fix: env() TypeError for non-string $_SERVER values + esc() fixes

- env(): guard non-string values (int argc, array argv in CLI) before
  strtolower() to prevent TypeError under declare(strict_types=1)

- esc(): propagate $encoding in recursive array calls (was ignored before),
  add early return after array processing, replace single static $escaper
  with static $escapers[] cache keyed by encoding

- tests: data-provider test for env() non-string types,
  three tests for esc() foreach reference leak

Author: gr8man

system/Common.php

@@ -416,6 +416,12 @@ function env(string $key, $default = null)
             return $default;
         }
 
+        // Non-string values (e.g. $_SERVER['argc'] is int, $_SERVER['argv'] is array in CLI)
+        // must be returned as-is to avoid TypeError from strtolower().
+        if (! is_string($value)) {
+            return $value;
+        }
+
         // Handle any boolean values
         return match (strtolower($value)) {
             'true'  => true,
@@ -459,8 +465,11 @@ function esc($data, string $context = 'html', ?string $encoding = null)
 
         if (is_array($data)) {
             foreach ($data as &$value) {
-                $value = esc($value, $context);
+                $value = esc($value, $context, $encoding);
             }
+            unset($value); // Prevent reference leak: &$value would remain bound to last element
+
+            return $data;
         }
 
         if (is_string($data)) {
@@ -470,16 +479,14 @@ function esc($data, string $context = 'html', ?string $encoding = null)
 
             $method = $context === 'attr' ? 'escapeHtmlAttr' : 'escape' . ucfirst($context);
 
-            static $escaper;
-            if (! $escaper) {
-                $escaper = new Escaper($encoding);
-            }
+            static $escapers = [];
+            $cacheKey        = $encoding ?? 'default';
 
-            if ($encoding !== null && $escaper->getEncoding() !== $encoding) {
-                $escaper = new Escaper($encoding);
+            if (! isset($escapers[$cacheKey])) {
+                $escapers[$cacheKey] = new Escaper($encoding);
             }
 
-            $data = $escaper->{$method}($data);
+            $data = $escapers[$cacheKey]->{$method}($data);
         }
 
         return $data;

tests/system/CommonFunctionsTest.php

@@ -131,6 +131,43 @@ public function testEnvBooleans(): void
         $this->assertNull(env('p4'));
     }
 
+    #[DataProvider('provideEnvReturnsCorrectTypesWithoutTypeError')]
+    public function testEnvReturnsCorrectTypesWithoutTypeError(string $source, mixed $value): void
+    {
+        $key = 'ci_test_var';
+
+        if ($source === 'SERVER' || $source === 'BOTH') {
+            $_SERVER[$key] = $value;
+        }
+
+        if ($source === 'ENV' || $source === 'BOTH') {
+            $_ENV[$key] = $value;
+        }
+
+        try {
+            $this->assertSame($value, env($key));
+        } finally {
+            unset($_SERVER[$key], $_ENV[$key]);
+        }
+    }
+
+    public static function provideEnvReturnsCorrectTypesWithoutTypeError(): iterable
+    {
+        yield 'integer from SERVER' => ['SERVER', 2];
+
+        yield 'array from SERVER' => ['SERVER', ['spark', 'migrate']];
+
+        yield 'int 1 is not true' => ['SERVER', 1];
+
+        yield 'int 0 is not false' => ['SERVER', 0];
+
+        yield 'float from SERVER' => ['SERVER', 3.14];
+
+        yield 'integer from ENV' => ['ENV', 42];
+
+        yield 'CLI simulation BOTH' => ['BOTH', 3];
+    }
+
     private function createRouteCollection(): RouteCollection
     {
         return new RouteCollection(Services::locator(), new Modules(), new Routing());
@@ -276,6 +313,40 @@ public function testEscapeRecursiveArrayRaw(): void
         $this->assertSame($data, esc($data, 'raw'));
     }
 
+    public function testEscapeArrayDoesNotLeakForeachReference(): void
+    {
+        $data = ['first' => '<b>bold</b>', 'last' => '<i>italic</i>'];
+
+        $escaped = esc($data);
+
+        $value = 'CORRUPTED';
+
+        $this->assertSame('&lt;b&gt;bold&lt;/b&gt;', $escaped['first']);
+        $this->assertSame('&lt;i&gt;italic&lt;/i&gt;', $escaped['last']);
+    }
+
+    public function testEscapeArrayLastElementNotMutatedAfterCall(): void
+    {
+        $data = ['x' => '<script>', 'y' => '<style>'];
+
+        $escaped = esc($data);
+
+        $this->assertSame('&lt;script&gt;', $escaped['x']);
+        $this->assertSame('&lt;style&gt;', $escaped['y']);
+        $this->assertCount(2, $escaped);
+    }
+
+    public function testEscapeArrayReferenceIsCleanedUpOnSingleElement(): void
+    {
+        $data = ['only' => '<div>'];
+
+        $escaped = esc($data);
+
+        $value = 'OVERWRITE_ATTEMPT';
+
+        $this->assertSame('&lt;div&gt;', $escaped['only']);
+    }
+
     #[PreserveGlobalState(false)]
     #[RunInSeparateProcess]
     #[WithoutErrorHandler]