From 043ac0ea462de0f2f8e8f163457653fa160689f1 Mon Sep 17 00:00:00 2001
From: Mike Letellier <mike@crabcyb.org>
Date: Mon, 12 Jan 2026 14:48:01 -0400
Subject: [PATCH] Change how icons are rendered for inserting shortcodes to
 reduce number of phpcs ignore comments for echoing unescaped html

---
 classes/helpers/FrmFormsHelper.php | 21 ++++++++-------------
 1 file changed, 8 insertions(+), 13 deletions(-)

diff --git a/classes/helpers/FrmFormsHelper.php b/classes/helpers/FrmFormsHelper.php
index 5ea6e1f9d6..41e1a65165 100644
--- a/classes/helpers/FrmFormsHelper.php
+++ b/classes/helpers/FrmFormsHelper.php
@@ -701,29 +701,24 @@ public static function insert_opt_html( $args ) {
 
 		$truncated_name = FrmAppHelper::truncate( $args['name'], 60 );
 
-		if ( isset( $field['icon'] ) ) {
-			$icon = FrmAppHelper::icon_by_class(
-				$field['icon'],
-				array(
-					'aria-hidden' => 'true',
-					'echo'        => false,
-				)
-			);
-		} else {
-			$icon = '';
-		}
 		?>
 		<li class="<?php echo esc_attr( $class ); ?>">
 			<a href="javascript:void(0)" class="frmids frm_insert_code" data-code="<?php echo esc_attr( $args['id'] ); ?>">
 				<?php
-				echo FrmAppHelper::kses_icon( $icon ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
+				if ( isset( $field['icon'] ) ) {
+					FrmAppHelper::icon_by_class( $field['icon'], array( 'aria-hidden' => 'true' ) );
+				}
+
 				echo esc_html( $truncated_name );
 				?>
 				<span>[<?php echo esc_attr( $args['id_label'] ?? $args['id'] ); ?>]</span>
 			</a>
 			<a href="javascript:void(0)" class="frmkeys frm_insert_code frm_hidden" data-code="<?php echo esc_attr( $args['key'] ); ?>">
 				<?php
-				echo FrmAppHelper::kses_icon( $icon ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
+				if ( isset( $field['icon'] ) ) {
+					FrmAppHelper::icon_by_class( $field['icon'], array( 'aria-hidden' => 'true' ) );
+				}
+
 				echo esc_html( $truncated_name );
 				?>
 				<span>[<?php echo esc_attr( FrmAppHelper::truncate( $args['key_label'] ?? $args['key'], 7 ) ); ?>]</span>