Formatting: Prevent PHP 8.1 deprecation when passing null to esc_url() - #12132
Formatting: Prevent PHP 8.1 deprecation when passing null to esc_url()#12132Dervish12 wants to merge 2 commits into
Conversation
Add a null check to `esc_url()` to prevent the "Passing null to parameter WordPress#1 ($string) of type string is deprecated" notice that occurs on PHP 8.1+ when null is passed to `ltrim()` on line 4545. Multiple WordPress core functions such as `get_edit_post_link()`, `get_edit_comment_link()`, and `get_previous_posts_page_link()` can return null, and their return values are frequently passed directly to `esc_url()` without intermediate null checks. While the individual callers can be guarded (as done in [r62034] for `previous_posts()`), hardening `esc_url()` itself provides defense in depth for all current and future callers, including third-party code. When null is passed, `esc_url()` now returns an empty string, which matches the existing behavior on PHP < 8.1 (where `ltrim(null)` silently returned an empty string). Adds unit tests to validate the behavior for both `esc_url()` and `sanitize_url()`. Follow-up to [r62034]. Props Dervish12. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
|
The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the Core Committers: Use this line as a base for the props when committing in SVN: To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook. |
Test using WordPress PlaygroundThe changes in this pull request can previewed and tested using a WordPress Playground instance. WordPress Playground is an experimental project that creates a full WordPress instance entirely within the browser. Some things to be aware of
For more details about these limitations and more, check out the Limitations page in the WordPress Playground documentation. |
1 participant
Summary
Fix a PHP 8.1+ deprecation notice in
esc_url()whennullis passed as the$urlparameter.Trac ticket: https://core.trac.wordpress.org/ticket/65441
On PHP 8.1+, passing
nulltoesc_url()triggers:This occurs because
esc_url()callsltrim( $url )on line 4545 without first checking fornull. Multiple core functions that returnstring|null(such asget_edit_post_link(),get_edit_comment_link(),get_edit_bookmark_link()) have their return values passed directly toesc_url()throughout the codebase.Fix
Add
null === $urlto the existing empty check, returning an empty string. This matches the pre-PHP 8.1 behavior whereltrim(null)silently returned''.Follow-up to [r62034] which fixed the same pattern in
previous_posts().Tests
test_null_input_returns_empty_string— verifiesesc_url( null )returns''test_sanitize_url_null_input_returns_empty_string— verifiessanitize_url( null )returns''This Pull Request is for code review only. Please keep all other discussion in the Trac ticket. Do not merge this Pull Request. See GitHub Pull Requests for Code Review in the Core Handbook for more details.