Fix PHPCS code errors: escaping, nonce order and a PHP 8 join() fatal

readme.txt

@@ -179,6 +179,7 @@ For help with or questions about FakerPress, visit the [WordPress Plugin Forums]
 * Tweak - Clear every JavaScript lint and TypeScript error: WordPress package types, the `@fp` import alias in ESLint, the zod v4 meta-rule schema, `…` in translated strings, and `let`/`const` in the legacy jQuery scripts. [[#236](https://github.com/bordoni/fakerpress/pull/236)]
 * Tweak - Clear every stylelint error in the admin styles with a Tailwind v4 aware config; the compiled CSS is unchanged apart from dropping obsolete `-moz-` gradients and empty rules. [[#237](https://github.com/bordoni/fakerpress/pull/237)]
 * Tweak - PHPCS skips the public hook names, the namespaced Faker formatter names and the generated readme data, each with a documented reason. [[#238](https://github.com/bordoni/fakerpress/pull/238)]
+* Fix - The text provider's sentences, paragraphs and text no longer fatal on PHP 8 (`join()` argument order); the post search verifies its nonce before reading the request; template output is escaped, and batch success messages are translatable. [[#239](https://github.com/bordoni/fakerpress/pull/239)]
 
 = 0.9.2 — 20 of July 2026 =
 

src/FakerPress/Admin.php

@@ -73,12 +73,14 @@ public static function add_message( $html, $type = 'success', $priority = 10 ) {
 		 * @filter fakerpress.messages.allowed_html
 		 * @since 0.1.2
 		 */
-		self::$messages[] = $message = (object) [
+		$message = (object) [
 			'html'     => wp_kses( wpautop( $html ), apply_filters( 'fakerpress.messages.allowed_html', [] ), [ 'http', 'https' ] ),
 			'type'     => esc_attr( $type ),
 			'priority' => $priority === 0 ? $priority + 1 : $priority,
 		];
 
+		self::$messages[] = $message;
+
 		usort( self::$messages, 'FakerPress\sort_by_priority' );
 
 		return $message;
@@ -92,7 +94,7 @@ public static function add_message( $html, $type = 'success', $priority = 10 ) {
 	 * @since 0.1.2
 	 * @return null Actions do not return
 	 */
-	public function _action_admin_notices() {
+	public function _action_admin_notices() { // phpcs:ignore PSR2.Methods.MethodDeclaration.Underscore -- Public hook callback name, renaming breaks third-party remove_action()/remove_filter() calls.
 		foreach ( self::$messages as $k => $message ) {
 			$classes = [
 				// Plugin class to give the styling
@@ -156,13 +158,17 @@ public function get_base_title(): string {
 		 *
 		 * @param string $title Which base title will be used.
 		 */
-		return apply_filters( 'fakerpress.admin.title_base', __( '%s on FakerPress', 'fakerpress' ) );
+		return apply_filters(
+			'fakerpress.admin.title_base',
+			/* translators: %s: Title of the current FakerPress admin page. */
+			__( '%s on FakerPress', 'fakerpress' )
+		);
 	}
 
 	/**
 	 * @todo refactor
 	 */
-	public function _filter_set_admin_page_title( $admin_title, $title ) {
+	public function _filter_set_admin_page_title( $admin_title, $title ) { // phpcs:ignore PSR2.Methods.MethodDeclaration.Underscore -- Public hook callback name, renaming breaks third-party remove_action()/remove_filter() calls.
 		if ( ! $this->is_active() ) {
 			return $admin_title;
 		}
@@ -176,7 +182,7 @@ public function _filter_set_admin_page_title( $admin_title, $title ) {
 		return $admin_title;
 	}
 
-	public function _filter_messages_allowed_html() {
+	public function _filter_messages_allowed_html() { // phpcs:ignore PSR2.Methods.MethodDeclaration.Underscore -- Public hook callback name, renaming breaks third-party remove_action()/remove_filter() calls.
 		return [
 			'a'      => [
 				'class' => [],
@@ -222,12 +228,12 @@ public function _filter_messages_allowed_html() {
 	 * @uses \FakerPress\Plugin::$slug
 	 * @return string
 	 */
-	public function _filter_admin_footer_text( $text ) {
+	public function _filter_admin_footer_text( $text ) { // phpcs:ignore PSR2.Methods.MethodDeclaration.Underscore -- Public hook callback name, renaming breaks third-party remove_action()/remove_filter() calls.
 		if ( ! $this->is_active() ) {
 			return $text;
 		}
 
