PHP 8.3

Backward Incompatible Changes

PHP Core

Programs that were very close to overflowing the call stack

Programs that were very close to overflowing the call stack may now throw an Error when using more than zend.max_allowed_stack_size-zend.reserved_stack_size bytes of stack (fiber.stack_size-zend.reserved_stack_size for fibers).

Executing proc_get_status() multiple times

Executing proc_get_status() multiple times will now always return the right value on POSIX systems. Previously, only the first call of the function returned the right value. Executing proc_close() after proc_get_status() will now also return the right exit code. Previously this would return -1. Internally, this works by caching the result on POSIX systems. If the previous behaviour is required, it is possible to check the "cached" key in the array returned by proc_get_status() to check whether the result was cached.

Zend Max Execution Timers

Zend Max Execution Timers is now enabled by default for ZTS builds on Linux.

Uses of traits with static properties

Uses of traits with static properties will now redeclare static properties inherited from the parent class. This will create a separate static property storage for the current class. This is analogous to adding the static property to the class directly without traits.

Assigning a negative index to an empty array

Assigning a negative index $n to an empty array will now make sure that the next index is $n+1 instead of 0.

Class constant visibility variance check

Class constant visibility variance is now correctly checked when inherited from interfaces.

WeakMap entries whose key maps to itself

WeakMap entries whose key maps to itself (possibly transitively) may now be removed during cycle collection if the key is not reachable except by iterating over the WeakMap (reachability via iteration is considered weak). Previously, such entries would never be automatically removed.

Date

The DateTime extension has introduced Date extension specific exceptions and errors under the DateError and DateException hierarchies, instead of warnings and generic exceptions. This improves error handling, at the expense of having to check for errors and exceptions.

DOM

Calling DOMChildNode::after(), DOMChildNode::before(), DOMChildNode::replaceWith() on a node that has no parent is now a no-op instead of a hierarchy exception, which is the behaviour demanded by the DOM specification.

Using the DOMParentNode and DOMChildNode methods without a document now works instead of throwing a DOM_HIERARCHY_REQUEST_ERR DOMException. This is in line with the behaviour demanded by the DOM specification.

Calling DOMDocument::createAttributeNS() without specifying a prefix would incorrectly create a default namespace, placing the element inside the namespace instead of the attribute. This bug is now fixed.

DOMDocument::createAttributeNS() would previously incorrectly throw a DOM_NAMESPACE_ERRNAMESPACE_ERR DOMException when the prefix was already used for a different URI. It now correctly chooses a different prefix when there's a prefix name conflict.

New methods and properties were added to some DOM classes. If a userland class inherits from these classes and declare a method or property with the same name, the declarations must be compatible. Otherwise, a typical compile error about incompatible declarations will be thrown. See the list of new features and new functions for a list of the newly implemented methods and properties.

FFI

C functions that have a return type of void now return null instead of returning the following object object(FFI\CData:void) { }

Opcache

The opcache.consistency_checks INI directive was removed. This feature was broken with the tracing JIT, as well as with inheritance cache, and has been disabled without a way to enable it since PHP 8.1.18 and PHP 8.2.5. Both the tracing JIT and inheritance cache may modify shm after the script has been persisted by invalidating its checksum. The attempted fix skipped over the modifiable pointers but was rejected due to complexity. For this reason, it was decided to remove the feature instead.

Phar

The type of Phar class constants are now declared.

Standard

The range() function has had various changes:

  • A TypeError is now thrown when passing objects, resources, or arrays as the boundary inputs.
  • A more descriptive ValueError is thrown when passing 0 for $step.
  • A ValueError is now thrown when using a negative $step for increasing ranges.
  • If $step is a float that can be interpreted as an int, it is now done so.
  • A ValueError is now thrown if any argument is infinity or NAN.
  • An E_WARNING is now emitted if $start or $end is the empty string. The value continues to be cast to the value 0.
  • An E_WARNING is now emitted if $start or $end has more than one byte, only if it is a non-numeric string.
  • An E_WARNING is now emitted if $start or $end is cast to an integer because the other boundary input is a number. (e.g. range(5, 'z');).
  • An E_WARNING is now emitted if $step is a float when trying to generate a range of characters, except if both boundary inputs are numeric strings (e.g. range('5', '9', 0.5); does not produce a warning).
  • range() now produce a list of characters if one of the boundary inputs is a string digit instead of casting the other input to int (e.g. range('9', 'A');).
range('9', 'A'); // ["9", ":", ";", "<", "=", ">", "?", "@", "A"], as of PHP 8.3.0
range('9', 'A'); // [9, 8, 7, 6, 5, 4, 3, 2, 1, 0], prior to PHP 8.3.0
?>

The file() flags error check now catches all invalid flags. Notably FILE_APPEND was previously silently accepted.

SNMP

The type of SNMP class constants are now declared.

PHP 8.2

Backward Incompatible Changes

Date

DateTime::createFromImmutable() now has a tentative return type of static, previously it was DateTime.

DateTimeImmutable::createFromMutable() now has a tentative return type of static, previously it was DateTimeImmutable.

number symbols in relative formats no longer accept multiple signs, e.g. +-2.

ODBC

The ODBC extension now escapes the username and password for the case when both a connection string and username/password are passed, and the string must be appended to. Before, user values containing values needing escaping could have created a malformed connection string, or injected values from user-provided data. The escaping rules should be identical to the .NET BCL DbConnectionOptions behaviour.

PDO_ODBC

The PDO_ODBC extension also escapes the username and password when a connection string is passed. See the change to the ODBC extension for further details.

Standard

glob() now returns an empty array if all paths are restricted by open_basedir. Previously it returned false. Moreover, a warning is now emitted even if only some paths are restricted by open_basedir.

