PHP 8.1+ and 8.4 deprecation notices: FILTER_SANITIZE_STRING and fgetcsv/fputcsv without $escape

Description

Visualizer 4.0.9 (also current development) triggers deprecation notices on newer PHP versions. Nothing breaks today, but the notices fill debug logs, and the FILTER_SANITIZE_STRING calls will fail once PHP removes the constant.

1. FILTER_SANITIZE_STRING (deprecated since PHP 8.1)

classes/Visualizer/Module/Chart.php, getCharts():

line 349: filter_input( INPUT_GET, 's', FILTER_SANITIZE_STRING )
line 352: filter_input( INPUT_GET, 'filter', FILTER_SANITIZE_STRING )

getCharts() feeds the chart list in the editor's add-chart modal, so on PHP 8.1+ with debug logging on, a notice is logged every time the list loads.

$filter is only compared against Visualizer_Plugin::getChartTypes() with a strict in_array(), so the replacement just needs to give back a plain string. For example:

$filter = isset( $_GET['s'] ) ? sanitize_text_field( wp_unslash( $_GET['s'] ) ) : '';

(same for filter).

2. fgetcsv() / fputcsv() without an explicit $escape (deprecated in PHP 8.4)

PHP 8.4 deprecates relying on the default $escape value. 9 call sites:

classes/Visualizer/Source/Csv.php lines 64, 77, 158, 161 (CSV import, fgetcsv)
classes/Visualizer/Module.php lines 288 (fputcsv), 292, 310 (fgetcsv) (CSV export)
classes/Visualizer/Module/Chart.php line 1262 (fputcsv)
classes/Visualizer/Module/Abilities.php line 1212 (fputcsv)

To keep the current behavior, pass the old default explicitly, '\\', along with the delimiter and enclosure where they're missing, e.g.:

fgetcsv( $handle, 0, VISUALIZER_CSV_DELIMITER, VISUALIZER_CSV_ENCLOSURE, '\\' );
fputcsv( $fp, $row, ',', '"', '\\' );

(Plugin requires PHP 7.4, where the 5th argument already exists, so no version check is needed.)

Steps to reproduce

PHP 8.4 (or 8.1+ for part 1), WP_DEBUG and WP_DEBUG_LOG on.
Edit a post and open the Visualizer add-chart modal: FILTER_SANITIZE_STRING deprecation logged from Chart.php 349/352.
Import a chart from a CSV file, then export a chart as CSV: fgetcsv()/fputcsv() "the $escape parameter must be provided" deprecations logged.

Expected

No deprecation notices on PHP 8.1 through 8.4.

Customer report: https://secure.helpscout.net/conversation/3481258997/

I have fixed it with PR #1397

QA agent — 🟢 Passing checks · The reported PHP deprecations are gone, with CSV behavior preserved.

The chart picker, CSV import, save/reopen and CSV download passed on PHP 8.1 through 8.4 with none of the reported notices. The base build reproduced those notices, while saved rows and downloaded CSV bytes matched the candidate. The PR’s three new tests passed on PHP 8.4 and 7.4. CSV upload used a seeded valid Pro license, not real license activation.

Worth a human look

Check the separate stripslashes(null) deprecation when reopening CSV data with a blank numeric cell; it also occurs on the base build.
Verify manual chart updates through the Abilities REST API after fixing its existing wp_tempnam() error; both builds fail before reaching CSV parsing.
Confirm whether unsupported multi-character VISUALIZER_CSV_ESCAPE values should receive a friendlier configuration error; PHP currently rejects ab with ValueError.

Checks (4 passed)

✅ Opening the editor’s Visualizer chart picker and filtering by chart type returns the matching charts without FILTER_SANITIZE_STRING deprecation notices on PHP 8.1 through 8.4.
✅ Importing a CSV file through the chart editor completes and previews the uploaded chart data without CSV escape-parameter deprecation notices on PHP 8.1 through 8.4.
✅ After a CSV import is saved and the chart is reopened, the chart retains its imported series and rows with the previous backslash-escape behavior.
✅ Exporting the imported chart as CSV downloads its series and rows without CSV escape-parameter deprecation notices on PHP 8.1 through 8.4 and keeps the previous export behavior.

