Null coalescing operator triggers Detected usage of a non-validated input variable

[aaronjorbin]

Null coalescing operators were added to PHP in PHP7. They are "syntactic sugar for the common case of needing to use a ternary in conjunction with isset(). It returns its first operand if it exists and is not NULL; otherwise it returns its second operand."

$test = isset( $_GET['test'] ) ? $_GET['test'] : '';
can become
$test = $_GET['test'] ?? '';

At first glance, It looks like WordPress_Sniff::is_in_isset_or_empty needs to take Null coalescing operators into effect.

[jrfnl]

For that matter, we should also start accounting for the upcoming ??= null coalescing equals operator for which the RFC has been accepted and which is expected to be implemented in PHP 7.2 will be included in PHP 7.4.
Ref: https://wiki.php.net/rfc/null_coalesce_equal_operator

We'll probably will need to wait a little for that though as PHPCS upstream will need to start backfilling for the new token T_COALESCE_EQUAL, so the PHPCS requirement will need to go up by that time as well.