Fix PHP 8.1+ deprecations: null passed to string functions

[mumnik]

Summary

PHP 8.1 deprecated passing null to built-in string functions (strlen(), strpos(), strtolower(), preg_match(), explode(), etc.). These deprecations become TypeError in PHP 9.0.

This PR adds (string) casts where nullable values can reach string functions across 8 core files:

• html.php — anchor() and mail_to_safe() can receive null $href/$email
• input.php — server(), headers(), is_ajax() pass potentially null $index to strtoupper()/strtolower()
• str.php — Fixes a logic bug in truncate(): strlen($string !== mb_strlen($string)) had wrong parentheses, passing a boolean to strlen() instead of comparing lengths. Also fixes is_html()
• security.php — Input::method() return cast in CSRF check
• format.php — $string and $json parameters in XML/JSON processing
• validation.php — $rules parameter in add_field()
• controller/rest.php — HTTP_AUTHORIZATION header value from Input::server()
• request/driver.php — $method and $mime parameters

Bug fix in Str::truncate()

// Before (broken — passes boolean to strlen):
if (MBSTRING and strlen($string !== mb_strlen($string)))

// After (correct — compares string lengths):
if (MBSTRING and strlen((string) $string) !== mb_strlen((string) $string))

This bug meant the multibyte offset correction in truncate() never executed.

Test plan

• Tested on PHP 8.4.8 with a production FuelPHP 1.9 application
• All 8 files pass php -l syntax check
• No deprecation warnings in runtime output
• Backward compatible — (string) cast on a string is a no-op

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud