
+						foreach ( $product_ids as $product_id ) {
+							$title 	= get_the_title( $product_id );
+							$sku 	= get_post_meta( $product_id, '_sku', true );
+							
+							if ( ! $title ) 
+								continue;
+								
+							if ( ! empty( $sku ) ) 
+								$sku = ' (SKU: ' . $sku . ')';
 
-							if (!$title) continue;
-
-							if (isset($sku) && $sku) $sku = ' (SKU: ' . $sku . ')';
-
-							echo '<option value="'.$product_id.'" selected="selected">'. $title . $sku .'</option>';
+							echo '<option value="' . esc_attr( $product_id ) . '" selected="selected">' . esc_html( $title . $sku ) . '</option>';
 						}
 					}
 				?>
-			</select> <img class="help_tip" data-tip='<?php _e('Up-sells are products which you recommend instead of the currently viewed product, for example, products that are more profitable or better quality or more expensive.', 'woocommerce') ?>' src="<?php echo $woocommerce->plugin_url(); ?>/assets/images/help.png" /></p>
+			</select> <img class="help_tip" data-tip='<?php _e( 'Up-sells are products which you recommend instead of the currently viewed product, for example, products that are more profitable or better quality or more expensive.', 'woocommerce' ) ?>' src="<?php echo $woocommerce->plugin_url(); ?>/assets/images/help.png" /></p>
 
-			<p class="form-field"><label for="crosssell_ids"><?php _e('Cross-Sells', 'woocommerce'); ?></label>
-			<select id="crosssell_ids" name="crosssell_ids[]" class="ajax_chosen_select_products" multiple="multiple" data-placeholder="<?php _e('Search for a product&hellip;', 'woocommerce'); ?>">
+			<p class="form-field"><label for="crosssell_ids"><?php _e( 'Cross-Sells', 'woocommerce' ); ?></label>
+			<select id="crosssell_ids" name="crosssell_ids[]" class="ajax_chosen_select_products" multiple="multiple" data-placeholder="<?php _e( 'Search for a product&hellip;', 'woocommerce' ); ?>">
 				<?php
-					$product_ids = get_post_meta( $post->ID, '_crosssell_ids', true );
-					if ($product_ids) {
-						foreach ($product_ids as $product_id) {
-							$title 	= get_the_title($product_id);
-							$sku 	= get_post_meta($product_id, '_sku', true);
+					$product_ids = array_map( 'absint', get_post_meta( $post->ID, '_crosssell_ids', true ) );
+					if ( $product_ids ) {
+						foreach ( $product_ids as $product_id ) {
+							$title 	= get_the_title( $product_id );
+							$sku 	= get_post_meta( $product_id, '_sku', true );
+							
+							if ( ! $title ) 
+								continue;
+								
+							if ( ! empty( $sku ) ) 
+								$sku = ' (SKU: ' . $sku . ')';
 
-							if (!$title) continue;
-
-							if (isset($sku) && $sku) $sku = ' (SKU: ' . $sku . ')';
-
-							echo '<option value="'.$product_id.'" selected="selected">'. $title . $sku .'</option>';
+							echo '<option value="' . esc_attr( $product_id ) . '" selected="selected">' . esc_html( $title . $sku ) . '</option>';
 						}
 					}
 				?>
-			</select> <img class="help_tip" data-tip='<?php _e('Cross-sells are products which you promote in the cart, based on the current product.', 'woocommerce') ?>' src="<?php echo $woocommerce->plugin_url(); ?>/assets/images/help.png" /></p>
+			</select> <img class="help_tip" data-tip='<?php _e( 'Cross-sells are products which you promote in the cart, based on the current product.', 'woocommerce' ) ?>' src="<?php echo $woocommerce->plugin_url(); ?>/assets/images/help.png" /></p>
 
-			<?php do_action('woocommerce_product_options_related'); ?>
+			<?php do_action( 'woocommerce_product_options_related' ); ?>
 
 		</div>
 
@@ -514,14 +515,14 @@ function woocommerce_product_data_box() {
 			echo '<div class="options_group hide_if_external">';
 
 				// Purchase note
-				woocommerce_wp_textarea_input(  array( 'id' => '_purchase_note', 'label' => __('Purchase Note', 'woocommerce'), 'description' => __('Enter an optional note to send the customer after purchase.', 'woocommerce') ) );
+				woocommerce_wp_textarea_input(  array( 'id' => '_purchase_note', 'label' => __( 'Purchase Note', 'woocommerce' ), 'description' => __( 'Enter an optional note to send the customer after purchase.', 'woocommerce' ) ) );
 
 			echo '</div>';
 
 			echo '<div class="options_group">';
 
