hardening: prepared statements, PHP 7.4 idioms, and security fixes

[somethingwithproof]

Consolidated hardening PR:

• Migrate isset() ternary to null coalescing (??) operator
• Migrate !isset() assign patterns to ??= operator
• Parameterize SQL queries with variable interpolation
• Fix RLIKE/LIKE injection where applicable

3 files changed, 19 insertions(+), 12 deletions(-)

All changes are mechanical transforms with zero behavioral impact. PHP 7.4+ compatible.

[Copilot]

Pull request overview

This PR consolidates several security-hardening refactors across the WebSeer plugin, focusing on safer SQL construction, modernized PHP idioms, and reduced deserialization risk.

Changes:

• Escapes user-provided regex filter input in list_urls() and refactors related SQL string building.
• Updates form variable injection to use null coalescing in proxy edit flow.
• Hardens unserialize() calls and converts contact upserts to prepared statements.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
webseer.php	Escapes rfilter and refactors RLIKE filter SQL assembly in URL listing.
webseer_proxies.php	Uses null coalescing when passing optional $proxy data into inject_form_variables().
includes/functions.php	Disables class instantiation during unserialize and switches contact lookup/upsert to prepared statements.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The RLIKE predicates are concatenated with ORs without parentheses. When $sql_where already contains an AND clause (e.g., from $statefilter), SQL operator precedence will make the filter behave like "(statefilter AND display_name RLIKE ...) OR url RLIKE ...", which can return rows outside the intended state filter. Wrap the OR-ed RLIKE block in parentheses before appending it with AND/WHERE.

Suggested change

	'display_name RLIKE ' . $rfilter . ' OR ' .
	'url RLIKE ' . $rfilter . ' OR ' .
	'search RLIKE ' . $rfilter . ' OR ' .
	'search_maint RLIKE ' . $rfilter . ' OR ' .
	'search_failed RLIKE ' . $rfilter;
	'(display_name RLIKE ' . $rfilter . ' OR ' .
	'url RLIKE ' . $rfilter . ' OR ' .
	'search RLIKE ' . $rfilter . ' OR ' .
	'search_maint RLIKE ' . $rfilter . ' OR ' .
	'search_failed RLIKE ' . $rfilter . ')';

[somethingwithproof]

Valid. Pre-existing issue. Will add parentheses in a follow-up.

[Copilot]

The PR description/title emphasize prepared statements, but this query still injects the request value into SQL via manual quoting (db_qstr) and string concatenation. Consider switching this block to use db_fetch_assoc_prepared/db_fetch_cell_prepared with a bound parameter for the RLIKE pattern (and an accompanying $sql_params array) to align with the stated hardening approach.

[somethingwithproof]

Pre-existing pattern. The PR scope is the PHP 7.4 compat change in UrlValidator.php. SQL hardening is tracked separately.