In `@inc/admin-pages/class-multisite-setup-admin-page.php`:
- Around line 283-285: The call to wp_die currently uses __() which is flagged
by static analysis; replace the unescaped translation with an escaped
translation function by changing the wp_die call to use esc_html__() instead of
__(), i.e. update the wp_die invocation that follows the
current_user_can('manage_options') check so the message is escaped (refer to the
wp_die(...) and current_user_can(...) usage in
class-multisite-setup-admin-page.php).
- Around line 525-526: Replace the use of PHP's parse_url() with WordPress'
wp_parse_url() for both assignments to $base and $domain to avoid PHP-version
inconsistencies: call wp_parse_url(trailingslashit(get_option('home')),
PHP_URL_PATH) for $base and wp_parse_url(get_option('home'), PHP_URL_HOST) for
$domain (keeping trailingslashit/get_option usage and the PHP_URL_* component
constants) so the code uses WP's URL parser consistently.
- Line 219: Replace uses of PHP's parse_url() with WordPress's wp_parse_url() to
avoid inconsistent outputs across PHP versions: update the assignment that sets
$base_domain (currently using parse_url($home_url, PHP_URL_HOST)) to use
wp_parse_url($home_url)['host'] (or check the returned array safely) and make
the corresponding change inside the display_manual_instructions() function where
parse_url() is used; ensure you handle the wp_parse_url() return structure and
fallback if 'host' is not set.
- Around line 465-500: modify_wp_config() currently uses non‑Yoda conditions and
direct PHP filesystem functions and ignores wp-config.php located one directory
above ABSPATH; update it to use WP_Filesystem for existence/read/write
operations (replace file_exists/is_writable/file_get_contents/file_put_contents
with appropriate WP_Filesystem methods after initializing global
$wp_filesystem), change comparisons to Yoda style (e.g., false === $var checks
for file_get_contents/file_put_contents results and === false for strpos), and
add a fallback check for wp-config.php in the parent directory (try ABSPATH .
'wp-config.php' then dirname(ABSPATH) . '/wp-config.php') before proceeding;
keep the existing logic that checks preg_match for WP_ALLOW_MULTISITE and uses
substr_replace to insert $constant_to_add but perform reads/writes via
$wp_filesystem methods instead of direct PHP calls.
- Around line 579-589: In add_final_multisite_constants(): replace the fragile
exact-string anchor search for "define( 'WP_ALLOW_MULTISITE', true );" with a
regex that matches a define of WP_ALLOW_MULTISITE allowing optional whitespace
and variations (e.g. /define\s*\(\s*'WP_ALLOW_MULTISITE'\s*,\s*true\s*\)\s*;/i),
set $insert_position to the end of that regex match if found; if not found,
fallback to locating the "/* That's all" marker (e.g. strpos($config_content,
"/* That's all") ) and insert the $constants_to_add before that; finally, use a
Yoda-style comparison when writing the file (false !== file_put_contents(...))
and return false only if neither anchor is found or the write fails.

In `@inc/admin-pages/class-multisite-setup-admin-page.php`:
- Around line 646-673: The inline clipboard script added in register_scripts()
targets buttons matching selector
button[onclick*='navigator.clipboard.writeText'] but the manual instructions
render only <pre> blocks (no such buttons), so either remove the dead
wp_add_inline_script call in register_scripts() or add actual copy buttons next
to the rendered <pre> blocks and bind them to navigator.clipboard.writeText;
locate register_scripts(), the wp_add_inline_script(...) block and the query
selector string "button[onclick*='navigator.clipboard.writeText']" to decide
whether to delete the inline script or implement UI buttons that match that
selector and update the click handler accordingly.
- Around line 257-270: The backup_warning 'desc' currently concatenates raw
__('...','multisite-ultimate') outputs into HTML; replace those calls with
escaped versions (esc_html__() or esc_html_e() where appropriate) for the text
nodes inside the HTML string to prevent unescaped translated markup, e.g. change
the __('Before You Continue', 'multisite-ultimate') and the long paragraph
__('Please ensure...', 'multisite-ultimate') usages in the backup_warning array
so they are escaped before concatenation; keep icon/HTML markup intact but
ensure only escaped translation functions are injected into the 'desc' value.
- Around line 229-238: The translatable strings inside the 'subdomain_install'
settings array use placeholders but lack translator context comments; add a /*
translators: ... */ comment immediately above each
__()/esc_html__()/esc_html__() call that contains placeholders to explain what
the placeholders represent (e.g., base domain and example site), so translators
know how to order/translate them; do the same for the other occurrence that uses
esc_html__ with %1$s / %2$s (referenced in the review) so both spots include
clear translators: notes.