[vivi-the-going-merry]

Lite half of Strategy11/formidable-pro#6915. The Pro half is Strategy11/formidable-pro#6916.

Broken: posting an array (field[]=x) to a phone/formatted text field, or to a key FrmEntry::sanitize_entry_post sanitizes (form_key, item_key, frm_action), threw a fatal TypeError on PHP 8.

Changed:

• FrmEntryValidate::validate_phone_field: an array value adds the field's "invalid" error.
• FrmAppHelper::sanitize_request: an array value becomes ''. The only caller maps every key to a scalar sanitizer.

Verified: CI run on the test-only commit failed exactly the 2 new tests with preg_match(): Argument #2 ($subject) must be of type string, array given (951 tests, 2 errors). The run on the fix commit is linked in the checks below.

Not done: the Array to string conversion warnings from the issue were not traced.

Part of Strategy11/formidable-pro#6915

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Strategy11/formidable-forms
• Branch: master
• File: .coderabbit.yaml
• Commit: a0b9742
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: 8b91c285-0e36-4b56-b532-86a7af5d1242

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[deepsource-io]

DeepSource Code Review

We reviewed changes in a0b9742...65775a3 on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade

Security   Reliability   Complexity   Hygiene

Code Review Summary

Analyzer	Status	Updated (UTC)	Details
PHP		Oct 24, 2026 2:55p.m.	Review ↗
JavaScript		Oct 24, 2026 2:55p.m.	Review ↗

---

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.

[deepsource-io]

Call to an undefined method test_FrmEntryValidate::assertArrayHasKey()

The method you are trying to call is not defined, which can result in a fatal error.

[deepsource-io]

Call to an undefined method test_FrmAppHelper::assertSame()

The method you are trying to call is not defined, which can result in a fatal error.

[franky-the-going-merry]

Approve. No blocking findings.

• Repro, before/after (PHP 8.2 CLI, real validate_phone_field and sanitize_request from each tree, WP helpers stubbed): on master, an array phone value throws TypeError: preg_match(): Argument #2 ($subject) must be of type string, array given, and an array frm_action throws a TypeError from the sanitizer. On this branch the phone array returns the field's "invalid" error and frm_action becomes ''. Valid and invalid string phones behave the same on both, and an unmapped array key is left alone.
• Fix location: the single caller of sanitize_request (FrmEntry::sanitize_entry_post) maps only scalar sanitizers, so blanking an array there is correct. An empty array also reaches validate_phone_field ([] != '' is true in the caller's guard) and is caught by the same is_array() check.
• Tests: both new tests exercise the changed branches. The PR description records them failing on the test-only commit.
• Red checks, not caused by this PR: Psalm's annotations are all MissingPureAnnotation in FrmAbilities*Controller.php (files this PR doesn't touch). The two DeepSource comments ("undefined method assertArrayHasKey/assertSame") are false positives, because FrmUnitTest extends the WP PHPUnit case.

Not exercised: a live WordPress request with field[]=x (the Playground preview env would not boot here); the Array to string conversion warnings and the Pro half (formidable-pro#6916) are outside this PR.