 				// menu_order
-				woocommerce_wp_text_input(  array( 'id' => 'menu_order', 'label' => __('Menu order', 'woocommerce'), 'description' => __('Custom ordering position.', 'woocommerce'), 'value' => $post->menu_order ) );
+				woocommerce_wp_text_input(  array( 'id' => 'menu_order', 'label' => __( 'Menu order', 'woocommerce' ), 'description' => __( 'Custom ordering position.', 'woocommerce' ), 'value' => intval( $post->menu_order ) ) );
 
 			echo '</div>';
 
@@ -529,48 +530,50 @@ function woocommerce_product_data_box() {
 
 				// List Grouped products
 				$post_parents = array();
-				$post_parents[''] = __('Choose a grouped product&hellip;', 'woocommerce');
+				$post_parents[''] = __( 'Choose a grouped product&hellip;', 'woocommerce' );
 
-				$posts_in = array_unique((array) get_objects_in_term( get_term_by( 'slug', 'grouped', 'product_type' )->term_id, 'product_type' ));
-				if (sizeof($posts_in)>0) :
+				$posts_in = array_unique( (array) get_objects_in_term( get_term_by( 'slug', 'grouped', 'product_type' )->term_id, 'product_type' ) );
+				if ( sizeof( $posts_in ) > 0 ) {
 					$args = array(
-						'post_type'	=> 'product',
-						'post_status' => 'any',
-						'numberposts' => -1,
-						'orderby' => 'title',
-						'order' => 'asc',
-						'post_parent' => 0,
-						'include' => $posts_in,
+						'post_type'		=> 'product',
+						'post_status' 	=> 'any',
+						'numberposts' 	=> -1,
+						'orderby' 		=> 'title',
+						'order' 		=> 'asc',
+						'post_parent' 	=> 0,
+						'include' 		=> $posts_in,
 					);
-					$grouped_products = get_posts($args);
-					$loop = 0;
-					if ($grouped_products) : foreach ($grouped_products as $product) :
+					$grouped_products = get_posts( $args );
 
-						if ($product->ID==$post->ID) continue;
+					if ( $grouped_products ) {
+						foreach ( $grouped_products as $product ) {
 
-						$post_parents[$product->ID] = $product->post_title;
+							if ( $product->ID == $post->ID ) 
+								continue;
 
-					endforeach; endif;
-				endif;
+							$post_parents[ $product->ID ] = $product->post_title;
+						}
+					}
+				}
 
-				woocommerce_wp_select( array( 'id' => 'parent_id', 'label' => __('Grouping', 'woocommerce'), 'value' => $post->post_parent, 'options' => $post_parents ) );
+				woocommerce_wp_select( array( 'id' => 'parent_id', 'label' => __( 'Grouping', 'woocommerce' ), 'value' => absint( $post->post_parent ), 'options' => $post_parents ) );
 
-				do_action('woocommerce_product_options_grouping');
+				do_action( 'woocommerce_product_options_grouping' );
 
 			echo '</div>';
 
 			echo '<div class="options_group reviews">';
 
-				woocommerce_wp_checkbox( array( 'id' => 'comment_status', 'label' => __('Enable reviews', 'woocommerce'), 'cbvalue' => 'open', 'value' => $post->comment_status ) );
+				woocommerce_wp_checkbox( array( 'id' => 'comment_status', 'label' => __( 'Enable reviews', 'woocommerce' ), 'cbvalue' => 'open', 'value' => esc_attr( $post->comment_status ) ) );
 
-				do_action('woocommerce_product_options_reviews');
+				do_action( 'woocommerce_product_options_reviews' );
 
 			echo '</div>';
 			?>
 
 		</div>
 
-		<?php do_action('woocommerce_product_write_panels'); ?>
+		<?php do_action( 'woocommerce_product_write_panels' ); ?>
 
 	</div>
 	<?php
@@ -955,11 +958,13 @@ add_action('woocommerce_process_product_meta', 'woocommerce_process_product_meta
  * @return void
  */
 function woocommerce_change_insert_into_post( $translation, $original ) {
-    if( !isset( $_REQUEST['from'] ) ) return $translation;
+    if ( ! isset( $_REQUEST['from'] ) ) 
+    	return $translation;
 
-	$original = strtolower($original);
+	$original = strtolower( $original );
 
-    if( $_REQUEST['from'] == 'wc01' && ($original == 'insert into post' || $original == 'use this image') ) return __('Use this file', 'woocommerce' );
+    if ( $_REQUEST['from'] == 'wc01' && ( $original == 'insert into post' || $original == 'use this image' ) ) 
+    	return __( 'Use this file', 'woocommerce' );
 
     return $translation;
 }
@@ -979,54 +984,47 @@ function woocommerce_product_data_visibility() {
 	if ( $post->post_type != 'product' )
 		return;
 
-	$current_visibility = get_post_meta( $post->ID, '_visibility', true );
-	$current_featured = get_post_meta( $post->ID, '_featured', true );
+	$current_visibility = ( $current_visibility = get_post_meta( $post->ID, '_visibility', true ) ) ? $current_visibility : 'visible';
+	$current_featured 	= ( $current_featured = get_post_meta( $post->ID, '_featured', true ) ) ? $current_featured : 'no';
 
