Phorge neither uses PHP's mysqli extension nor calls PHP's htmlentities() function.

Are you sure about that? Phorge supports either the old mysql extension or mysqli - and mysql was deprecated in PHP 5.5, and removed in PHP 7.0. Notably, Phorge checks for the existence of mysqli in PhabricatorDatabaseRef, PhabricatorExtensionSetupCheck and PhabricatorPHPConfigSetupCheck.

Yeah I was also pretty sure Phab used mysqli? I have had to have it on all my installations, and the Phorge documentation still cites it. https://we.phorge.it/book/contrib/article/database/

Though for the scope of the concern here that shouldn't matter, as per the quoted details the mysqli extension was only using E_STRICT between a range of PHP versions now in the rearview mirror, the removal of it was approved and merged at the end of August 2019, so continued use of the mysqli extension won't trip Phorge up for this deprecation.

I cannot remember how I attempted (and failed) to check a few weeks ago... Thank you both for jumping in and correcting!

In D25887#25297, @mainframe98 wrote:

Phorge supports either the old mysql extension or mysqli - and mysql was deprecated in PHP 5.5, and removed in PHP 7.0.

That sounds like technical debt to remove so I filed T16024