Port the code to PHP 8.5.

Replace the short open tags and the removed functions (mcrypt, mysql_error,
salt-less crypt). Decode the reCAPTCHA reply as JSON, turn off mysqli
exceptions, drop stripslashes(), and default missing input values.
Fix the misplaced continue in prune_images().

about.php

@@ -1,4 +1,4 @@
-<? require_once("./session.lib.php"); ?>
+<?php require_once("./session.lib.php"); ?>
 <!DOCTYPE html>
 <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
   <head>
@@ -11,10 +11,10 @@
     <script type="text/javascript" src="utilities.js"></script>
     <link rel="alternate" type="application/rss+xml" title="xxx.org.za RSS feed" href="/feed" />
   </head>
-<? flush(); ?>
+<?php flush(); ?>
 <body>
 <div id="container">
-<? include_once("./sidebar.inc.php"); ?>
+<?php include_once("./sidebar.inc.php"); ?>
 <main id="main">
 <div id="maintext">
 
@@ -99,9 +99,9 @@ stories "drabblets".
 </div> <!-- .maintext  -->
 </main> <!-- .main      -->
 </div> <!-- .container -->
-<? include_once("./bottombar.inc.php"); ?>
+<?php include_once("./bottombar.inc.php"); ?>
 
-<? open_db('close'); ?>
+<?php open_db('close'); ?>
 
 </body>
 </html>

article.php

@@ -1,4 +1,4 @@
-<? require_once("./session.lib.php"); ?>
+<?php require_once("./session.lib.php"); ?>
 <!DOCTYPE html>
 <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
   <head>
@@ -11,7 +11,7 @@
     <script type="text/javascript" src="utilities.js"></script>
     <link rel="alternate" type="application/rss+xml" title="xxx.org.za RSS feed" href="/feed" />
   </head>
-<? 
+<?php 
   flush();
   $num_stories = 5;
   $editable    = FALSE;
@@ -21,13 +21,13 @@
 ?>
 <body>
 <div id="container">
-<? include_once("./sidebar.inc.php"); ?>
+<?php include_once("./sidebar.inc.php"); ?>
 <main id="main">
 <div id="maintext">
 
 <h1 class="logo">x&middot;x&middot;x</h1>
 
-<?
+<?php
 if (!get_id() && (get_count() > 1))
   echo sort_options("article");
 echo display_stories();
@@ -36,9 +36,9 @@ echo display_stories();
 </div> <!-- .maintext  -->
 </main> <!-- .main      -->
 </div> <!-- .container -->
-<? include_once("./bottombar.inc.php"); ?>
+<?php include_once("./bottombar.inc.php"); ?>
 
-<? open_db('close'); ?>
+<?php open_db('close'); ?>
 
 </body>
 </html>

bottombar.inc.php

@@ -1,5 +1,5 @@
 <footer id="bottom"><p>
-All stories and submissions <a class="whitefont" href="about">&copy;</a> 2003&ndash;<? echo gmdate("Y"); ?> their respective authors. 
+All stories and submissions <a class="whitefont" href="about">&copy;</a> 2003&ndash;<?php echo gmdate("Y"); ?> their respective authors. 
 </p></footer>
-<? $_SESSION['referrer'] = $_SERVER['REQUEST_URI']; ?>
-<? include_once('google.inc.php'); ?>
+<?php $_SESSION['referrer'] = $_SERVER['REQUEST_URI']; ?>
+<?php include_once('google.inc.php'); ?>

display.php

@@ -1,4 +1,4 @@
-<?
+<?php
 require_once('./open_db.lib.php');
 open_db('open');
 require_once('./get_data.lib.php');
@@ -37,7 +37,7 @@ function display_img($id) {
   }
 
   $query = "SELECT img, mime FROM $table WHERE 1 AND ID = ".$db->real_escape_string($id)." LIMIT 0, 1";
-  $result = $db->query($query)or die("Query failed : ".mysql_error());
+  $result = $db->query($query)or die("Query failed : ".$db->error);
 
   $row = $result->fetch_assoc();
   if ($row) {

feed.php

@@ -1,4 +1,4 @@
-<?
+<?php
 require_once('./open_db.lib.php');
 open_db('open');
 require_once('./get_data.lib.php');
@@ -13,7 +13,7 @@ header("Content-Type: application/rss+xml");
 
