fix(defensive): harden helper library input and output handling

[somethingwithproof]

Summary

• lib/html_utility.php — update_order_string() wrote the sort_direction request parameter directly into $_SESSION['sort_string'] without checking it is ASC or DESC. Added strtoupper() normalisation and an in_array(['ASC','DESC']) allowlist before every session write; values outside the allowlist default to ASC.
• lib/functions.php — sanitize_uri() — the function stripped most dangerous characters but had no entry for the // prefix, which browsers interpret as a scheme-relative URL. Added a strncmp(ltrim($uri), '//', 2) guard that returns '/' for any such input.
• lib/functions.php — is_valid_pathname() — the character-class regex [a-zA-Z0-9_.:/\\-] allows literal dots, so ../../etc/passwd passed validation. Added an explicit strpos('..') rejection before the regex.
• lib/database.php — db_qstr() fallback — the no-PDO fallback escaped \, \0, and ' but omitted \x1a (MySQL's Ctrl+Z escape sequence). Added "\x1a" => "\\\x1a" to the replacement map to match PDO quote() behaviour.

Categorisation

Defensive programming — each change tightens an input-validation or output-encoding invariant in a shared helper used across the whole codebase.

Test plan

• Confirm table sorting (host.php, graphs.php, etc.) still works with ASC and DESC columns
• Confirm sort_direction values other than ASC/DESC are silently coerced to ASC rather than causing errors
• Confirm sanitize_uri() with a //attacker.com input returns /
• Confirm admin settings paths containing .. are rejected by is_valid_pathname()
• Run PHPUnit suite: php vendor/bin/phpunit

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

This PR hardens input validation/sanitization in several request-handling helpers and corrects FILTER_VALIDATE_REGEXP usage by adding proper regex delimiters/anchors, with an accompanying unit test.

Changes:

• Fix FILTER_VALIDATE_REGEXP patterns to include delimiters and proper anchoring for boolean/template inputs.
• Sanitize sort direction inputs to only allow ASC/DESC in order-string generation.
• Add additional safeguards in pathname/URI sanitization and improve string escaping in SQL quoting.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
tests/Unit/FilterValidateRegexTest.php	Adds a unit test asserting delimiter requirements and expected filter_var behavior.
lib/html_utility.php	Normalizes/whitelists sort_direction before building ORDER BY strings.
lib/html_graph.php	Updates request filter regexes to delimited, anchored expressions.
lib/functions.php	Adds .. rejection in pathname validation and blocks protocol-relative URIs.
lib/database.php	Extends manual string escaping to include 0x1A (\x1a).