PHP 8.1+ and 8.4 deprecation notices: FILTER_SANITIZE_STRING and fgetcsv/fputcsv without $escape #1395

Description

Visualizer 4.0.9 (also current development) triggers deprecation notices on newer PHP versions. Nothing breaks today, but the notices fill debug logs, and the FILTER_SANITIZE_STRING calls will fail once PHP removes the constant.

1. FILTER_SANITIZE_STRING (deprecated since PHP 8.1)

classes/Visualizer/Module/Chart.php, getCharts():

• line 349: filter_input( INPUT_GET, 's', FILTER_SANITIZE_STRING )
• line 352: filter_input( INPUT_GET, 'filter', FILTER_SANITIZE_STRING )

getCharts() feeds the chart list in the editor's add-chart modal, so on PHP 8.1+ with debug logging on, a notice is logged every time the list loads.

$filter is only compared against Visualizer_Plugin::getChartTypes() with a strict in_array(), so the replacement just needs to give back a plain string. For example:

$filter = isset( $_GET['s'] ) ? sanitize_text_field( wp_unslash( $_GET['s'] ) ) : '';

(same for filter).

2. fgetcsv() / fputcsv() without an explicit $escape (deprecated in PHP 8.4)

PHP 8.4 deprecates relying on the default $escape value. 9 call sites:

• classes/Visualizer/Source/Csv.php lines 64, 77, 158, 161 (CSV import, fgetcsv)
• classes/Visualizer/Module.php lines 288 (fputcsv), 292, 310 (fgetcsv) (CSV export)
• classes/Visualizer/Module/Chart.php line 1262 (fputcsv)
• classes/Visualizer/Module/Abilities.php line 1212 (fputcsv)

To keep the current behavior, pass the old default explicitly, '\\', along with the delimiter and enclosure where they're missing, e.g.:

fgetcsv( $handle, 0, VISUALIZER_CSV_DELIMITER, VISUALIZER_CSV_ENCLOSURE, '\\' );
fputcsv( $fp, $row, ',', '"', '\\' );

(Plugin requires PHP 7.4, where the 5th argument already exists, so no version check is needed.)

Steps to reproduce

1. PHP 8.4 (or 8.1+ for part 1), WP_DEBUG and WP_DEBUG_LOG on.
2. Edit a post and open the Visualizer add-chart modal: FILTER_SANITIZE_STRING deprecation logged from Chart.php 349/352.
3. Import a chart from a CSV file, then export a chart as CSV: fgetcsv()/fputcsv() "the $escape parameter must be provided" deprecations logged.

Expected

No deprecation notices on PHP 8.1 through 8.4.

Customer report: https://secure.helpscout.net/conversation/3481258997/