 // Set up a RSS "header"
 $query = "SELECT MAX(`date`) FROM $table;";
-$result = $db->query($query) or die("Query failed : ".$db->error());
+$result = $db->query($query) or die("Query failed : ".$db->error);
 $most_recent = $result->fetch_row();
 $now = date("D, d M Y H:i:s O");
 

get_data.lib.php

@@ -1,4 +1,4 @@
-<?
+<?php
 require_once('open_db.lib.php');
 
 function display_stories($id = NULL) {
@@ -193,9 +193,9 @@ function get_query($id = NULL) {
  * Return array of the POST variables we may care about 
  * (safer than extract($_POST))
  *
- * If $stripslashes is non-null, run stripslashes on the values
- * Note that stripslashes turns NULL into string("")
- * and int(0) into string("0")
+ * If $stripslashes is non-null, turn every value into a string:
+ * NULL (or an array) becomes string(""), int(0) becomes string("0").
+ * (It used to run stripslashes, but magic_quotes_gpc no longer exists.)
  *
  * If $html is non-null, run the output through htmlspecialchars,
  * to translate HTML-unsafe characters. This should only be needed
@@ -219,7 +219,7 @@ function get_post_data($stripslashes = NULL, $html = NULL) {
   $entry['queue_url']  = $queue ? 1 : 0;
 
   if ($stripslashes) {
-    $entry = array_map('stripslashes', $entry);
+    $entry = array_map('map_string', $entry);
   }
   if ($html) {
     $entry = array_map('map_html', $entry);
@@ -227,8 +227,11 @@ function get_post_data($stripslashes = NULL, $html = NULL) {
   $results[] = $entry;
   return $results;
 }
+function map_string($value) {
+  return is_scalar($value) ? (string)$value : '';
+}
 function map_html($string) {
-  return htmlspecialchars($string, ENT_QUOTES, 'UTF-8', FALSE);
+  return htmlspecialchars(map_string($string), ENT_QUOTES, 'UTF-8', FALSE);
 }
 function unmap_html($string) {
   return htmlspecialchars_decode($string, ENT_QUOTES);
@@ -243,7 +246,7 @@ function get_id() {
   if (is_numeric($id)) {
     return $id;
   } else if (isset($_REQUEST['id']) && is_numeric($_REQUEST['id'])) {
-    $id = $db->real_escape_string(stripslashes($_REQUEST['id']));
+    $id = $db->real_escape_string($_REQUEST['id']);
     return $id;
   } else {
     return NULL;
@@ -252,7 +255,7 @@ function get_id() {
 
 function get_search_args() {
   global $db;
-  if (isset($_GET['search'])) {
+  if (isset($_GET['search']) && is_string($_GET['search'])) {
     $search = $db->real_escape_string($_GET['search']);
     return $search;
   }
@@ -261,7 +264,7 @@ function get_search_args() {
 function get_order() {
   global $db;
   $order = NULL;
-  if (isset($_GET['order'])) {
+  if (isset($_GET['order']) && is_string($_GET['order'])) {
     $order = $db->real_escape_string($_GET['order']);
   }
   // Sort ascending by default
@@ -279,7 +282,7 @@ function get_order() {
 function get_sort_arg() {
   global $db;
   $sort = NULL;
-  if (isset($_GET['sort'])) {
+  if (isset($_GET['sort']) && is_string($_GET['sort'])) {
     $sort = $db->real_escape_string($_GET['sort']);
   }
   if ($sort != "author" &&
@@ -292,7 +295,7 @@ function get_sort_arg() {
 function get_show_num() {
   global $db, $num_stories;
   $show = NULL;
-  if (isset($_GET['show'])) {
+  if (isset($_GET['show']) && is_string($_GET['show'])) {
     $show = $db->real_escape_string($_GET['show']);
   }
   if (is_numeric($show))
@@ -306,7 +309,7 @@ function get_show_num() {
 function get_start_num() {
   global $db;
   $start = NULL;
-  if (isset($_GET['start'])) {
+  if (isset($_GET['start']) && is_string($_GET['start'])) {
     $start = $db->real_escape_string($_GET['start']);
   }
   if (!is_numeric($start))
@@ -344,7 +347,7 @@ function which_table($move = FALSE, $action = 'read') {
     return 'queue';
 
   // Viewing
-  } else if ($queue && ($is_admin || array_key_exists('allow_queue_image', $_SESSION))) {
+  } else if ($queue && ($is_admin || isset($_SESSION['allow_queue_image']))) {
     return 'queue';
   } else {
     return 'xxx';

google.inc.php

@@ -1,4 +1,4 @@
-<?
+<?php
 $ga_id = config('GOOGLE_ANALYTICS_ID');
 if (! $is_admin && $ga_id) { ?>
 <script>
@@ -10,4 +10,4 @@ if (! $is_admin && $ga_id) { ?>
   ga('create', <?= json_encode($ga_id, JSON_HEX_TAG) ?>, 'auto');
   ga('send', 'pageview');
 </script>
-<? } ?>
+<?php } ?>