Full report, evidence and session trail

🧪 QA steps and test links

On PHP 8.1 and newer, Visualizer fills the debug log with PHP deprecation notices whenever a chart is created, exported as CSV, or listed in the editor's chart picker. Nothing breaks on screen today, but the notices flood debug logs, and one of them turns into a fatal error once PHP drops the deprecated constant.

Requires: PHP 8.4 with WP_DEBUG and WP_DEBUG_LOG on, and a way to read debug.log (a log viewer plugin, for example).

Link	Build	Bot check
Reproduce the bug	Visualizer 4.0.9 (released)	✅ Reproduced: creating a Pie chart logged 4 `fgetcsv()` notices, Export CSV logged `fputcsv()`/`fgetcsv()` notices, and the chart picker list logged 2 `FILTER_SANITIZE_STRING` notices
Verify the fix	PR #1397 build `0419e8a`	✅ Fixed: same steps logged none of these notices; the export still downloaded the same rows and the picker still filtered to the Pie chart

In the links:

They run PHP 8.4 with debug logging on, skip the setup wizard and the editor welcome guide, and open on Visualizer → Chart Library.
The bot checked step 5 by sending the chart picker's own request rather than clicking through the media window.
Three OpenSpout ... Implicitly marking parameter ... as nullable is deprecated notices show on both links. They come from a bundled library and are not part of this issue.
Tools → QA Logs shows debug.log.

Reproduce on Visualizer 4.0.9:

Visualizer → Chart Library → Add New Chart → Classic Builder.
Pick Pie/Donut, click Next, then Create Chart.
In the Chart Library, click the chart's Export CSV (download) icon.
Posts → Add New Post, add a Classic block and click Add Media.
Click Visualizations in the left menu and pick Pie in the chart type filter.
Open Tools → QA Logs (or your log viewer).

Bug: the log shows fgetcsv(): the $escape parameter must be provided as its default value will change (and the same for fputcsv()) after steps 2 and 3, and Constant FILTER_SANITIZE_STRING is deprecated after step 5.
Fixed: none of these notices appear, the export CSV has the same rows, and the picker still lists only the Pie chart.

Edge cases

Search the chart picker by a chart type name, and clear the filter: the matching charts or all charts show, with no notices.
Export a chart whose data has quotes, commas or a backslash in a cell (edit the data with Edit Data): the CSV keeps the values exactly as before the fix.
Same steps on PHP 7.4 and 8.1: no new warnings or errors, charts and exports behave as before.
Edit an existing chart's data manually and save: the chart keeps its series and rows.

Fix: #1397 (open)

🎉 This issue has been resolved in version 4.0.10 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀

Navigation Menu

Repository navigation

PHP 8.1+ and 8.4 deprecation notices: FILTER_SANITIZE_STRING and fgetcsv/fputcsv without $escape #1395

Description

1. FILTER_SANITIZE_STRING (deprecated since PHP 8.1)

2. fgetcsv() / fputcsv() without an explicit $escape (deprecated in PHP 8.4)

Steps to reproduce

Expected

🧪 QA steps and test links

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

PHP 8.1+ and 8.4 deprecation notices: FILTER_SANITIZE_STRING and fgetcsv/fputcsv without $escape #1395

Description

Description

1. FILTER_SANITIZE_STRING (deprecated since PHP 8.1)

2. fgetcsv() / fputcsv() without an explicit $escape (deprecated in PHP 8.4)

Steps to reproduce

Expected

Activity

girishpanchal30 commented on Oct 21, 2026

pirate-bot commented on Oct 22, 2026

kushh23 commented on Oct 22, 2026

🧪 QA steps and test links

pirate-bot commented on Oct 26, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions