toBe(0); expect(sanitize_uri($uri))->toBe($uri) ->and(substr_count(sanitize_uri($uri), 'action='))->toBe(1); }); test('a leading question mark yields an ampersand, not a second question mark', function () { $uri = '?a=1&x=graph_view.php'; expect(strpos($uri, '?'))->toBe(0); $result = sanitize_uri($uri); expect($result)->toBe('?a=1&x=graph_view.php&action=preview') ->and(substr_count($result, '?'))->toBe(1); }); test('an action still gets appended when the uri genuinely lacks one', function () { expect(sanitize_uri('graph_view.php?local_graph_id=3')) ->toBe('graph_view.php?local_graph_id=3&action=preview'); }); test('a uri that is not graph_view is left alone', function () { expect(sanitize_uri('index.php?a=1'))->toBe('index.php?a=1'); }); test('selected graphs refuses a nested array, as its contract states', function () { expect(sanitize_unserialize_selected_graphs(serialize([1, 2, '3'])))->toBe([1, 2, '3']) ->and(sanitize_unserialize_selected_graphs(serialize([1, [2]])))->toBeFalse() ->and(sanitize_unserialize_selected_graphs(serialize([1, 'abc'])))->toBeFalse() ->and(sanitize_unserialize_selected_graphs(serialize([1, true])))->toBeFalse(); }); test('filter_value still escapes markup and the grave accent', function () { expect(filter_value('ac', ''))->toBe('a<b>c') ->and(filter_value('a`b', ''))->toContain('`'); });