FilesystemIterator::__construct(): prior to PHP 8.2.0, FilesystemIterator::SKIP_DOTS constant was always set and couldn't be disabled. In order to maintain the previous behaviour the constant must be explicitly set when using the flags parameter. The default value from flags parameter has not been modified.

strtolower(), strtoupper(), stristr(), stripos(), strripos(), lcfirst(), ucfirst(), ucwords(), and str_ireplace() are no longer locale-sensitive. They now perform ASCII case conversion, as if the locale were "C". Localized versions of these functions are available in the MBString extension. Moreover, array_change_key_case(), and sorting with SORT_FLAG_CASE now also use ASCII case conversion.

str_split() returns an empty array for an empty string now. Previously it returned an array with a single empty string entry. mb_str_split() is not affected by this change as it was already behaving like that.

ksort() and krsort() now do numeric string comparison under SORT_REGULAR using the standard PHP 8 rules now.

var_export() no longer omits the leading backslash for exported classes, i.e. these are now fully qualified.

Standard PHP Library (SPL)

The following methods now enforce their signature:

SplFileObject::hasChildren() now has a tentative return type of false, previously it was bool.

SplFileObject::getChildren() now has a tentative return type of null, previously it was ?RecursiveIterator.

GlobIterator now returns an empty array if all paths are restricted by open_basedir. Previously it returned false. Moreover, a warning is now emitted even if only some paths are restricted by open_basedir.

PHP 8.1

Backward Incompatible Changes

PHP Core

$GLOBALS Access Restrictions

Access to the $GLOBALS array is now subject to a number of restrictions. Read and write access to individual array elements like $GLOBALS['var'] continues to work as-is. Read-only access to the entire $GLOBALS array also continues to be supported. However, write access to the entire $GLOBALS array is no longer supported. For example, array_pop($GLOBALS) will result in an error.

Usage of static Variables in Inherited Methods

When a method using static variables is inherited (but not overridden), the inherited method will now share static variables with the parent method.

class A {
public static function counter() {
static $counter = 0;
$counter++;
return $counter;
}
}
class B extends A {}
var_dump(A::counter()); // int(1)
var_dump(A::counter()); // int(2)
var_dump(B::counter()); // int(3), previously int(1)
var_dump(B::counter()); // int(4), previously int(2)
?>
This means that static variables in methods now behave the same way as static properties.

Optional parameters specified before required parameters

An optional parameter specified before required parameters is now always treated as required, even when called using named arguments. As of PHP 8.0.0, but prior to PHP 8.1.0, the below emits a deprecation notice on the definition, but runs successfully when called. As of PHP 8.1.0, an error of class ArgumentCountError is thrown, as it would be when called with positional arguments.

function makeyogurt($container = "bowl", $flavour)
{
return "Making a $container of $flavour yogurt.\n";
}
try
{
echo makeyogurt(flavour: "raspberry");
}
catch (Error $e)
{
echo get_class($e), ' - ', $e->getMessage(), "\n";
}
?>

Output of the above example in PHP 8.0:

Deprecated: Required parameter $flavour follows optional parameter $container
 in example.php on line 3
Making a bowl of raspberry yogurt.

Output of the above example in PHP 8.1:

Deprecated: Optional parameter $container declared before required parameter
 $flavour is implicitly treated as a required parameter in example.php on line 3
ArgumentCountError - makeyogurt(): Argument #1 ($container) not passed

Note that a default value of null can be used before required parameters to specify a nullable type, but the parameter will still be required.

Return Type Compatibility with Internal Classes

Most non-final internal methods now require overriding methods to declare a compatible return type, otherwise a deprecated notice is emitted during inheritance validation. In case the return type cannot be declared for an overriding method due to PHP cross-version compatibility concerns, a ReturnTypeWillChange attribute can be added to silence the deprecation notice.

New Keywords

readonly is a keyword now. However, it still may be used as function name.

never is now a reserved word, so it cannot be used to name a class, interface or trait, and is also prohibited from being used in namespaces.

Resource to Object Migration

Several resources have been migrated to objects. Return value checks using is_resource() should be replaced with checks for false.

MySQLi

mysqli_fetch_fields(), and mysqli_fetch_field_direct() will now always return 0 for the max_length. This information can be computed by iterating over the result set, and taking the maximum length. This is what PHP was doing internally previously.

The MYSQLI_STMT_ATTR_UPDATE_MAX_LENGTH option no longer has any effect.

The MYSQLI_STORE_RESULT_COPY_DATA option no longer has any effect. Passing any value to the mode parameter of mysqli::store_result() no longer has any effect.

mysqli::connect() now returns true instead of null on success.

The default error handling mode has been changed from "silent" to "exceptions" See the MySQLi reporting mode page for more details on what this entails, and how to explicitly set this attribute. To restore the previous behaviour use: mysqli_report(MYSQLI_REPORT_OFF);

Classes extending mysqli_stmt::execute() are now required to specify the additional optional parameter.

MySQLnd

The mysqlnd.fetch_data_copy INI directive has been removed. This should not result in user-visible behavior changes.

OpenSSL

EC private keys will now be exported in PKCS#8 format rather than traditional format, just like all other keys.

openssl_pkcs7_encrypt() and openssl_cms_encrypt() will now to default using AES-128-CBC rather than RC2-40. The RC2-40 cipher is considered insecure and not enabled by default by OpenSSL 3.

PHP Data Objects

PDO::ATTR_STRINGIFY_FETCHES now stringifies values of type bool to "0" or "1". Previously bools were not stringified.

Calling PDOStatement::bindColumn() with PDO::PARAM_LOB will now constantly bind a stream result when PDO::ATTR_STRINGIFY_FETCHES is not enabled. Previously, the result would either be a stream or a string depending on the used database driver and the time the binding is performed.

MySQL Driver

Integers and floats in result sets will now be returned using native PHP types instead of strings when using emulated prepared statements. This matches the behavior of native prepared statements. The previous behaviour can be restored by enabling the PDO::ATTR_STRINGIFY_FETCHES option.

SQLite Driver

Integers and floats in results sets will now be returned using native PHP types. The previous behaviour can be restored by enabling the PDO::ATTR_STRINGIFY_FETCHES option.

Phar

To comply with the ArrayAccess interface, Phar::offsetUnset() and PharData::offsetUnset() no longer return a bool.

Standard

version_compare() no longer accepts undocumented operator abbreviations.

htmlspecialchars(), htmlentities(), htmlspecialchars_decode(), html_entity_decode(), and get_html_translation_table() now use ENT_QUOTES | ENT_SUBSTITUTE rather than ENT_COMPAT by default. This means that ' is escaped to ' while previously nothing was done. Additionally, malformed UTF-8 will be replaced by a Unicode substitution character, instead of resulting in an empty string.

debug_zval_dump() now prints the refcount of a reference wrappers with their refcount, instead of only prepending & to the value. This more accurately models reference representation since PHP 7.0.

debug_zval_dump() now prints interned instead of a dummy refcount for interned strings and immutable arrays.

