fix: env() TypeError for non-string $_SERVER values + esc() fixes

[gr8man]

Fix: env() TypeError in CLI + esc() improvements

What

Fixes two bugs in system/Common.php.

env() — In CLI, $_SERVER contains non-string values (argc is int, argv is array). Passing them to strtolower() threw a TypeError under declare(strict_types=1). Added an is_string() guard before the match expression; non-string values are returned as-is.

esc() — Three fixes applied together:

• foreach ($data as &$value) left a dangling reference after the loop; added unset($value) to prevent silent mutation of the last array element in the calling scope
• $encoding was not propagated in recursive array calls
• Replaced single static $escaper with static $escapers[] keyed by encoding for correct per-encoding caching

Tests

Added a data-provider test for env() covering non-string $_SERVER/$_ENV values (int, array, float), and three tests verifying the esc() reference leak is gone.

Files changed

• system/Common.php
• tests/system/CommonFunctionsTest.php

[michalsn]

Please send one change per PR.

This needs a changelog entry.

[michalsn]

Suggested change

unset($value); // Prevent reference leak: &$value would remain bound to last element

What reference leak? We return right after this.

[michalsn]

This will cause the incorrect encoding default to be accepted after the first normal instantiation.

Please change it to the equivalent of Escaper handling:

Suggested change

	$cacheKey = $encoding ?? 'default';
	$cacheKey = strtolower($encoding ?? 'utf-8');

[michalsn]

Suggested change

	public function testEscapeArrayDoesNotLeakForeachReference(): void
	{
	$data = ['first' => '<b>bold</b>', 'last' => '<i>italic</i>'];
	$escaped = esc($data);
	$this->assertSame('&lt;b&gt;bold&lt;/b&gt;', $escaped['first']);
	$this->assertSame('&lt;i&gt;italic&lt;/i&gt;', $escaped['last']);
	}
	public function testEscapeArrayLastElementNotMutatedAfterCall(): void
	{
	$data = ['x' => '<script>', 'y' => '<style>'];
	$escaped = esc($data);
	$this->assertSame('&lt;script&gt;', $escaped['x']);
	$this->assertSame('&lt;style&gt;', $escaped['y']);
	$this->assertCount(2, $escaped);
	}
	public function testEscapeArrayReferenceIsCleanedUpOnSingleElement(): void
	{
	$data = ['only' => '<div>'];
	$escaped = esc($data);
	$this->assertSame('&lt;div&gt;', $escaped['only']);
	}

There is no reference leak, so these tests don't prove anything IMO.