index.php

@@ -1,4 +1,4 @@
-<? require_once("./session.lib.php"); ?>
+<?php require_once("./session.lib.php"); ?>
 <!DOCTYPE html>
 <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
   <head>
@@ -11,7 +11,7 @@
     <script type="text/javascript" src="utilities.js"></script>
     <link rel="alternate" type="application/rss+xml" title="xxx.org.za RSS feed" href="/feed" />
   </head>
-<? 
+<?php 
   flush();
   $num_stories = 5;
   $editable    = FALSE;
@@ -21,7 +21,7 @@
 ?>
 <body>
 <div id="container">
-<? include_once("./sidebar.inc.php"); ?>
+<?php include_once("./sidebar.inc.php"); ?>
 <main id="main">
 <div id="maintext">
 
@@ -36,7 +36,7 @@ encouraged!
 </p>
 <p>You can send in an entry <a href="/publish/">here</a>; take a shufty at the <a href="about">guidelines</a>.</p>
 
-<?
+<?php
 
 echo display_stories();
 
@@ -44,9 +44,9 @@ echo display_stories();
 </div> <!-- .maintext  -->
 </main> <!-- .main      -->
 </div> <!-- .container -->
-<? include_once("./bottombar.inc.php"); ?>
+<?php include_once("./bottombar.inc.php"); ?>
 
-<? open_db('close'); ?>
+<?php open_db('close'); ?>
 
 </body>
 </html>

lib/convert_entities.inc.php

@@ -1,4 +1,4 @@
-<?
+<?php
 
 function html_entity_decode_full($string, $quotes = ENT_COMPAT, $charset = 'UTF-8') {
   /* Regular Expression:

navigation.lib.php

@@ -1,6 +1,7 @@
-<?
+<?php
 require_once('open_db.lib.php');
 require_once("get_data.lib.php");
+if (stream_resolve_include_path("Numbers/Words.php"))
   include_once("Numbers/Words.php");
 
 function sort_options($link) {
@@ -64,7 +65,7 @@ function get_pager() {
   $queue_url  = $queue ? 1 : 0;
 
   $string = '<div class="pager">';
-  $nw = new Numbers_Words();
+  $nw = class_exists('Numbers_Words') ? new Numbers_Words() : NULL;
   // Are there later stories? Go backwards to them
   $string .= '<span class="next">';
   if ($start > 0) {
@@ -74,7 +75,7 @@ function get_pager() {
     if (isset($_GET['show']))   $string .= '&amp;show='.$show;
     if (isset($_GET['sort']))   $string .= '&amp;sort='.$sort;
     if (isset($_GET['order']))  $string .= '&amp;order='.$order;
-    $articles = ($show == 1) ? "article" : $nw->toWords($show)." articles";
+    $articles = ($show == 1) ? "article" : ($nw ? $nw->toWords($show) : $show)." articles";
     $string .= '">&laquo; Next '.$articles.'</a>';
   }
   $string .= "</span>\n";
@@ -88,7 +89,7 @@ function get_pager() {
     if (isset($_GET['show']))   $string .= '&amp;show='.$show;
     if (isset($_GET['sort']))   $string .= '&amp;sort='.$sort;
     if (isset($_GET['order']))  $string .= '&amp;order='.$order;
-    $articles = ($show == 1) ? "article" : $nw->toWords($show)." articles";
+    $articles = ($show == 1) ? "article" : ($nw ? $nw->toWords($show) : $show)." articles";
     $string .= '">Previous '.$articles.' &raquo;</a>';
   }
   $string .= "</span>\n";

open_db.lib.php

@@ -1,4 +1,4 @@
-<?
+<?php
 require_once(__DIR__ . '/config.lib.php');
 global $db;
 function open_db($state) {
@@ -9,6 +9,8 @@ function open_db($state) {
       $view_user = config('DB_USER');
       $view_pass = config('DB_PASS');
       $db_name   = config('DB_NAME');
+      // PHP 8.1+ throws exceptions by default; keep the old return-value checks working
+      mysqli_report(MYSQLI_REPORT_OFF);
       $db = new mysqli($hostname, $view_user, $view_pass, $db_name);
       if ($db->connect_error) {
         die ("Unable to connect to database");

publish/addeditor.php

@@ -1,4 +1,4 @@
-<? 
+<?php 
 if ( ! isset($_SERVER['HTTPS'])) {
    header('Location: https://' . $_SERVER["SERVER_NAME"] . $_SERVER['REQUEST_URI']);
 }
@@ -12,9 +12,9 @@ if (!isset($_SESSION['editor'])) {
   open_db('open');
   $table = "editors";
 