Standard PHP Library (SPL)

SplFixedArray, will now be JSON encoded like an array

PHP 8.0

Backward Incompatible Changes

PHP Core

String to Number Comparison

Non-strict comparisons between numbers and non-numeric strings now work by casting the number to string and comparing the strings. Comparisons between numbers and numeric strings continue to work as before. Notably, this means that 0 == "not-a-number" is considered false now.

Comparison Before After
0 == "0" true true
0 == "0.0" true true
0 == "foo" true false
0 == "" true false
42 == " 42" true true
42 == "42foo" true false

Other incompatible Changes

  • match is now a reserved keyword.

  • mixed is now a reserved word, so it cannot be used to name a class, interface or trait, and is also prohibited from being used in namespaces.

  • Assertion failures now throw by default. If the old behavior is desired, assert.exception=0 can be set in the INI settings.

  • Methods with the same name as the class are no longer interpreted as constructors. The __construct() method should be used instead.

  • The ability to call non-static methods statically has been removed. Thus is_callable() will fail when checking for a non-static method with a classname (must check with an object instance).

  • The (real) and (unset) casts have been removed.

  • The track_errors ini directive has been removed. This means that php_errormsg is no longer available. The error_get_last() function may be used instead.

  • The ability to define case-insensitive constants has been removed. The third argument to define() may no longer be true.

  • The ability to specify an autoloader using an __autoload() function has been removed. spl_autoload_register() should be used instead.

  • The errcontext argument will no longer be passed to custom error handlers set with set_error_handler().

  • create_function() has been removed. Anonymous functions may be used instead.

  • each() has been removed. foreach or ArrayIterator should be used instead.

  • The ability to unbind this from closures that were created from a method, using Closure::fromCallable() or ReflectionMethod::getClosure(), has been removed.

  • The ability to unbind this from proper closures that contain uses of this has also been removed.

  • The ability to use array_key_exists() with objects has been removed. isset() or property_exists() may be used instead.

  • The behavior of array_key_exists() regarding the type of the key parameter has been made consistent with isset() and normal array access. All key types now use the usual coercions and array/object keys throw a TypeError.

  • Any array that has a number n as its first numeric key will use n+1 for its next implicit key, even if n is negative.

  • The default error_reporting level is now E_ALL. Previously it excluded E_NOTICE and E_DEPRECATED.

  • display_startup_errors is now enabled by default.

  • Using parent inside a class that has no parent will now result in a fatal compile-time error.

  • The @ operator will no longer silence fatal errors (E_ERROR, E_CORE_ERROR, E_COMPILE_ERROR, E_USER_ERROR, E_RECOVERABLE_ERROR, E_PARSE). Error handlers that expect error_reporting to be 0 when @ is used, should be adjusted to use a mask check instead:

    // Replace
    function my_error_handler($err_no, $err_msg, $filename, $linenum) {
    if (    error_reporting() == 0) {
    return     false;
    }
    // ...
    }

    // With
    function my_error_handler($err_no, $err_msg, $filename, $linenum) {
    if (!(    error_reporting() & $err_no)) {
    return     false;
    }
    // ...
    }
    ?>

    Additionally, care should be taken that error messages are not displayed in production environments, which can result in information leaks. Please ensure that display_errors=Off is used in conjunction with error logging.

  • #[ is no longer interpreted as the start of a comment, as this syntax is now used for attributes.

  • Inheritance errors due to incompatible method signatures (LSP violations) will now always generate a fatal error. Previously a warning was generated in some cases.

  • The precedence of the concatenation operator has changed relative to bitshifts and addition as well as subtraction.

    echo "Sum: " . $a + $b;
    // was previously interpreted as:
    echo ("Sum: " . $a) + $b;
    // is now interpreted as:
    echo "Sum:" . ($a + $b);
    ?>

  • Arguments with a default value that resolves to null at runtime will no longer implicitly mark the argument type as nullable. Either an explicit nullable type, or an explicit null default value has to be used instead.

    // Replace
    function test(int $arg = CONST_RESOLVING_TO_NULL) {}
    // With
    function test(?int $arg = CONST_RESOLVING_TO_NULL) {}
    // Or
    function test(int $arg = null) {}
    ?>

  • A number of warnings have been converted into Error exceptions:

    • Attempting to write to a property of a non-object. Previously this implicitly created an stdClass object for null, false and empty strings.
    • Attempting to append an element to an array for which the PHP_INT_MAX key is already used.
    • Attempting to use an invalid type (array or object) as an array key or string offset.
    • Attempting to write to an array index of a scalar value.
    • Attempting to unpack a non-array/Traversable.
    • Attempting to access unqualified constants which are undefined. Previously, unqualified constant accesses resulted in a warning and were interpreted as strings.
    • Passing the wrong number of arguments to a non-variadic built-in function will throw an ArgumentCountError.

    A number of notices have been converted into warnings:

    • Attempting to read an undefined variable.
    • Attempting to read an undefined property.
    • Attempting to read an undefined array key.
    • Attempting to read a property of a non-object.
    • Attempting to access an array index of a non-array.
    • Attempting to convert an array to string.
    • Attempting to use a resource as an array key.
    • Attempting to use null, a boolean, or a float as a string offset.
    • Attempting to read an out-of-bounds string offset.
    • Attempting to assign an empty string to a string offset.

  • Attempting to assign multiple bytes to a string offset will now emit a warning.

  • Unexpected characters in source files (such as NUL bytes outside of strings) will now result in a ParseError exception instead of a compile warning.

  • Uncaught exceptions now go through "clean shutdown", which means that destructors will be called after an uncaught exception.

  • The compile time fatal error "Only variables can be passed by reference" has been delayed until runtime, and converted into an "Argument cannot be passed by reference" Error exception.

  • Some "Only variables should be passed by reference" notices have been converted to "Argument cannot be passed by reference" exception.

