PHPCS issue in wp-load.php .

[hilayt24]

$_SERVER data not unslashed before sanitization.

if ( false === strpos( $_SERVER['REQUEST_URI'], 'setup-config' ) ) {
		header( 'Location: ' . $path );
		exit;
	}

[hilayt24]

Using wp_unslash() before sinitatization is recommended.

[SergeyBiryukov]

Hi there, welcome back to WordPress Trac! Thanks for the ticket.

Do you get any PHPCS warnings from this file? When running WPCS checks for WordPress core with the default phpcs.xml.dist​ file, wp-load.php appears to pass all the checks successfully in my testing.

Since we're directly checking for setup-config appearing anywhere in $_SERVER['REQUEST_URI'], I think it would not matter here whether it's slashed or not.

[azouamauriac]

Hello welcome to core trac! Thanks for the report,
I noticed the same thing with Sergey, I don't get any PHPCS warnings while running WPCS checks for WordPress core, but I get warning while running checks using ​https://github.com/WordPress/WordPress-Coding-Standards phpcs rules.

Adding close keywords as this doesn't seem come from core phpcs rules.

[hilayt24]

I am closing this ticket now .