-  $username = $db->real_escape_string($_POST['username']);
-  $password = crypt($_POST['password']);
-  $email    = $db->real_escape_string($_POST['email']);
+  $username = $db->real_escape_string($_POST['username'] ?? '');
+  $password = $db->real_escape_string(password_hash($_POST['password'] ?? '', PASSWORD_DEFAULT));
+  $email    = $db->real_escape_string($_POST['email'] ?? '');
   $query = "INSERT INTO $table SET".
             "`username` = '".$username."', ".
             "`password` = '".$password."', ".
@@ -39,18 +39,18 @@ if (!isset($_SESSION['editor'])) {
     <script type="text/javascript" src="../utilities.js"></script>
     <link rel="alternate" type="application/rss+xml" title="xxx.org.za RSS feed" href="/feed" />
   </head>
-<? flush(); ?>
+<?php flush(); ?>
 <body>
 <div id="container">
-<? include_once("../sidebar.inc.php"); ?>
+<?php include_once("../sidebar.inc.php"); ?>
 <main id="main">
 <div id="maintext">
 
 <H1>add editor</H1>
 
-<? if ($added) { ?>
+<?php if ($added) { ?>
   <p>Added editor <?= $username ?></p>
-<? } else { ?>
+<?php } else { ?>
 
 <form action="https://xxx.org.za<?= $_SERVER['REQUEST_URI'] ?>" method="post">
   <div class="grid">
@@ -77,12 +77,12 @@ if (!isset($_SESSION['editor'])) {
 
   </div><!-- .grid -->
 </form>
-<? } ?>
+<?php } ?>
 
 </div> <!-- .maintext  -->
 </main> <!-- .main      -->
 </div> <!-- .container -->
-<? include_once("../bottombar.inc.php"); ?>
+<?php include_once("../bottombar.inc.php"); ?>
 
 </body>
 </html>

publish/choose.inc.php

@@ -1,4 +1,4 @@
-<?
+<?php
 // Default to the queue.
 if (!isset($_REQUEST['queue']))
   $queue = TRUE;
@@ -12,15 +12,15 @@ if (!get_id() && (get_count() > 1))
 if ($queue) { ?>
 
 <p>To view already-posted articles, <a href="edit?queue=0">click here</a>.</p>
-<?  } else { ?>
+<?php  } else { ?>
 <p>To view articles in the queue, <a href="edit?queue=1">click here</a>.</p>
 <div class="input" style="text-align: justify">
         <form action="" method="get">
-  <input name="search" type="text" class="input" id="search" maxlength="40" value="<?= $_GET['search'] ?>" />
+  <input name="search" type="text" class="input" id="search" maxlength="40" value="<?= $_GET['search'] ?? '' ?>" />
   <input name="queue" type="hidden" value="0" />
   <button type="submit" id="choose" name="action" value="choose" class="inputbutton">Search</button>
 </form>
 </div>
-<?  }
+<?php  }
 echo display_stories();
 ?>

publish/edit.php

@@ -1,4 +1,4 @@
-<?
+<?php
 if ( ! isset($_SERVER['HTTPS'])) {
    header('Location: https://' . $_SERVER["SERVER_NAME"] . $_SERVER['REQUEST_URI']);
 }
@@ -22,9 +22,9 @@ if (!isset($_SESSION['editor'])) {
     <link rel='stylesheet' type='text/css' href='../publish/style.css' />
     <script type="text/javascript" src="../utilities.js"></script>
     <link rel="alternate" type="application/rss+xml" title="xxx.org.za RSS feed" href="/feed" />
-<? include_once('./tinymce_init.inc.php'); ?>
+<?php include_once('./tinymce_init.inc.php'); ?>
   </head>
-<?
+<?php
   flush();
   require_once("../get_data.lib.php");
   open_db('open');
@@ -35,13 +35,13 @@ if (!isset($_SESSION['editor'])) {
 ?>
 <body>
 <div id='container'>
-<? include_once("../sidebar.inc.php"); ?>
+<?php include_once("../sidebar.inc.php"); ?>
 <div id='main'>
 <div id='maintext'>
 
 <H1>edit</H1>
 
-<? 
+<?php 
 
 /* Authenticated admin user allowed to: check the queue
           edit article on the queue
@@ -116,9 +116,9 @@ switch ($action) {
 </div> <!-- maintext  -->
 </div> <!-- main      -->
 </div> <!-- container -->
-<? include_once("../bottombar.inc.php"); ?>
+<?php include_once("../bottombar.inc.php"); ?>
 