-		return '<a target="_blank" href="http://wordpress.org/support/plugin/fakerpress#postform">' . esc_attr__( 'Contact Support', 'fakerpress' ) . '</a> | ' .
+		return '<a target="_blank" href="http://wordpress.org/support/plugin/fakerpress#postform">' . esc_html__( 'Contact Support', 'fakerpress' ) . '</a> | ' .
 			str_replace(
 				[ '[stars]', '[wp.org]' ],
 				[
@@ -249,7 +255,7 @@ public function _filter_admin_footer_text( $text ) {
 	 * @uses \FakerPress\Plugin::$slug
 	 * @return string
 	 */
-	public function _filter_update_footer( $text ) {
+	public function _filter_update_footer( $text ) { // phpcs:ignore PSR2.Methods.MethodDeclaration.Underscore -- Public hook callback name, renaming breaks third-party remove_action()/remove_filter() calls.
 		if ( ! $this->is_active() ) {
 			return $text;
 		}
@@ -276,7 +282,7 @@ public function _filter_update_footer( $text ) {
 		return $sponsor . $translate . $version;
 	}
 
-	public function _filter_body_class( $classes ) {
+	public function _filter_body_class( $classes ) { // phpcs:ignore PSR2.Methods.MethodDeclaration.Underscore -- Public hook callback name, renaming breaks third-party remove_action()/remove_filter() calls.
 		$more = [
 			$classes,
 			'__fakerpress',

src/FakerPress/Admin/Menu.php

@@ -3,11 +3,11 @@
 namespace FakerPress\Admin;
 
 use FakerPress\Admin\View\Factory as View_Factory;
-use function FakerPress\make;
-
 use FakerPress\Plugin;
 use FakerPress\Admin;
 
+use function FakerPress\make;
+
 /**
  * Class Menu
  *
@@ -45,10 +45,10 @@ class Menu {
 	 * @param callable|null $callback   A callback to render this menu item.
 	 * @param string|null   $parent     What is the parent menu.
 	 */
-	public static function add( string $slug, $title, $label, string $capability = 'manage_options', int $priority = 10, $callback = null, $parent = null ): void {
+	public static function add( string $slug, $title, $label, string $capability = 'manage_options', int $priority = 10, $callback = null, $parent = null ): void { // phpcs:ignore Universal.NamingConventions.NoReservedKeywordParameterNames.parentFound -- Public API, renaming the parameter breaks callers that pass it as a named argument.
 		$slug = sanitize_key( $slug );
 
-		static::$items[ $slug ] = $menu = (object) [
+		$menu = (object) [
 			'slug'       => $slug,
 			'title'      => esc_attr( $title ),
 			'hook'       => null, // Will be set later from WP.
@@ -59,6 +59,8 @@ public static function add( string $slug, $title, $label, string $capability = '
 			'parent'     => $parent, // Used to set up error page.
 		];
 
+		static::$items[ $slug ] = $menu;
+
 		if ( ! is_callable( $menu->callback ) ) {
 			$menu->callback = static function () use ( $menu ) {
 				$menu = make( Menu::class )->get_current();
@@ -199,7 +201,7 @@ public function register_menus_to_wp() {
 
 		// Change the Default Submenu for FakerPress menus
 		if ( ! empty( $GLOBALS['submenu'][ Plugin::$slug ] ) ) {
-			$GLOBALS['submenu'][ Plugin::$slug ][0][0] = esc_attr__( 'Settings', 'fakerpress' );
+			$GLOBALS['submenu'][ Plugin::$slug ][0][0] = esc_attr__( 'Settings', 'fakerpress' ); // phpcs:ignore WordPress.WP.GlobalVariablesOverride.Prohibited -- Relabels the auto-created first submenu item, which WordPress only exposes through this global.
 		}
 	}
 
@@ -213,7 +215,7 @@ public function register_menus_to_wp() {
 	 *
 	 * @return void
 	 */
-	public function correctly_set_current_screen( $screen ) {
+	public function correctly_set_current_screen( $screen ) { // phpcs:ignore Generic.CodeAnalysis.UnusedFunctionParameter.Found -- Public method called from the current_screen action with the screen argument, kept for BC.
 		$view = make( View_Factory::class )->get_current_view();
 		if ( ! $view ) {
 			return;

src/FakerPress/Admin/View/Attachment_View.php

@@ -97,6 +97,7 @@ public function parse_request() {
 		if ( ! empty( $results ) ) {
 			return Admin::add_message(
 				sprintf(
+					/* translators: 1: Number of items created, 2: Item type label (singular or plural), 3: Comma-separated links to the new items. */
 					__( 'Faked %1$d new %2$s: [ %3$s ]', 'fakerpress' ),
 					count( $results ),
 					_n( 'attachment', 'attachments', count( $results ), 'fakerpress' ),

