Testimonial Details Meta Box

// Post type, and the fields: meta key (saved with a leading underscore) => label and input type.
$wpide_box = array(
    'post_type' => 'testimonial',
    'title'     => 'Testimonial details',
    'fields'    => array(
        'testimonial_name' => array( 'label' => 'Customer name', 'type' => 'text' ),
        'testimonial_role' => array( 'label' => 'Role', 'type' => 'text' ),
        'testimonial_company' => array( 'label' => 'Company', 'type' => 'text' ),
        'testimonial_url' => array( 'label' => 'Website', 'type' => 'url' ),
        'testimonial_rating' => array( 'label' => 'Rating', 'type' => 'select', 'options' => array( '' => '—', '5' => '★★★★★', '4' => '★★★★', '3' => '★★★', '2' => '★★', '1' => '★' ) ),
    ),
);

add_action( 'add_meta_boxes_' . $wpide_box['post_type'], function () use ( $wpide_box ) {
    add_meta_box( 'wpide-testimonial-details', $wpide_box['title'], function ( $post ) use ( $wpide_box ) {
        wp_nonce_field( 'wpide_testimonial_details', 'wpide_testimonial_details_nonce' );
        echo '<div style="display:grid;gap:12px;grid-template-columns:repeat(auto-fill,minmax(220px,1fr))">';

        foreach ( $wpide_box['fields'] as $key => $field ) {
            $value = get_post_meta( $post->ID, '_' . $key, true );
            $id    = 'wpide-' . str_replace( '_', '-', $key );
            echo '<p style="margin:0">';

            if ( 'checkbox' === $field['type'] ) {
                printf( '<label><input type="checkbox" name="%1$s" value="1"%2$s> %3$s</label>', esc_attr( $key ), checked( $value, '1', false ), esc_html( $field['label'] ) );
            } else {
                printf( '<label for="%1$s"><strong>%2$s</strong></label><br>', esc_attr( $id ), esc_html( $field['label'] ) );

                if ( 'textarea' === $field['type'] ) {
                    printf( '<textarea class="widefat" rows="5" id="%1$s" name="%2$s">%3$s</textarea>', esc_attr( $id ), esc_attr( $key ), esc_textarea( $value ) );
                } elseif ( 'select' === $field['type'] ) {
                    printf( '<select class="widefat" id="%1$s" name="%2$s">', esc_attr( $id ), esc_attr( $key ) );
                    foreach ( $field['options'] as $option => $label ) {
                        printf( '<option value="%1$s"%2$s>%3$s</option>', esc_attr( $option ), selected( (string) $value, (string) $option, false ), esc_html( $label ) );
                    }
                    echo '</select>';
                } else {
                    printf( '<input class="widefat" type="%1$s" id="%2$s" name="%3$s" value="%4$s"%5$s>', esc_attr( $field['type'] ), esc_attr( $id ), esc_attr( $key ), esc_attr( $value ), 'number' === $field['type'] ? ' step="any" min="0"' : '' );
                }
            }

            echo '</p>';
        }

        echo '</div>';
    }, $wpide_box['post_type'], 'normal', 'high' );
} );

add_action( 'save_post_' . $wpide_box['post_type'], function ( $post_id ) use ( $wpide_box ) {
    if ( ! isset( $_POST['wpide_testimonial_details_nonce'] ) || ! wp_verify_nonce( sanitize_key( $_POST['wpide_testimonial_details_nonce'] ), 'wpide_testimonial_details' ) ) {
        return;
    }

    if ( wp_is_post_autosave( $post_id ) || wp_is_post_revision( $post_id ) || ! current_user_can( 'edit_post', $post_id ) ) {
        return;
    }

    foreach ( $wpide_box['fields'] as $key => $field ) {
        $raw = isset( $_POST[ $key ] ) ? wp_unslash( $_POST[ $key ] ) : ''; // phpcs:ignore WordPress.Security.ValidatedSanitizedInput -- sanitized below per type.
        $raw = is_string( $raw ) ? $raw : '';

        switch ( $field['type'] ) {
            case 'url':
                $value = esc_url_raw( $raw );
                break;
            case 'email':
                $value = sanitize_email( $raw );
                break;
            case 'number':
                $value = is_numeric( $raw ) ? (string) ( 0 + $raw ) : '';
                break;
            case 'textarea':
                $value = sanitize_textarea_field( $raw );
                break;
            case 'checkbox':
                $value = $raw ? '1' : '';
                break;
            case 'select':
                $value = array_key_exists( $raw, $field['options'] ) ? $raw : '';
                break;
            case 'date':
                $value = preg_match( '/^\d{4}-\d{2}-\d{2}$/', $raw ) ? $raw : '';
                break;
            case 'datetime-local':
                $value = preg_match( '/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}$/', $raw ) ? $raw : '';
                break;
            default:
                $value = sanitize_text_field( $raw );
        }

        if ( '' === $value ) {
            delete_post_meta( $post_id, '_' . $key );
        } else {
            update_post_meta( $post_id, '_' . $key, $value );
        }
    }
} );

add_shortcode( 'testimonial_details', function () {
    $id = get_the_ID();

    if ( ! $id || 'testimonial' !== get_post_type( $id ) ) {
        return '';
    }

    $name    = get_post_meta( $id, '_testimonial_name', true );
    $role    = trim( get_post_meta( $id, '_testimonial_role', true ) . ', ' . get_post_meta( $id, '_testimonial_company', true ), ', ' );
    $url     = get_post_meta( $id, '_testimonial_url', true );
    $rating  = (int) get_post_meta( $id, '_testimonial_rating', true );
    $html    = $rating ? '<span class="testimonial-rating" role="img" aria-label="' . esc_attr( $rating . ' out of 5 stars' ) . '">' . str_repeat( '★', $rating ) . str_repeat( '☆', 5 - $rating ) . '</span> ' : '';
    $name    = $name ? $name : get_the_title( $id );
    $html   .= '<cite>' . ( $url ? '<a href="' . esc_url( $url ) . '" rel="nofollow noopener">' . esc_html( $name ) . '</a>' : esc_html( $name ) ) . '</cite>';

    return '<p class="testimonial-attribution">' . $html . ( $role ? ' <span class="testimonial-role">' . esc_html( $role ) . '</span>' : '' ) . '</p>';
} );