From 4825da8e49c302392fe6018862dfcdd6f91c6192 Mon Sep 17 00:00:00 2001 From: Claude Sonnet 5 Date: Mon, 17 Aug 2026 19:09:41 +0000 Subject: Guard valid_keyval()/valid_input() against null input (PHP 8.1 deprecation) These two functions are the single most common entry point in the codebase — ~30+ files call them as valid_keyval($_GET["My_key"]) or valid_input($_POST[...]) with no isset() guard at the call site. When the key is absent, PHP passes null straight into trim(), which is a non-nullable string parameter. As of PHP 8.1 this triggers a "Passing null to parameter #1 ($string) ... is deprecated" notice on every one of those call sites, on every request missing the param. Coalescing to '' inside the two functions themselves fixes this once, for every caller, instead of patching every call site individually. Verified empirically against PHP 8.3.28: valid_keyval(null) / valid_input(null) no longer emit the trim() deprecation notice and still return '' as before (same effective behavior as PHP 7.4). Reviewed by: Frederick M Muriithi --- sourcecodes/input_validate.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'sourcecodes/input_validate.php') diff --git a/sourcecodes/input_validate.php b/sourcecodes/input_validate.php index f5d5a4fc..06843a57 100644 --- a/sourcecodes/input_validate.php +++ b/sourcecodes/input_validate.php @@ -3,7 +3,7 @@ function valid_keyval($keyval) { - $keyval = trim($keyval); + $keyval = trim((string)($keyval ?? '')); $keyval = stripslashes($keyval); $keyval = htmlspecialchars($keyval); //check if keyval contains only uppercase or lowercase letters. @@ -19,7 +19,7 @@ function valid_keyval($keyval) function valid_input($input) { - $input = trim($input); + $input = trim((string)($input ?? '')); $input = stripslashes($input); $input = htmlspecialchars($input); //check if keyval contains only letters, numbers, hyphens, underscore, periods, or whitespace. -- cgit 1.4.1