-<? open_db('close'); ?>
+<?php open_db('close'); ?>
 <!-- Finis -->
 
 </body>

publish/index.php

@@ -1,4 +1,4 @@
-<? require_once("../session.lib.php"); ?>
+<?php require_once("../session.lib.php"); ?>
 <!DOCTYPE html>
 <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
   <head>
@@ -11,12 +11,12 @@
     <link rel='stylesheet' type='text/css' href='../publish/style.css' />
     <script type="text/javascript" src="../utilities.js"></script>
     <link rel="alternate" type="application/rss+xml" title="xxx.org.za RSS feed" href="/feed" />
-<? include_once('tinymce_init.inc.php'); ?>
-<? if (!$is_admin ) { ?>
+<?php include_once('tinymce_init.inc.php'); ?>
+<?php if (!$is_admin ) { ?>
     <script src="https://www.google.com/recaptcha/api.js"></script>
-<? } ?>
+<?php } ?>
   </head>
-<? 
+<?php 
   flush(); 
   require_once("../get_data.lib.php");
   open_db('open');
@@ -26,13 +26,13 @@
 ?>
 <body>
 <div id='container'>
-<? include_once("../sidebar.inc.php"); ?>
+<?php include_once("../sidebar.inc.php"); ?>
 <div id='main'>
 <div id='maintext'>
 
 <h1>submit</h1>
 
-<? 
+<?php 
 /* Authenticated admin user allowed to: check the queue
 					edit article on the queue
 					optionally preview
@@ -84,9 +84,9 @@ switch ($action) {
 </div> <!-- maintext  -->
 </div> <!-- main      -->
 </div> <!-- container -->
-<? include_once("../bottombar.inc.php"); ?>
+<?php include_once("../bottombar.inc.php"); ?>
 
-<?  open_db('close'); ?>
+<?php  open_db('close'); ?>
 
 </body>
 </html>

publish/login.php

@@ -1,4 +1,4 @@
-<?
+<?php
 if ( ! isset($_SERVER['HTTPS'])) {
    header('Location: https://' . $_SERVER["SERVER_NAME"] . $_SERVER['REQUEST_URI']);
 }
@@ -14,20 +14,22 @@ if (isset($_SESSION['editor'])) {
   $table = "editors";
   open_db('open');
 
-  $username = $db->real_escape_string($_POST['username']);
+  $username = $db->real_escape_string($_POST['username'] ?? '');
   $query = "SELECT * FROM $table WHERE ".
            "username LIKE '".$username."' ".
            "LIMIT 1;";
-  $getid = $db->query($query) or die("Query failed: ".$db->error());
+  $getid = $db->query($query) or die("Query failed: ".$db->error);
   $row = $getid->fetch_assoc();
 
+  $stored_password = '';
   if (isset($row))
     $stored_password = $row['password'];
   else  $denied = TRUE;
   $getid->close();
   open_db('close');
-  $compare_password = $_POST['password'];
-  if (crypt($compare_password, $stored_password) != $stored_password) {
+  $compare_password = $_POST['password'] ?? '';
+  // password_verify() also accepts hashes made by the old crypt() call
+  if (!password_verify($compare_password, $stored_password)) {
     $denied = TRUE;
   } else {
     $_SESSION['editor'] = $username; 
@@ -65,21 +67,21 @@ if (isset($_SESSION['editor'])) {
     <script type="text/javascript" src="../utilities.js"></script>
     <link rel="alternate" type="application/rss+xml" title="xxx.org.za RSS feed" href="/feed" />
   </head>
-<? flush(); ?>
+<?php flush(); ?>
 <body>
 <div id="container">
-<? include_once("../sidebar.inc.php"); ?>
+<?php include_once("../sidebar.inc.php"); ?>
 <main id="main">
 <div id="maintext">
 
 <H1>editor login</H1>
 
-<? 
+<?php 
 if ($denied) 
   echo "<p><strong>Access denied. Please try again.</strong></p>\n";
 ?>
 
-<form action="<? echo "https://xxx.org.za".$_SERVER['REQUEST_URI']; ?>" method="post">
+<form action="<?php echo "https://xxx.org.za".$_SERVER['REQUEST_URI']; ?>" method="post">
   <div class="grid">
 
     <label for="username">Username: </label>
@@ -108,7 +110,7 @@ if ($denied)
 </div> <!-- .maintext  -->
 </main> <!-- .main      -->
 </div> <!-- .container -->
-<? include_once("../bottombar.inc.php"); ?>
+<?php include_once("../bottombar.inc.php"); ?>
 
