…Default` sniff

> htmlspecialchars(), htmlentities(), htmlspecialchars_decode(),
> html_entitity_decode() and get_html_translation_table() now use
> ENT_QUOTES | ENT_SUBSTITUTE rather than ENT_COMPAT by default. This means
> that ' is escaped to ' while previously it was left alone.
> Additionally, malformed UTF-8 will be replaced by a Unicode substitution
> character, instead of resulting in an empty string.

Refs:
* https://github.com/php/php-src/blob/28a1a6be0873a109cb02ba32784bf046b87a02e4/UPGRADING#L149-L154
* php/php-src@50eca61

This new sniff will detect and flag use of these function without explicitly passing the `$flags` parameter when `testVersion` includes both PHP < 8.1 as well as PHP 8.1+.

Note: the extra `ENT_HTML401` addition is a documentation-only change as the value of the constant is `0`, so has no effect on the bitwise value of the flag.

Includes unit tests.
Includes sniff documentation.

wimg approved these changes Dec 5, 2022

wimg deleted the php-8.1/new-htmlentitiesflagdefault-sniff branch

jrfnl mentioned this pull request