-	$visibility_options = apply_filters('woocommerce_product_visibility_options', array(
-		'visible' => __('Catalog/search', 'woocommerce'),
-		'catalog' => __('Catalog', 'woocommerce'),
-		'search' => __('Search', 'woocommerce'),
-		'hidden' => __('Hidden', 'woocommerce')
+	$visibility_options = apply_filters( 'woocommerce_product_visibility_options', array(
+		'visible' 	=> __( 'Catalog/search', 'woocommerce' ),
+		'catalog' 	=> __( 'Catalog', 'woocommerce' ),
+		'search' 	=> __( 'Search', 'woocommerce' ),
+		'hidden' 	=> __( 'Hidden', 'woocommerce' )
 	) );
-
-	if ( ! $current_visibility )
-		$current_visibility = 'visible';
-
-	if ( ! $current_featured )
-		$current_featured = 'no';
 	?>
 	<div class="misc-pub-section" id="catalog-visibility">
-		<?php _e('Catalog visibility:', 'woocommerce'); ?> <strong id="catalog-visibility-display"><?php
+		<?php _e( 'Catalog visibility:', 'woocommerce' ); ?> <strong id="catalog-visibility-display"><?php
 
 			echo isset( $visibility_options[ $current_visibility ]  ) ? esc_html( $visibility_options[ $current_visibility ] ) : esc_html( $current_visibility );
 
 			if ( $current_featured == 'yes' )
-				echo ', ' . __('Featured', 'woocommerce');
-
+				echo ', ' . __( 'Featured', 'woocommerce' );
 		?></strong>
 
-		<a href="#catalog-visibility" class="edit-catalog-visibility hide-if-no-js"><?php _e('Edit'); ?></a>
+		<a href="#catalog-visibility" class="edit-catalog-visibility hide-if-no-js"><?php _e( 'Edit', 'woocommerce' ); ?></a>
 
 		<div id="catalog-visibility-select" class="hide-if-js">
 
-			<input type="hidden" name="current_visibilty" id="current_visibilty" value="<?php echo $current_visibility; ?>" />
-			<input type="hidden" name="current_featured" id="current_featured" value="<?php echo $current_featured; ?>" />
+			<input type="hidden" name="current_visibilty" id="current_visibilty" value="<?php echo esc_attr( $current_visibility ); ?>" />
+			<input type="hidden" name="current_featured" id="current_featured" value="<?php echo esc_attr( $current_featured ); ?>" />
 
 			<?php
-				echo '<p>' . __('Define the loops this product should be visible in. The product will still be accessible directly.', 'woocommerce') . '</p>';
+				echo '<p>' . __( 'Define the loops this product should be visible in. The product will still be accessible directly.', 'woocommerce' ) . '</p>';
 
 				foreach ( $visibility_options as $name => $label ) {
-					echo '<input type="radio" name="_visibility" id="_visibility_' . $name . '" value="' . $name . '" ' . checked( $current_visibility, $name, false ). ' data-label="' . $label . '" /> <label for="_visibility_' . $name . '" class="selectit">' . $label . '</label><br />';
+					echo '<input type="radio" name="_visibility" id="_visibility_' . esc_attr( $name ) . '" value="' . esc_attr( $name ) . '" ' . checked( $current_visibility, $name, false ) . ' data-label="' . esc_attr( $label ) . '" /> <label for="_visibility_' . esc_attr( $name ) . '" class="selectit">' . esc_html( $label ) . '</label><br />';
 				}
 
-				echo '<p>' . __('Enable this option to feature this product.', 'woocommerce') . '</p>';
+				echo '<p>' . __( 'Enable this option to feature this product.', 'woocommerce' ) . '</p>';
 
-				echo '<input type="checkbox" name="_featured" id="_featured" ' . checked( $current_featured, 'yes', false ). ' /> <label for="_featured">' . __('Featured Product', 'woocommerce') . '</label><br />';
+				echo '<input type="checkbox" name="_featured" id="_featured" ' . checked( $current_featured, 'yes', false ) . ' /> <label for="_featured">' . __( 'Featured Product', 'woocommerce' ) . '</label><br />';
 			?>
 
 			<p>
-			 <a href="#catalog-visibility" class="save-post-visibility hide-if-no-js button"><?php _e('OK'); ?></a>
-			 <a href="#catalog-visibility" class="cancel-post-visibility hide-if-no-js"><?php _e('Cancel'); ?></a>
+			 <a href="#catalog-visibility" class="save-post-visibility hide-if-no-js button"><?php _e( 'OK', 'woocommerce' ); ?></a>
+			 <a href="#catalog-visibility" class="cancel-post-visibility hide-if-no-js"><?php _e( 'Cancel', 'woocommerce' ); ?></a>
 			</p>
 
 		</div>