Repository navigation
PHP 8.1+ and 8.4 deprecation notices: FILTER_SANITIZE_STRING and fgetcsv/fputcsv without $escape #1395
Description
Description
Visualizer 4.0.9 (also current development) triggers deprecation notices on newer PHP versions. Nothing breaks today, but the notices fill debug logs, and the FILTER_SANITIZE_STRING calls will fail once PHP removes the constant.
1. FILTER_SANITIZE_STRING (deprecated since PHP 8.1)
classes/Visualizer/Module/Chart.php, getCharts():
- line 349:
filter_input( INPUT_GET, 's', FILTER_SANITIZE_STRING ) - line 352:
filter_input( INPUT_GET, 'filter', FILTER_SANITIZE_STRING )
getCharts() feeds the chart list in the editor's add-chart modal, so on PHP 8.1+ with debug logging on, a notice is logged every time the list loads.
$filter is only compared against Visualizer_Plugin::getChartTypes() with a strict in_array(), so the replacement just needs to give back a plain string. For example:
$filter = isset( $_GET['s'] ) ? sanitize_text_field( wp_unslash( $_GET['s'] ) ) : '';
(same for filter).
2. fgetcsv() / fputcsv() without an explicit $escape (deprecated in PHP 8.4)
PHP 8.4 deprecates relying on the default $escape value. 9 call sites:
classes/Visualizer/Source/Csv.phplines 64, 77, 158, 161 (CSV import,fgetcsv)classes/Visualizer/Module.phplines 288 (fputcsv), 292, 310 (fgetcsv) (CSV export)classes/Visualizer/Module/Chart.phpline 1262 (fputcsv)classes/Visualizer/Module/Abilities.phpline 1212 (fputcsv)
To keep the current behavior, pass the old default explicitly, '\\', along with the delimiter and enclosure where they're missing, e.g.:
fgetcsv( $handle, 0, VISUALIZER_CSV_DELIMITER, VISUALIZER_CSV_ENCLOSURE, '\\' );
fputcsv( $fp, $row, ',', '"', '\\' );
(Plugin requires PHP 7.4, where the 5th argument already exists, so no version check is needed.)
Steps to reproduce
- PHP 8.4 (or 8.1+ for part 1),
WP_DEBUGandWP_DEBUG_LOGon. - Edit a post and open the Visualizer add-chart modal:
FILTER_SANITIZE_STRINGdeprecation logged from Chart.php 349/352. - Import a chart from a CSV file, then export a chart as CSV:
fgetcsv()/fputcsv()"the $escape parameter must be provided" deprecations logged.
Expected
No deprecation notices on PHP 8.1 through 8.4.
Customer report: https://secure.helpscout.net/conversation/3481258997/
Activity
girishpanchal30 commentedon Oct 21, 2026
I have fixed it with PR #1397
pirate-bot commentedon Oct 22, 2026
QA agent — 🟢 Passing checks · The reported PHP deprecations are gone, with CSV behavior preserved.
The chart picker, CSV import, save/reopen and CSV download passed on PHP 8.1 through 8.4 with none of the reported notices. The base build reproduced those notices, while saved rows and downloaded CSV bytes matched the candidate. The PR’s three new tests passed on PHP 8.4 and 7.4. CSV upload used a seeded valid Pro license, not real license activation.
Worth a human look
Checks (4 passed)
Full report, evidence and session trail
kushh23 commentedon Oct 22, 2026
🧪 QA steps and test links
On PHP 8.1 and newer, Visualizer fills the debug log with PHP deprecation notices whenever a chart is created, exported as CSV, or listed in the editor's chart picker. Nothing breaks on screen today, but the notices flood debug logs, and one of them turns into a fatal error once PHP drops the deprecated constant.
Requires: PHP 8.4 with
WP_DEBUGandWP_DEBUG_LOGon, and a way to readdebug.log(a log viewer plugin, for example).fgetcsv()notices, Export CSV loggedfputcsv()/fgetcsv()notices, and the chart picker list logged 2FILTER_SANITIZE_STRINGnotices0419e8aIn the links:
OpenSpout ... Implicitly marking parameter ... as nullable is deprecatednotices show on both links. They come from a bundled library and are not part of this issue.debug.log.Reproduce on Visualizer 4.0.9:
fgetcsv(): the $escape parameter must be provided as its default value will change(and the same forfputcsv()) after steps 2 and 3, andConstant FILTER_SANITIZE_STRING is deprecatedafter step 5.Edge cases
Fix: #1397 (open)