Optimize denylist loop

[Crabcyborg]

Carrying from #3284

Attached are 50KB of text generated from https://www.lipsum.com/feed/html

lorem-ipsum.txt

This update optimizes the str_contains checks by creating a 4-gram index and checking against that first before the more expensive str_contains call.

The optimization is mostly seen when submitting large amount of text, like the 50KB example here.

This removes over 6 seconds from my form submission time.

The string is pretty repetitive so it might not be totally reflective of real cases, but I expect it to still be a huge improvement.

Before

After

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 12434d8e-bf14-4b93-a0b3-2660d28692ce

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[deepsource-io]

DeepSource Code Review

We reviewed changes in c2ba43f...5ba9a39 on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

Important

Some issues found as part of this review are outside of the diff in this pull request and aren't shown in the inline review comments due to GitHub's API limitations. You can see those issues on the DeepSource dashboard.

PR Report Card

Overall Grade

Security   Reliability   Complexity   Hygiene

Code Review Summary

Analyzer	Status	Updated (UTC)	Details
PHP		Aug 28, 2026 6:48p.m.	Review ↗
JavaScript		Aug 28, 2026 6:48p.m.	Review ↗

---

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.

[deepsource-io]

Visibility should be explicitly set for `PREFIX_LENGTH` constant

Visibility (also know as Access Modifiers) can be used to define where it can be accessed. There are three access modifiers available in PHP:

• public - The class members can be accessed from everywhere. This is default.
• protected - The class members can be accessed within the class and by classes derived from that class.
• private - The class members can only be accessed within the class.

The class members(properties, constants, or methods) declared without any explicit visibility keyword are by default considered as public. It is recommended to set visibility explicitly, which increases code readability. In addition, it gives the developer a mental model of where the class member would be accessible, which also leads to a better API design and makes sure that you are not making something public which isn't supposed to be.
Also, as per PSR-12: Extended Coding Style, visibility should be explicitly declared with all class properties, constants and methods.

[deepsource-io]

Visibility should be explicitly set for `MIN_LENGTH_TO_INDEX` constant

Visibility (also know as Access Modifiers) can be used to define where it can be accessed. There are three access modifiers available in PHP:

• public - The class members can be accessed from everywhere. This is default.
• protected - The class members can be accessed within the class and by classes derived from that class.
• private - The class members can only be accessed within the class.

The class members(properties, constants, or methods) declared without any explicit visibility keyword are by default considered as public. It is recommended to set visibility explicitly, which increases code readability. In addition, it gives the developer a mental model of where the class member would be accessible, which also leads to a better API design and makes sure that you are not making something public which isn't supposed to be.
Also, as per PSR-12: Extended Coding Style, visibility should be explicitly declared with all class properties, constants and methods.

[deepsource-io]

Visibility should be explicitly set for `MAX_LENGTH_TO_INDEX` constant

Visibility (also know as Access Modifiers) can be used to define where it can be accessed. There are three access modifiers available in PHP:

• public - The class members can be accessed from everywhere. This is default.
• protected - The class members can be accessed within the class and by classes derived from that class.
• private - The class members can only be accessed within the class.

The class members(properties, constants, or methods) declared without any explicit visibility keyword are by default considered as public. It is recommended to set visibility explicitly, which increases code readability. In addition, it gives the developer a mental model of where the class member would be accessible, which also leads to a better API design and makes sure that you are not making something public which isn't supposed to be.
Also, as per PSR-12: Extended Coding Style, visibility should be explicitly declared with all class properties, constants and methods.

[deepsource-io]

Visibility should be explicitly set for `PREFIX_LENGTH` constant

Visibility (also know as Access Modifiers) can be used to define where it can be accessed. There are three access modifiers available in PHP:

• public - The class members can be accessed from everywhere. This is default.
• protected - The class members can be accessed within the class and by classes derived from that class.
• private - The class members can only be accessed within the class.

The class members(properties, constants, or methods) declared without any explicit visibility keyword are by default considered as public. It is recommended to set visibility explicitly, which increases code readability. In addition, it gives the developer a mental model of where the class member would be accessible, which also leads to a better API design and makes sure that you are not making something public which isn't supposed to be.
Also, as per PSR-12: Extended Coding Style, visibility should be explicitly declared with all class properties, constants and methods.

[deepsource-io]

Visibility should be explicitly set for `MIN_LENGTH_TO_INDEX` constant

Visibility (also know as Access Modifiers) can be used to define where it can be accessed. There are three access modifiers available in PHP:

• public - The class members can be accessed from everywhere. This is default.
• protected - The class members can be accessed within the class and by classes derived from that class.
• private - The class members can only be accessed within the class.

The class members(properties, constants, or methods) declared without any explicit visibility keyword are by default considered as public. It is recommended to set visibility explicitly, which increases code readability. In addition, it gives the developer a mental model of where the class member would be accessible, which also leads to a better API design and makes sure that you are not making something public which isn't supposed to be.
Also, as per PSR-12: Extended Coding Style, visibility should be explicitly declared with all class properties, constants and methods.

[deepsource-io]

Visibility should be explicitly set for `MAX_LENGTH_TO_INDEX` constant

Visibility (also know as Access Modifiers) can be used to define where it can be accessed. There are three access modifiers available in PHP:

• public - The class members can be accessed from everywhere. This is default.
• protected - The class members can be accessed within the class and by classes derived from that class.
• private - The class members can only be accessed within the class.

The class members(properties, constants, or methods) declared without any explicit visibility keyword are by default considered as public. It is recommended to set visibility explicitly, which increases code readability. In addition, it gives the developer a mental model of where the class member would be accessible, which also leads to a better API design and makes sure that you are not making something public which isn't supposed to be.
Also, as per PSR-12: Extended Coding Style, visibility should be explicitly declared with all class properties, constants and methods.

[truongwp]

This looks good.

[Crabcyborg]

Thanks Truong!

🚀