[BUG]: Filter::StringVal with <<>>

[niden]

FILTER_SANITIZE_STRING is to be removed from PHP 8.1. The StringVal filter relies on filter_var() to sanitize strings.

As per the documentation as well as the relevant RFC that removes the constant, htmlspecialchars() is a better alternative to the functionality.

The current implementation - which no longer uses filter_var is based on preg_match is:

public function __invoke($input)
{
    $input = str_replace(chr(0), "", (string) $input);
    $input = preg_replace("/<[^>]*>?/", "", $input);

    return str_replace(["'", "\""], ["&#39;", "&#34;"], $input);
}

When using the following string:

$input = '<< >> ' ' ' ' " " " " < >  - -  ... '

the expected result is:

' ' ' ' ' " " " "   - -  ... '

but instead we get:

'> ' ' ' ' " " " "   - -  ... '

Options:

1. correct the preg_match to pick up the >
2. Change the StringVal filter to use htmlspecialchars() and also introduce StringValLegacy as a new filter which will only work for PHP 7.4 and 8.0 and will utilize filter_var(). This way we have something that people can use as they have been, and offer a path to upgrade the filter within the next major version.

[niden]

I am more inclined to go with no 2.

[Jeckerson]

@niden OK for option 2.

[niden]

Resolved in #15983