  • The generated name for anonymous classes has changed. It will now include the name of the first parent or interface:

    new class extends ParentClass {};
    // -> ParentClass@anonymous
    new class implements FirstInterface, SecondInterface {};
    // -> FirstInterface@anonymous
    new class {};
    // -> class@anonymous
    ?>

    The name shown above is still followed by a NUL byte and a unique suffix.

  • Non-absolute trait method references in trait alias adaptations are now required to be unambiguous:

    class X {
    use     T1, T2 {
    func as otherFunc;
    }
    function     func() {}
    }
    ?>

    If both T1::func() and T2::func() exist, this code was previously silently accepted, and func was assumed to refer to T1::func. Now it will generate a fatal error instead, and either T1::func or T2::func needs to be written explicitly.

  • The signature of abstract methods defined in traits is now checked against the implementing class method:

    trait MyTrait {
    abstract private function     neededByTrait(): string;
    }

    class     MyClass {
    use     MyTrait;

    // Error, because of return type mismatch.
    private function neededByTrait(): int { return 42; }
    }
    ?>

  • Disabled functions are now treated exactly like non-existent functions. Calling a disabled function will report it as unknown, and redefining a disabled function is now possible.

  • data:// stream wrappers are no longer writable, which matches the documented behavior.

  • The arithmetic and bitwise operators +, -, *, /, **, %, <<, >>, &, |, ^, ~, ++, -- will now consistently throw a TypeError when one of the operands is an array, resource or non-overloaded object. The only exception to this is the array + array merge operation, which remains supported.

  • Float to string casting will now always behave locale-independently.

    setlocale(LC_ALL, "de_DE");
    $f = 3.14;
    echo     $f, "\n";
    // Previously: 3,14
    // Now: 3.14
    ?>

    See printf(), number_format() and NumberFormatter() for ways to customize number formatting.

  • Support for deprecated curly braces for offset access has been removed.

    // Instead of:
    $array{0};
    $array{"key"};
    // Write:
    $array[0];
    $array["key"];
    ?>

  • Applying the final modifier on a private method will now produce a warning unless that method is the constructor.

  • If an object constructor exit()s, the object destructor will no longer be called. This matches the behavior when the constructor throws.

  • Namespaced names can no longer contain whitespace: While Foo\Bar will be recognized as a namespaced name, Foo \ Bar will not. Conversely, reserved keywords are now permitted as namespace segments, which may also change the interpretation of code: new\x is now the same as constant('new\x'), not new \x().

  • Nested ternaries now require explicit parentheses.

  • debug_backtrace() and Exception::getTrace() will no longer provide references to arguments. It will not be possible to change function arguments through the backtrace.

  • Numeric string handling has been altered to be more intuitive and less error-prone. Trailing whitespace is now allowed in numeric strings for consistency with how leading whitespace is treated. This mostly affects:

    • The is_numeric() function
    • String-to-string comparisons
    • Type declarations
    • Increment and decrement operations

    The concept of a "leading-numeric string" has been mostly dropped; the cases where this remains exist in order to ease migration. Strings which emitted an E_NOTICE "A non well-formed numeric value encountered" will now emit an E_WARNING "A non-numeric value encountered" and all strings which emitted an E_WARNING "A non-numeric value encountered" will now throw a TypeError. This mostly affects:

    • Arithmetic operations
    • Bitwise operations

    This E_WARNING to TypeError change also affects the E_WARNING "Illegal string offset 'string'" for illegal string offsets. The behavior of explicit casts to int/float from strings has not been changed.

  • Magic Methods will now have their arguments and return types checked if they have them declared. The signatures should match the following list:

    • __call(string $name, array $arguments): mixed
    • __callStatic(string $name, array $arguments): mixed
    • __clone(): void
    • __debugInfo(): ?array
    • __get(string $name): mixed
    • __invoke(mixed $arguments): mixed
    • __isset(string $name): bool
    • __serialize(): array
    • __set(string $name, mixed $value): void
    • __set_state(array $properties): object
    • __sleep(): array
    • __unserialize(array $data): void
    • __unset(string $name): void
    • __wakeup(): void

  • call_user_func_array() array keys will now be interpreted as parameter names, instead of being silently ignored.

  • Declaring a function called assert() inside a namespace is no longer allowed, and issues E_COMPILE_ERROR. The assert() function is subject to special handling by the engine, which may lead to inconsistent behavior when defining a namespaced function with the same name.

Resource to Object Migration

Several resources have been migrated to objects. Return value checks using is_resource() should be replaced with checks for false.

COM and .Net (Windows)

The ability to import case-insensitive constants from type libraries has been removed. The second argument to com_load_typelib() may no longer be false; com.autoregister_casesensitive may no longer be disabled; case-insensitive markers in com.typelib_file are ignored.

CURL

CURLOPT_POSTFIELDS no longer accepts objects as arrays. To interpret an object as an array, perform an explicit (array) cast. The same applies to other options accepting arrays as well.

Date and Time

mktime() and gmmktime() now require at least one argument. time() can be used to get the current timestamp.

DOM

Unimplemented classes from the DOM extension that had no behavior and contained test data have been removed. These classes have also been removed in the latest version of the DOM standard:

  • DOMNameList
  • DomImplementationList
  • DOMConfiguration
  • DomError
  • DomErrorHandler
  • DOMImplementationSource
  • DOMLocator
  • DOMUserDataHandler
  • DOMTypeInfo
  • DOMStringExtend

Unimplemented methods from the DOM extension that had no behavior have been removed:

  • DOMNamedNodeMap::setNamedItem()
  • DOMNamedNodeMap::removeNamedItem()
  • DOMNamedNodeMap::setNamedItemNS()
  • DOMNamedNodeMap::removeNamedItemNS()
  • DOMText::replaceWholeText()
  • DOMNode::compareDocumentPosition()
  • DOMNode::isEqualNode()
  • DOMNode::getFeature()
  • DOMNode::setUserData()
  • DOMNode::getUserData()
  • DOMDocument::renameNode()

Enchant

Exif

read_exif_data() has been removed; exif_read_data() should be used instead.

Filter

  • The FILTER_FLAG_SCHEME_REQUIRED and FILTER_FLAG_HOST_REQUIRED flags for the FILTER_VALIDATE_URL filter have been removed. The scheme and host are (and have been) always required.

