“Constant FILTER_SANITIZE_STRING is deprecated” in WordPress: what to use instead

The message, exactly

A contact form plugin cleans what a visitor typed with the old filter. On PHP 8.0 it runs without a message; from PHP 8.1 on, PHP adds the notice, and PHP 8.5 names the replacement php.net suggests:

<?php
$input = '<b>Tom\'s "best" offer</b>'; // what a visitor typed

$name = filter_var($input, FILTER_SANITIZE_STRING);
echo $name, "\n";

Tom's "best" offer

Deprecated: Constant FILTER_SANITIZE_STRING is deprecated in /var/www/html/wp-content/plugins/contact-form-lite/includes/form.php on line 4
Tom's "best" offer

Deprecated: Constant FILTER_SANITIZE_STRING is deprecated since 8.1, use htmlspecialchars() instead in /var/www/html/wp-content/plugins/contact-form-lite/includes/form.php on line 4
Tom's "best" offer

php.net: “The FILTER_SANITIZE_STRING and FILTER_SANITIZE_STRIPPED filters are deprecated.” (php.net) FILTER_SANITIZE_STRIPPED is another name for the same filter and gets the same notice.

Is it urgent?

No. The result is the same on every version, as the output shows; PHP only adds the notice. It still needs a fix at some point, because a future PHP version is expected to remove what is deprecated today. Update the plugin, or send the message to its developer.

What the old filter did

php.net describes it: “This filter strips tags and HTML-encodes double and single quotes.” (php.net) That is two jobs in one: removing HTML, and making quotes safe inside HTML. It also had a side effect worth knowing: it cut the text at a lone <, as if a tag started there.

<?php
$input = '5 < 6 and <b>bold</b>'; // what a visitor typed

echo 'the old filter: ', filter_var($input, FILTER_SANITIZE_STRING), "\n";
echo 'strip_tags():   ', strip_tags($input), "\n";

the old filter: 5
strip_tags():   5 < 6 and bold

What to use instead

php.net’s note on the filter says: “Deprecated as of PHP 8.1.0, use htmlspecialchars() instead.” (php.net) But htmlspecialchars() does only the second job: it keeps the tags, as visible text. The same input with the plain PHP functions:

<?php
$input = '<b>Tom\'s "best" offer</b>'; // what a visitor typed

echo 'strip_tags():       ', strip_tags($input), "\n";
echo 'htmlspecialchars(): ', htmlspecialchars($input), "\n";
echo 'both:               ', htmlspecialchars(strip_tags($input)), "\n";

strip_tags():       Tom's "best" offer
htmlspecialchars(): <b>Tom's "best" offer</b>
both:               Tom's "best" offer

strip_tags():       Tom's "best" offer
htmlspecialchars(): <b>Tom's "best" offer</b>
both:               Tom's "best" offer

• strip_tags() removes the tags and leaves the quotes as they are.
• htmlspecialchars() keeps the tags as visible text and encodes quotes. On PHP 8.0 it leaves the single quote alone; since PHP 8.1: “This means that ' is escaped to ' while previously nothing was done.” (php.net)
• Both together, on PHP 8.1 and later, give the same text as the old filter, with different but equivalent HTML codes for the quotes.

WordPress has its own function for this, sanitize_text_field(): it “Sanitizes a string from user input or from the database.” (developer.wordpress.org) We ran it on WordPress 7.1.2 with the same two inputs:

$input = '<b>Tom\'s "best" offer</b>';
echo sanitize_text_field( $input ), "\n";

$input = '5 < 6 and <b>bold</b>';
echo sanitize_text_field( $input ), "\n";

Tom's "best" offer
5 < 6 and bold

It removes the tags like strip_tags(), keeps the quotes, and keeps the text after a lone < (written as <). Which one fits depends on where the text goes next, so this is the plugin developer’s decision.

Who fixes it

A check that reads code finds every use of the constant, while your site still runs an older PHP version:

CompatNav reports the constant wherever the code names it. It can’t judge which replacement suits the plugin; that stays with the developer. Other PHP 8.1 notices, such as passing null to a PHP function, depend on values while the site runs, and no code check can find them beforehand. How to keep notices off your pages: Deprecation notice vs fatal error.