 </body>
 </html>

publish/logout.php

@@ -1,4 +1,4 @@
-<?
+<?php
 //include_once('../session.lib.php');
 header( 'Cache-Control: no-store, no-cache, must-revalidate' );
 header( 'Cache-Control: post-check=0, pre-check=0', false );

publish/modify.inc.php

@@ -1,4 +1,4 @@
-<?
+<?php
 echo display_stories();
  
 echo "<br /><br />\n";

publish/post.lib.php

@@ -1,4 +1,4 @@
-<? 
+<?php 
 require_once('../open_db.lib.php');
 require_once('../get_data.lib.php');
 
@@ -11,8 +11,10 @@ function save_data($id = NULL) {
   else
     $move = FALSE;
   $table = which_table($move, $action);
+  $image_file = FALSE;
+  $queue_id   = NULL;
 
-  // extract POST variables (running through stripslashes)
+  // extract POST variables
   $result = get_post_data(TRUE);
   // assign their keys and values to the symbol table
   extract($result[0], EXTR_OVERWRITE);
@@ -86,7 +88,7 @@ function save_data($id = NULL) {
   // Get the (new) ID if we don't already have it.
   if (!is_numeric($id) || $move) {
     $query = "SELECT LAST_INSERT_ID();";
-    $getid = $db->query($query) or die("Query failed: ".$db->error());
+    $getid = $db->query($query) or die("Query failed: ".$db->error);
     $row = $getid->fetch_row();
     $id = $row[0];
   }
@@ -119,8 +121,9 @@ function delete_story($id, $move = FALSE) {
 
   $query = "DELETE FROM $table WHERE `id` = '".$id."' LIMIT 1;";
   //echo $query;
-  $result = $db->query($query)or die("Query failed : ".$db->error());
+  $result = $db->query($query)or die("Query failed : ".$db->error);
 
+  $message = '';
   if (!$move)
     $message = 'Article has been deleted.';
 
@@ -129,13 +132,13 @@ function delete_story($id, $move = FALSE) {
 
 function get_mimetype($image_file) {
   $upload = getimagesize($image_file);
-  $mimetype = $upload['mime'];
+  $mimetype = $upload ? $upload['mime'] : NULL;
   return $mimetype;
 }
 
 function save_uploaded_file() {
   // Save uploaded file to new, temporary location
-  if (is_uploaded_file($_FILES['upload']['tmp_name'])) {
+  if (is_uploaded_file($_FILES['upload']['tmp_name'] ?? '')) {
     $tmp_file = $_FILES['upload']['tmp_name'];
     $new_file = $_SERVER['DOCUMENT_ROOT'] . "/graphics" . $tmp_file;
     $end_dir  = dirname($new_file);
@@ -164,8 +167,8 @@ function prune_images($image_file) {
   unlink($image_file);
 
   if ( $dir_handle = @opendir($cleanup_dir) ) {
-    if($dir_handle=='.' || $dir_handle=='..') continue;
-    while ($cleanup_file = readdir ($dir_handle)) {
+    while (($cleanup_file = readdir ($dir_handle)) !== FALSE) {
+      if ($cleanup_file == '.' || $cleanup_file == '..') continue;
       $cleanup_file = $cleanup_dir . "/". $cleanup_file;
       if (@filemtime($cleanup_file) < (time() - $age)) {
         @unlink($cleanup_file);
@@ -184,10 +187,12 @@ function prune_images($image_file) {
 $validate = array();
 function validate_data() {
   global $validate;
-  // extract POST variables (running through stripslashes)
+  // extract POST variables
   $result = get_post_data(TRUE);
   // assign their keys and values to the symbol table
   extract($result[0], EXTR_OVERWRITE);
+  $upload_error = $_FILES['upload']['error']    ?? UPLOAD_ERR_NO_FILE;
+  $upload_tmp   = $_FILES['upload']['tmp_name'] ?? '';
 
 
   if (!$author) {
@@ -203,11 +208,11 @@ function validate_data() {
   }
 
   // 0 == no error; 4 == no file; all others are errors.
-  if ($_FILES['upload']['error'] > 0 &&
-      $_FILES['upload']['error'] !== 4) {
-    $validate['upload'] = 'There was an error uploading the file ('.$_FILES['upload']['error'].')';
-  } else if ($_FILES['upload']['tmp_name']) {
-    $upload = getimagesize($_FILES['upload']['tmp_name']);
+  if ($upload_error > 0 &&
+      $upload_error !== 4) {
+    $validate['upload'] = 'There was an error uploading the file ('.$upload_error.')';
+  } else if ($upload_tmp) {
+    $upload = getimagesize($upload_tmp);
     if (!$upload)
       $validate['upload'] = htmlspecialchars($_FILES['upload']['name']) . 
                             " wasn't an image file. Please go back.";
@@ -245,7 +250,7 @@ function send_email($title, $author, $story) {
   $headers = 'From: x.x.x Queue <editor@xxx.org.za>'."\r\n";
   $message = "Please review the queue. $author has sent the following new submission:\n\n";
   if ($story)
-    $message .= wordwrap(preg_replace("#(<br.?/?>|</p>)#", "\n", strip_tags(stripslashes(html_entity_decode_full($story)))));
+    $message .= wordwrap(preg_replace("#(<br.?/?>|</p>)#", "\n", strip_tags(html_entity_decode_full($story))));
   else
     $message .= "<Submission is an image. Review on the site.>";
   $message .= "\n\nhttp://xxx.org.za/publish/edit";