  • The INPUT_REQUEST and INPUT_SESSION source for filter_input() etc. have been removed. These were never implemented and their use always generated a warning.

GD

  • The deprecated function image2wbmp() has been removed.

  • The deprecated functions png2wbmp() and jpeg2wbmp() have been removed.

  • The default mode parameter of imagecropauto() no longer accepts -1. IMG_CROP_DEFAULT should be used instead.

  • On Windows, php_gd2.dll has been renamed to php_gd.dll.

GMP

gmp_random() has been removed. One of gmp_random_range() or gmp_random_bits() should be used instead.

Iconv

iconv implementations which do not properly set errno in case of errors are no longer supported.

IMAP

Internationalization Functions

  • The deprecated constant INTL_IDNA_VARIANT_2003 has been removed.

  • The deprecated Normalizer::NONE constant has been removed.

LDAP

MBString

OCI8

  • The OCI-Lob class is now called OCILob, and the OCI-Collection class is now called OCICollection for name compliance enforced by PHP 8 arginfo type annotation tooling.

  • Several alias functions have been marked as deprecated.

  • oci_internal_debug() and its alias ociinternaldebug() have been removed.

ODBC

OpenSSL

Regular Expressions (Perl-Compatible)

When passing invalid escape sequences they are no longer interpreted as literals. This behavior previously required the X modifier – which is now ignored.

PHP Data Objects

  • The default error handling mode has been changed from "silent" to "exceptions". See Errors and error handling for details.

  • The signatures of some PDO methods have changed:

    • PDO::query(string $query, ?int $fetchMode = null, mixed ...$fetchModeArgs)
    • PDOStatement::setFetchMode(int $mode, mixed ...$args)

PDO ODBC

The php.ini directive pdo_odbc.db2_instance_name has been removed.

PDO MySQL

PDO::inTransaction() now reports the actual transaction state of the connection, rather than an approximation maintained by PDO. If a query that is subject to "implicit commit" is executed, PDO::inTransaction() will subsequently return false, as a transaction is no longer active.

PostgreSQL

  • The deprecated pg_connect() syntax using multiple parameters instead of a connection string is no longer supported.

  • The deprecated pg_lo_import() and pg_lo_export() signature that passes the connection as the last argument is no longer supported. The connection should be passed as first argument instead.

  • pg_fetch_all() will now return an empty array instead of false for result sets with zero rows.

Phar

Metadata associated with a phar will no longer be automatically unserialized, to fix potential security vulnerabilities due to object instantiation, autoloading, etc.

Reflection

  • The method signatures

    • ReflectionClass::newInstance($args)
    • ReflectionFunction::invoke($args)
    • ReflectionMethod::invoke($object, $args)

    have been changed to:

    • ReflectionClass::newInstance(...$args)
    • ReflectionFunction::invoke(...$args)
    • ReflectionMethod::invoke($object, ...$args)

    Code that must be compatible with both PHP 7 and PHP 8 can use the following signatures to be compatible with both versions:

    • ReflectionClass::newInstance($arg = null, ...$args)
    • ReflectionFunction::invoke($arg = null, ...$args)
    • ReflectionMethod::invoke($object, $arg = null, ...$args)

  • The ReflectionType::__toString() method will now return a complete debug representation of the type, and is no longer deprecated. In particular the result will include a nullability indicator for nullable types. The format of the return value is not stable and may change between PHP versions.

  • Reflection export() methods have been removed. Instead reflection objects can be cast to string.

  • ReflectionMethod::isConstructor() and ReflectionMethod::isDestructor() now also return true for __construct() and __destruct() methods of interfaces. Previously, this would only be true for methods of classes and traits.

  • ReflectionType::isBuiltin() method has been moved to ReflectionNamedType. ReflectionUnionType does not have it.

Sockets

  • The deprecated AI_IDN_ALLOW_UNASSIGNED and AI_IDN_USE_STD3_ASCII_RULES flags for socket_addrinfo_lookup() have been removed.

Standard PHP Library (SPL)

Standard Library

  • assert() will no longer evaluate string arguments, instead they will be treated like any other argument. assert($a == $b) should be used instead of assert('$a == $b'). The assert.quiet_eval ini directive and the ASSERT_QUIET_EVAL constant have also been removed, as they would no longer have any effect.

  • parse_str() can no longer be used without specifying a result array.

  • The string.strip_tags filter has been removed.

  • The needle argument of strpos(), strrpos(), stripos(), strripos(), strstr(), strchr(), strrchr(), and stristr() will now always be interpreted as a string. Previously non-string needles were interpreted as an ASCII code point. An explicit call to chr() can be used to restore the previous behavior.

  • The needle argument for strpos(), strrpos(), stripos(), strripos(), strstr(), stristr() and strrchr() can now be empty.

  • The length argument for substr(), substr_count(), substr_compare(), and iconv_substr() can now be null. null values will behave as if no length argument was provided and will therefore return the remainder of the string instead of an empty string.

  • The length argument for array_splice() can now be null. null values will behave identically to omitting the argument, thus removing everything from the offset to the end of the array.

  • The args argument of vsprintf(), vfprintf(), and vprintf() must now be an array. Previously any type was accepted.

  • The 'salt' option of password_hash() is no longer supported. If the 'salt' option is used a warning is generated, the provided salt is ignored, and a generated salt is used instead.

  • The quotemeta() function will now return an empty string if an empty string was passed. Previously false was returned.

  • The following functions have been removed:

  • FILTER_SANITIZE_MAGIC_QUOTES has been removed.

  • Calling implode() with parameters in a reverse order ($pieces, $glue) is no longer supported.

  • parse_url() will now distinguish absent and empty queries and fragments:

    • http://example.com/foo → query = null, fragment = null
    • http://example.com/foo? → query = "", fragment = null
    • http://example.com/foo# → query = null, fragment = ""
    • http://example.com/foo?# → query = "", fragment = ""
    Previously all cases resulted in query and fragment being null.

  • var_dump() and debug_zval_dump() will now print floating-point numbers using serialize_precision rather than precision. In a default configuration, this means that floating-point numbers are now printed with full accuracy by these debugging functions.