src/FakerPress/Admin/View/Comment_View.php

@@ -94,6 +94,7 @@ public function parse_request() {
 		if ( ! empty( $results ) ) {
 			return Admin::add_message(
 				sprintf(
+					/* translators: 1: Number of items created, 2: Item type label (singular or plural), 3: Comma-separated links to the new items. */
 					__( 'Faked %1$d new %2$s: [ %3$s ]', 'fakerpress' ),
 					count( $results ),
 					_n( 'comment', 'comments', count( $results ), 'fakerpress' ),

src/FakerPress/Admin/View/Post_View.php

@@ -58,6 +58,7 @@ protected function get_page_data(): array {
 		$default_taxonomy_names = array_values(
 			array_intersect( [ 'category', 'post_tag' ], array_keys( $taxonomies ) )
 		);
+
 		$default_taxonomy = empty( $default_taxonomy_names )
 			? []
 			: [
@@ -169,6 +170,7 @@ public function parse_request() {
 		if ( ! empty( $results ) ) {
 			return Admin::add_message(
 				sprintf(
+					/* translators: 1: Number of items created, 2: Item type label (singular or plural), 3: Comma-separated links to the new items. */
 					__( 'Faked %1$d new %2$s: [ %3$s ]', 'fakerpress' ),
 					count( $results ),
 					_n( 'post', 'posts', count( $results ), 'fakerpress' ),

src/FakerPress/Admin/View/Term_View.php

@@ -93,6 +93,7 @@ public function parse_request() {
 		} else {
 			return Admin::add_message(
 				sprintf(
+					/* translators: 1: Number of items created, 2: Item type label (singular or plural), 3: Comma-separated links to the new items. */
 					__( 'Faked %1$d new %2$s: [ %3$s ]', 'fakerpress' ),
 					count( $results ),
 					_n( 'term', 'terms', count( $results ), 'fakerpress' ),

src/FakerPress/Admin/View/User_View.php

@@ -93,6 +93,7 @@ public function parse_request() {
 		if ( ! empty( $results ) ) {
 			return Admin::add_message(
 				sprintf(
+					/* translators: 1: Number of items created, 2: Item type label (singular or plural), 3: Comma-separated links to the new items. */
 					__( 'Faked %1$d new %2$s: [ %3$s ]', 'fakerpress' ),
 					count( $results ),
 					_n( 'user', 'users', count( $results ), 'fakerpress' ),

src/FakerPress/Ajax.php

@@ -51,7 +51,7 @@ public function search_terms( $request = null ) {
 				'search'     => get_request_var( 'search', '' ),
 				'post_type'  => get_request_var( 'post_type' ),
 				'taxonomies' => get_request_var( 'taxonomies', [] ),
-				'exclude'    => get_request_var( 'exclude', [] ),
+				'exclude'    => get_request_var( 'exclude', [] ), // phpcs:ignore WordPressVIPMinimum.Performance.WPQueryParams.PostNotIn_exclude -- Request field read into the search object, not a query argument.
 				'page'       => absint( get_request_var( 'page', 0 ) ),
 				'page_limit' => absint( get_request_var( 'page_limit', 10 ) ),
 				'nonce'      => get_request_var( 'nonce' ),
@@ -92,12 +92,12 @@ public function search_terms( $request = null ) {
 		}
 
 		if ( ! empty( $request->exclude ) ) {
-			$args['exclude'] = $request->exclude;
+			$args['exclude'] = $request->exclude; // phpcs:ignore WordPressVIPMinimum.Performance.WPQueryParams.PostNotIn_exclude -- Paginated Select2 term search, the caller passes the term IDs to leave out.
 		}
 
 		$response->args = $args;
 
-		$terms = get_terms( (array) $request->taxonomies, $args );
+		$terms = get_terms( array_merge( $args, [ 'taxonomy' => (array) $request->taxonomies ] ) );
 
 		// Setting up Select2
 		foreach ( $terms as $term ) {
@@ -137,14 +137,15 @@ public function query_posts( $request = null ) {
 			return ( is_ajax() ? wp_send_json( $response ) : $response );
 		}
 
-		$request = (object) $_POST;
-
-		if ( empty( $request->nonce ) || ! wp_verify_nonce( $request->nonce, Plugin::$slug . '-select2-WP_Query' ) ) {
+		// Verify the nonce before reading anything else from the request.
+		if ( empty( $_POST['nonce'] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST['nonce'] ) ), Plugin::$slug . '-select2-WP_Query' ) ) {
 			$response->message = esc_attr__( 'Invalid nonce verification', 'fakerpress' );
 
 			return ( is_ajax() ? wp_send_json( $response ) : $response );
 		}
 
+		$request = (object) $_POST;
+
 		if ( ! current_user_can( 'publish_posts' ) ) {
 			$response->message = esc_attr__( 'Your user needs the "publish_posts" permissions to use WP_Query.', 'fakerpress' );