publish/preview.inc.php

@@ -1,4 +1,4 @@
-<?
+<?php
 $result = get_post_data(TRUE, TRUE);
 extract($result[0], EXTR_OVERWRITE);
 
@@ -12,7 +12,9 @@ if (isset($_POST['g-recaptcha-response'])) {
   $captcha_resp = file_get_contents("https://www.google.com/recaptcha/api/siteverify?secret=".urlencode(config('RECAPTCHA_SECRET'))."&response=".
       $captcha."&remoteip=".$_SERVER['REMOTE_ADDR']);
   var_dump($captcha_resp);
-  if ($captcha_resp.success==false) {
+  // PHP 8 treats the bare word "success" as an undefined constant, so decode the JSON reply
+  $captcha_json = json_decode((string)$captcha_resp);
+  if (empty($captcha_json->success)) {
     $validate['captcha'] = 'The words you typed in the captcha were not correct. Please try again.';
     include('./write.inc.php');
     return;
@@ -21,7 +23,7 @@ if (isset($_POST['g-recaptcha-response'])) {
 
 echo '<p>Please review your submission. Once you\'ve finished, please click "Submit" at the bottom of the page, or click "Preview" to check it again.</p>';
 
-if (is_uploaded_file($_FILES['upload']['tmp_name']) && !isset($validate['upload'])) {
+if (is_uploaded_file($_FILES['upload']['tmp_name'] ?? '') &&!isset($validate['upload'])) {
   $tmp_file   = $_FILES['upload']['tmp_name'];
   $upload     = getimagesize($tmp_file);
   $new_file   = $_SERVER['DOCUMENT_ROOT'] . "/graphics" . $tmp_file;

publish/write.inc.php

@@ -1,4 +1,4 @@
-<?
+<?php
 $id     = get_id();
 $search = get_search_args();
 
@@ -51,13 +51,13 @@ if (count($validate) !== 0) {
 </div>
 <div class="textarea rightcolumn">
   <div id="textparent">
-    <textarea name="story" id="story" rows="20" cols="50"><? 
+    <textarea name="story" id="story" rows="20" cols="50"><?php 
 echo (isset($story) ? $story : '')
   ?></textarea>
     <div class="note">(To get line-breaks&mdash;as in poetry&mdash;instead of paragraph breaks, hit shift-enter instead of enter.)</div>
   </div>
   <div class="upload" id="uploadparent" style="display: none;"><div>
-<? 
+<?php 
 if (isset($file_src) || isset($img)) {
   if (isset($file_src)) {
     echo '  <input type="hidden" id="uploaded" name="uploaded" value="'.$file_src.'" />';
@@ -70,7 +70,7 @@ if (isset($file_src) || isset($img)) {
 }
 ?>
     <input type="file" name="upload" id="upload" />
-<? 
+<?php 
 if (isset($file_src) || isset($img)) {
   echo '  <div>';
   echo '  <div class="remove">';
@@ -86,22 +86,22 @@ if (isset($file_src) || isset($img)) {
   </div></div>
 </div>
 
-<?  if ($is_admin) { ?>
-  <label<? isset($validate['comments']) ? ' class="red"' : '' ?> for="comments">Comments:</label>
+<?php  if ($is_admin) { ?>
+  <label<?php isset($validate['comments']) ? ' class="red"' : '' ?> for="comments">Comments:</label>
   <div class="rightcolumn">
     <input type="text" name="comments" id="comments" maxlength="150" value="<?= isset($comments) ? $comments : '' ?>" />
   </div>
   <input type="hidden" id="editor" name="editor" value="<?= $username ?>" />
-<? } else { ?>
+<?php } else { ?>
   <input type="hidden" id="editor" name="editor" value="original author" />
-<? } ?>
+<?php } ?>
 
 <div style="display: none;">
 <input type="hidden" id="date" name="date" value="<?= isset($date) ? $date : '' ?>" />
 <input type="hidden" id="id" name="id" value="<?= isset($id) ? $id : '' ?>" />
 </div>
 