  • If the array returned by __sleep() contains non-existing properties, these are now silently ignored. Previously, such properties would have been serialized as if they had the value null.

  • The default locale on startup is now always "C". No locales are inherited from the environment by default. Previously, LC_ALL was set to "C", while LC_CTYPE was inherited from the environment. However, some functions did not respect the inherited locale without an explicit setlocale() call. An explicit setlocale() call is now always required if a locale component should be changed from the default.

  • The deprecated DES fallback in crypt() has been removed. If an unknown salt format is passed to crypt(), the function will fail with *0 instead of falling back to a weak DES hash now.

  • Specifying out of range rounds for SHA256/SHA512 crypt() will now fail with *0 instead of clamping to the closest limit. This matches glibc behavior.

  • The result of sorting functions may have changed, if the array contains elements that compare as equal.

  • Any functions accepting callbacks that are not explicitly specified to accept parameters by reference will now warn if a callback with reference parameters is used. Examples include array_filter() and array_reduce(). This was already the case for most, but not all, functions previously.

  • The HTTP stream wrapper as used by functions like file_get_contents() now advertises HTTP/1.1 rather than HTTP/1.0 by default. This does not change the behavior of the client, but may cause servers to respond differently. To retain the old behavior, set the 'protocol_version' stream context option, e.g.

    $ctx = stream_context_create(['http' => ['protocol_version' => '1.0']]);
    echo     file_get_contents('http://example.org', false, $ctx);
    ?>

  • Calling crypt() without an explicit salt is no longer supported. If you would like to produce a strong hash with an auto-generated salt, use password_hash() instead.

  • substr(), mb_substr(), iconv_substr() and grapheme_substr() now consistently clamp out-of-bounds offsets to the string boundary. Previously, false was returned instead of the empty string in some cases.

  • On Windows, the program execution functions (proc_open(), exec(), popen() etc.) using the shell, now consistently execute %comspec% /s /c "$commandline", which has the same effect as executing $commandline (without additional quotes).

Sysvsem

  • The auto_release parameter of sem_get() was changed to accept bool values rather than int.

Tidy

Tokenizer

  • T_COMMENT tokens will no longer include a trailing newline. The newline will instead be part of a following T_WHITESPACE token. It should be noted that T_COMMENT is not always followed by whitespace, it may also be followed by T_CLOSE_TAG or end-of-file.

  • Namespaced names are now represented using the T_NAME_QUALIFIED (Foo\Bar), T_NAME_FULLY_QUALIFIED (\Foo\Bar) and T_NAME_RELATIVE (namespace\Foo\Bar) tokens. T_NS_SEPARATOR is only used for standalone namespace separators, and only syntactially valid in conjunction with group use declarations.

XMLReader

XMLReader::open() and XMLReader::xml() are now static methods. They can still be called as instance methods, but inheriting classes need to declare them as static if they override these methods.

XML-RPC

The XML-RPC extension has been moved to PECL and is no longer part of the PHP distribution.

Zip

ZipArchive::OPSYS_Z_CPM has been removed (this name was a typo). Use ZipArchive::OPSYS_CPM instead.

Zlib

Windows PHP Test Packs

The test runner has been renamed from run-test.php to run-tests.php, to match its name in php-src.

PHP 7.4

Backward Incompatible Changes

PHP Core

Array-style access of non-arrays

Trying to use values of type null, bool, int, float or resource as an array (such as $null["key"]) will now generate a notice.

get_declared_classes() function

The get_declared_classes() function no longer returns anonymous classes that have not been instantiated yet.

fn keyword

fn is now a reserved keyword. In particular, it can no longer be used as a function or class name. It can still be used as a method or class constant name.

tag at end of file

at the end of the file (without trailing newline) will now be interpreted as an opening PHP tag. Previously it was interpreted either as a short opening tag followed by literal php and resulted in a syntax error (with short_open_tag=1) or was interpreted as a literal string (with short_open_tag=0).

Stream wrappers

When using include/require on a stream, streamWrapper::stream_set_option() will be invoked with the STREAM_OPTION_READ_BUFFER option. Custom stream wrapper implementations may need to implement the streamWrapper::stream_set_option() method to avoid a warning (always returning false is a sufficient implementation).

Serialization

The o serialization format has been removed. As it is never produced by PHP, this may only break unserialization of manually crafted strings.

Password algorithm constants

Password hashing algorithm identifiers are now nullable strings rather than integers.

  • PASSWORD_DEFAULT was int 1; now is string '2y' (in PHP 7.4.0, 7.4.1, and 7.4.2 it was null)
  • PASSWORD_BCRYPT was int 1; now is string '2y'
  • PASSWORD_ARGON2I was int 2; now is string 'argon2i'
  • PASSWORD_ARGON2ID was int 3; now is string 'argon2id'

Applications correctly using the constants PASSWORD_DEFAULT, PASSWORD_BCRYPT, PASSWORD_ARGON2I, and PASSWORD_ARGON2ID will continue to function correctly.

htmlentities() function

htmlentities() will now raise a notice (instead of a strict standards warning) if it is used with an encoding for which only basic entity substitution is supported, in which case it is equivalent to htmlspecialchars().

fread() and fwrite() function

fread() and fwrite() will now return false if the operation failed. Previously an empty string or 0 was returned. EAGAIN/EWOULDBLOCK are not considered failures.

These functions now also raise a notice on failure, such as when trying to write to a read-only file resource.

BCMath Arbitrary Precision Mathematics

BCMath functions will now warn if a non well-formed number is passed, such as "32foo". The argument will be interpreted as zero, as before.

CURL

Attempting to serialize a CURLFile class will now generate an exception. Previously the exception was only thrown on unserialization.

Using CURLPIPE_HTTP1 is deprecated, and is no longer supported as of cURL 7.62.0.

The $version parameter of curl_version() is deprecated. If any value not equal to the default CURLVERSION_NOW is passed, a warning is raised and the parameter is ignored.

Date and Time

Calling var_dump() or similar on a DateTime or DateTimeImmutable instance will no longer leave behind accessible properties on the object.

Comparison of DateInterval objects (using ==, <, and so on) will now generate a warning and always return false. Previously all DateInterval objects were considered equal, unless they had properties.

