Custom WordPress Query: CPT Related Tax Terms

functions.php

<?php 

// Validate and sanitize the ID of the current post
$portfolio_id = ( isset( $_GET['post'] ) && ctype_digit( $_GET['post'] ) ) ? $_GET['post'] : '';
$portfolio_id = filter_var( $portfolio_id, FILTER_SANITIZE_NUMBER_INT );

// Verify the nonce before processing the form submission
if ( isset( $_POST['submit_related_portfolio'] ) && wp_verify_nonce( $_POST['related_portfolio_nonce'], 'related_portfolio' ) ) {

    // Sanitize the input data
    $charcoal_terms = ( isset( $_POST['charcoal_terms'] ) ) ? sanitize_text_field( $_POST['charcoal_terms'] ) : '';

    // If there are any charcoal terms associated with this post, retrieve related portfolio items
    if ( ! empty( $charcoal_terms ) ) {
        $args = array(
            'post_type' => 'portfolio',
            'tax_query' => array(
                array(
                    'taxonomy' => 'charcoal',
                    'field' => 'slug',
                    'terms' => $charcoal_terms // use the sanitized input data
                )
            ),
            'post__not_in' => array( $portfolio_id ), // exclude the current portfolio item from the results
            'posts_per_page' => 3 // show up to 3 related portfolio items
        );
        
        $related_portfolio_query = new WP_Query( $args ); // run the custom query

        if ( $related_portfolio_query->have_posts() ) { ?>
            <div class="related-portfolio">
                <h2>Related Portfolio Items</h2>
                
                <div class="row">
                    <?php while ( $related_portfolio_query->have_posts() ) {
                        $related_portfolio_query->the_post(); ?>

                        <div class="col-md-4 mb-4">
                            <a href="<?php the_permalink(); ?>">
                                <?php the_post_thumbnail( 'medium_large', array( 'class' => 'img-fluid' ) ); ?>
                            </a>
                            <h3 class="mt-2"><a href="<?php the_permalink(); ?>"><?php the_title(); ?></a></h3>
                        </div>
                    
                    <?php } ?>
                </div><!-- .row -->
            </div><!-- .related-portfolio -->

            <?php wp_reset_postdata();
        }
    }
} ?>

<div id="primary" class="content-area">
    <main id="main" class="site-main">
        
        <?php
        while ( have_posts() ) :
            the_post();

            get_template_part( 'template-parts/content', 'portfolio' );

            // Add a nonce field to the related portfolio form
            $nonce = wp_create_nonce( 'related_portfolio' );
            ?>

            <form method="post" action="">
                <input type="hidden" name="related_portfolio_nonce" value="<?php echo esc_attr( $nonce ); ?>" />

                <label for="charcoal_terms">Related Portfolio Items:</label>
                <?php 
                // Get the charcoal terms associated with this post
                $terms = get_the_terms( $portfolio_id, 'charcoal' );

                if ( ! empty( $terms ) && ! is_wp_error( $terms ) ) { ?>
                    <select name="charcoal_terms" id="charcoal_terms">
                        <option value="">Select a Charcoal Term</option>
                        <?php foreach( $terms as $term ) { ?>
                            <option value="<?php echo esc_attr( $term->slug ); ?>"><?php echo esc_html( $term->name ); ?></option>
                        <?php } ?>
                    </select>
                <?php } ?>

                <input type="submit" name="submit_related_portfolio" value="Show Related Portfolio Items" />
            </form>

        <?php endwhile; // End of the loop. ?>
    
    </main><!-- #main -->
</div><!-- #primary -->

<?php
get_footer();

/*
Validated and sanitized the ID of the current post using isset(), ctype_digit(), and filter_var() functions.
Added a nonce field to the related portfolio form using wp_create_nonce() and esc_attr() functions.
Verified the nonce using the wp_verify_nonce() function before processing the form submission.
Sanitized the input data using sanitize_text_field() function.
Used esc_html() and esc_attr() functions to escape the output of dynamic data displayed on the page.
Retrieved the charcoal terms associated with the current post using the get_the_terms() function.
*/