-<?
+<?php
   if (!$is_admin && (($action == "") || isset($validate['captcha']))) {
     echo '<div class="g-recaptcha" data-sitekey="'.htmlspecialchars(config('RECAPTCHA_SITE_KEY')).'"></div>';
   }
@@ -116,7 +116,7 @@ if (isset($file_src) || isset($img)) {
 ?>
 <div class="leftcolumn"></div>
 <div class="submission rightcolumn">
-<?
+<?php
   if (isset($queue) && $is_admin) {
     echo '<button type="submit" id="preview" name="action" value="save">Save in queue</button>';
   } else {
@@ -138,7 +138,7 @@ if (isset($file_src) || isset($img)) {
 
 </form>
 
-<?
+<?php
   echo '<script type="text/javascript">'."\n";
 if (isset($file_src) || isset($img) || isset($validate['upload'])) {
   echo "  showHide('upload')\n";

session.lib.php

@@ -1,4 +1,4 @@
-<?
+<?php
 require_once(realpath(dirname(__FILE__) . '/open_db.lib.php'));
 
 $is_admin = FALSE;
@@ -33,14 +33,14 @@ function check_persistent_login() {
   open_db('open');
 
   $cookie_data = $db->real_escape_string($_COOKIE['PersistentAuth']);
-  list($username, $key) = explode("|", $cookie_data);
+  list($username, $key) = explode("|", $cookie_data, 2) + array('', '');
   $username = $db->real_escape_string($username);
   $key = $db->real_escape_string($key);
 
   $query = "SELECT * FROM $table WHERE ".
            "username LIKE '".$username."' ".
            "LIMIT 1;";
-  $getid = $db->query($query) or die("Query failed: ".$db->error());
+  $getid = $db->query($query) or die("Query failed: ".$db->error);
   $row = $getid->fetch_assoc();
   open_db('close');
 
@@ -68,11 +68,11 @@ function create_persistent_login($username) {
   open_db('open');
 
   $username = $db->real_escape_string($username);
-  $key = substr(bin2hex(mcrypt_create_iv(100,MCRYPT_DEV_URANDOM)), 0, 200);
+  $key = bin2hex(random_bytes(100));
 
   // Add session key to database
   $query = "INSERT INTO $table " . "(username, session) VALUES ('" . $username."', '" . $key . "');";
-  $db->query($query) or die("Query failed: ".$db->error());
+  $db->query($query) or die("Query failed: ".$db->error);
   open_db('close');
 
   // Create cookie with key
@@ -86,8 +86,8 @@ function delete_persistent_login() {
   $table = "persistent_sessions";
   open_db('open');
 
-  $cookie_data = $db->real_escape_string($_COOKIE['PersistentAuth']);
-  list($username, $key) = explode("|", $cookie_data);
+  $cookie_data = $db->real_escape_string($_COOKIE['PersistentAuth'] ?? '');
+  list($username, $key) = explode("|", $cookie_data, 2) + array('', '');
   $username = $db->real_escape_string($username);
   $key = $db->real_escape_string($key);
 
@@ -95,12 +95,12 @@ function delete_persistent_login() {
   $query = "DELETE FROM $table " . 
            " WHERE username LIKE '" . $username . "'" . 
            " AND session LIKE '" . $key . "';";
-  $db->query($query) or die("Query failed: ".$db->error());
+  $db->query($query) or die("Query failed: ".$db->error);
 
   // Reap old sessions
   $query = "DELETE FROM $table " . 
            " WHERE created < DATE_SUB(now(), INTERVAL 1 YEAR);";
-  $db->query($query) or die("Query failed: ".$db->error());
+  $db->query($query) or die("Query failed: ".$db->error);
 
   open_db('close');
 

sidebar.inc.php

@@ -1,6 +1,6 @@
 <aside id="sidebar">
   <div class="logo">
-    <a <?
+    <a <?php
 // Match files that use the main x.x.x logo
 if (preg_match("#^(/$|/index|/article)#", $_SERVER['REQUEST_URI'])) {
     echo 'class="mono" ';
@@ -27,7 +27,7 @@ if (preg_match("#^(/$|/index|/article)#", $_SERVER['REQUEST_URI'])) {
       <li><a href="/about">About <span class="xxx">x&middot;x&middot;x</span></a></li>
       <li><a href="/article?start=5">Archive</a></li>
       <li><a href="/publish">Add</a>/<a href="/publish/edit" class="sidelink">Edit</a></li>
-<? if (isset($is_admin) && $is_admin) {
+<?php if (isset($is_admin) && $is_admin) {
         echo '      <li><a href="/publish/addeditor">Add editor</a></li>'."\n";
         echo '      <li><a href="/publish/logout">Logout</a></li>'."\n";
 }