Intl

The default parameter value of idn_to_ascii() and idn_to_utf8() is now INTL_IDNA_VARIANT_UTS46 instead of the deprecated INTL_IDNA_VARIANT_2003.

MySQLi

The embedded server functionality has been removed. It was broken since at least PHP 7.0.

The undocumented mysqli::$stat property has been removed in favor of mysqli::stat().

OpenSSL

The openssl_random_pseudo_bytes() function will now throw an exception in error situations, similar to random_bytes(). In particular, an Error is thrown if the number of requested bytes is less than or equal to zero, and an Exception is thrown if sufficient randomness cannot be gathered. The $crypto_strong output argument is guaranteed to always be true if the function does not throw, so explicitly checking it is not necessary.

Regular Expressions (Perl-Compatible)

When PREG_UNMATCHED_AS_NULL mode is used, trailing unmatched capturing groups will now also be set to null (or [null, -1] if offset capture is enabled). This means that the size of the $matches will always be the same.

PHP Data Objects

Attempting to serialize a PDO or PDOStatement instance will now generate an Exception rather than a PDOException, consistent with other internal classes which do not support serialization.

Reflection

Reflection objects will now generate an exception if an attempt is made to serialize them. Serialization for reflection objects was never supported and resulted in corrupted reflection objects. It has been explicitly prohibited now.

The values of the class constant of ReflectionClassConstant, ReflectionMethod and ReflectionProperty have changed.

Standard PHP Library (SPL)

Calling get_object_vars() on an ArrayObject instance will now always return the properties of the ArrayObject itself (or a subclass). Previously it returned the values of the wrapped array/object unless the ArrayObject::STD_PROP_LIST flag was specified.

Other affected operations are:

(array) casts are not affected. They will continue to return either the wrapped array, or the ArrayObject properties, depending on whether the ArrayObject::STD_PROP_LIST flag is used.

SplPriorityQueue::setExtractFlags() will throw an exception if zero is passed. Previously this would generate a recoverable fatal error on the next extraction operation.

ArrayObject, ArrayIterator, SplDoublyLinkedList and SplObjectStorage now support the __serialize() and __unserialize() mechanism in addition to the Serializable interface. This means that serialization payloads created on older PHP versions can still be unserialized, but new payloads created by PHP 7.4 will not be understood by older versions.

Tokenizer

token_get_all() will now emit a T_BAD_CHARACTER token for unexpected characters instead of leaving behind holes in the token stream.

Incoming Cookies

As of PHP 7.4.11, the names of incoming cookies are no longer url-decoded for security reasons.

PHP 7.3

Backward Incompatible Changes

PHP Core

Heredoc/Nowdoc Ending Label Interpretation

Due to the introduction of flexible heredoc/nowdoc syntax, doc strings that contain the ending label inside their body may cause syntax errors or change in interpretation. For example in:

$str = <<abcdefg
 FOO
FOO;
?>
the indented occurrence of FOO did not previously have any special meaning. Now it will be interpreted as the end of the heredoc string and the following FOO; will cause a syntax error. This issue can always be resolved by choosing an ending label that does not occur within the contents of the string.

Continue Targeting Switch issues Warning

continue statements targeting switch control flow structures will now generate a warning. In PHP such continue statements are equivalent to break, while they behave as continue 2 in other languages.

while ($foo) {
switch ($bar) {
case "baz":
continue;
// Warning: "continue" targeting switch is equivalent to
// "break". Did you mean to use "continue 2"?
}
}
?>

Strict Interpretation of Integer String Keys on ArrayAccess

Array accesses of type $obj["123"], where $obj implements ArrayAccess and "123" is an integer string literal will no longer result in an implicit conversion to integer, i.e., $obj->offsetGet("123") will be called instead of $obj->offsetGet(123). This matches existing behavior for non-literals. The behavior of arrays is not affected in any way, they continue to implicitly convert integral string keys to integers.

Static Properties no longer separated by Reference Assignment

In PHP, static properties are shared between inheriting classes, unless the static property is explicitly overridden in a child class. However, due to an implementation artifact it was possible to separate the static properties by assigning a reference. This loophole has been fixed.

class Test {
public static $x = 0;
}
class Test2 extends Test { }

Test2::$x = &$x;
$x = 1;

var_dump(Test::$x, Test2::$x);
// Previously: int(0), int(1)
// Now: int(1), int(1)
?>

References returned by Array and Property Accesses are immediately unwrapped

References returned by array and property accesses are now unwrapped as part of the access. This means that it is no longer possible to modify the reference between the access and the use of the accessed value:

$arr = [1];
$ref =& $arr[0];
var_dump($arr[0] + ($arr[0] = 2));
// Previously: int(4), Now: int(3)
?>
This makes the behavior of references and non-references consistent. Please note that reading and writing a value inside a single expression remains undefined behavior and may change again in the future.

Argument Unpacking of Traversables with non-Integer Keys no longer supported

Argument unpacking stopped working with Traversables with non-integer keys. The following code worked in PHP 5.6-7.2 by accident.

function foo(...$args) {
var_dump($args);
}
function gen() {
yield 1.23 => 123;
}
foo(...gen());
?>

Miscellaneous

The ext_skel utility has been completely redesigned with new options and some old options removed. This is now written in PHP and has no external dependencies.

Support for BeOS has been dropped.

Exceptions thrown due to automatic conversion of warnings into exceptions in EH_THROW mode (e.g. some DateTime exceptions) no longer populate error_get_last() state. As such, they now work the same way as manually thrown exceptions.

TypeError now reports wrong types as int and bool instead of integer and boolean, respectively.

Undefined variables passed to compact() will now be reported as a notice.

getimagesize() and related functions now report the mime type of BMP images as image/bmp instead of image/x-ms-bmp, since the former has been registered with the IANA (see » RFC 7903).

stream_socket_get_name() will now return IPv6 addresses wrapped in brackets. For example "[::1]:1337" will be returned instead of "::1:1337".

BCMath Arbitrary Precision Mathematics

All warnings thrown by BCMath functions are now using PHP's error handling. Formerly some warnings have directly been written to stderr.

bcmul() and bcpow() now return numbers with the requested scale. Formerly, the returned numbers may have omitted trailing decimal zeroes.

IMAP, POP3 and NNTP

rsh/ssh logins are disabled by default. Use imap.enable_insecure_rsh if you want to enable them. Note that the IMAP library does not filter mailbox names before passing them to the rsh/ssh command, thus passing untrusted data to this function with rsh/ssh enabled is insecure.

Multibyte String

Due to added support for named captures, mb_ereg_*() patterns using named captures will behave differently. In particular named captures will be part of matches and mb_ereg_replace() will interpret additional syntax. See Named Captures for more information.

MySQL Improved Extension

Prepared statements now properly report the fractional seconds for DATETIME, TIME and TIMESTAMP columns with decimals specifier (e.g. TIMESTAMP(6) when using microseconds). Formerly, the fractional seconds part was simply omitted from the returned values.

MySQL Functions (PDO_MYSQL)

Prepared statements now properly report the fractional seconds for DATETIME, TIME and TIMESTAMP columns with decimals specifier (e.g. TIMESTAMP(6) when using microseconds). Formerly, the fractional seconds part was simply omitted from the returned values. Please note that this only affects the usage of PDO_MYSQL with emulated prepares turned off (e.g. using the native preparation functionality). Statements using connections having PDO::ATTR_EMULATE_PREPARES=true (which is the default) were not affected by the bug fixed and have already been getting the proper fractional seconds values from the engine.

Reflection

Reflection export to string now uses int and bool instead of integer and boolean, respectively.

Standard PHP Library (SPL)

If an SPL autoloader throws an exception, following autoloaders will not be executed. Previously all autoloaders were executed and exceptions were chained.

SimpleXML

Mathematic operations involving SimpleXML objects will now treat the text as an int or float, whichever is more appropriate. Previously values were treated as ints unconditionally.

Incoming Cookies

As of PHP 7.3.23, the names of incoming cookies are no longer url-decoded for security reasons.

PHP 7.2

Backward incompatible changes

Prevent number_format() from returning negative zero

Previously, it was possible for the number_format() function to return -0. Whilst this is perfectly valid according to the IEEE 754 floating point specification, this oddity was not desirable for displaying formatted numbers in a human-readable form.


var_dump(number_format(-0.01)); // now outputs string(1) "0" instead of string(2) "-0"

Convert numeric keys in object and array casts

Numeric keys are now better handled when casting arrays to objects and objects to arrays (either from explicit casting or by settype()).

This means that integer (or stringy integer) keys from arrays being casted to objects are now accessible:


// array to object
$arr = [0 => 1];
$obj = (object)$arr;
var_dump(
$obj,
$obj->{'0'}, // now accessible
$obj->{0} // now accessible
);

The above example will output:

object(stdClass)#1 (1) {
  ["0"]=>    // string key now, rather than integer key
  int(1)
}
int(1)
int(1)

And integer (or stringy integer) keys from objects being casted to arrays are now accessible:


// object to array
$obj = new class {
public function __construct()
{
$this->{0} = 1;
}
};
$arr = (array)$obj;
var_dump(
$arr,
$arr[0], // now accessible
$arr['0'] // now accessible
);

The above example will output:

array(1) {
  [0]=>    // integer key now, rather than string key
  int(1)
}
int(1)
int(1)

Disallow passing null to get_class()

Previously, passing null to the get_class() function would output the name of the enclosing class. This behaviour has now been removed, where an E_WARNING will be output instead. To achieve the same behaviour as before, the argument should simply be omitted.

Warn when counting non-countable types

An E_WARNING will now be emitted when attempting to count() non-countable types (this includes the sizeof() alias function).


var_dump(
count(null), // NULL is not countable
count(1), // integers are not countable
count('abc'), // strings are not countable
count(new stdClass), // objects not implementing the Countable interface are not countable
count([1,2]) // arrays are countable
);

The above example will output:

Warning: count(): Parameter must be an array or an object that implements Countable in %s on line %d

Warning: count(): Parameter must be an array or an object that implements Countable in %s on line %d

Warning: count(): Parameter must be an array or an object that implements Countable in %s on line %d

Warning: count(): Parameter must be an array or an object that implements Countable in %s on line %d
int(0)
int(1)
int(1)
int(1)
int(2)

Move ext/hash from resources to objects

As part of the long-term migration away from resources, the Hash extension has been updated to use objects instead of resources. The change should be seamless for PHP developers, except for where is_resource() checks have been made (which will need updating to is_object() instead).

Improve SSL/TLS defaults

The following changes to the defaults have been made:

  • tls:// now defaults to TLSv1.0 or TLSv1.1 or TLSv1.2
  • ssl:// an alias of tls://
  • STREAM_CRYPTO_METHOD_TLS_* constants default to TLSv1.0 or TLSv1.1 + TLSv1.2, instead of TLSv1.0 only

gettype() return value on closed resources

Previously, using gettype() on a closed resource would return a string of "unknown type". Now, a string of "resource (closed)" will be returned.

is_object() and __PHP_Incomplete_Class

Previously, using is_object() on the __PHP_Incomplete_Class class would return false. Now, true will be returned.

Promote the error level of undefined constants

Unqualified references to undefined constants will now generate an E_WARNING (instead of an E_NOTICE). In the next major version of PHP, they will generate Error exceptions.

Windows support

The officially supported, minimum Windows versions are now Windows 7/Server 2008 R2.

Checks on default property values of traits

Compatibility checks upon default trait property values will no longer perform casting.

object for class names

The object name was previously soft-reserved in PHP 7.0. This is now hard-reserved, prohibiting it from being used as a class, trait, or interface name.

NetWare support

Support for NetWare has now been removed.

array_unique() with SORT_STRING

While array_unique() with SORT_STRING formerly copied the array and removed non-unique elements (without packing the array afterwards), now a new array is built by adding the unique elements. This can result in different numeric indexes.

bcmod() changes with floats

The bcmod() function no longer truncates fractional numbers to integers. As such, its behavior now follows fmod(), rather than the % operator. For example bcmod('4', '3.5') now returns 0.5 instead of 1.

Hashing functions and non-cryptographic hashes

The hash_hmac(), hash_hmac_file(), hash_pbkdf2(), and hash_init() (with HASH_HMAC) functions no longer accept non-cryptographic hashes.

json_decode() function options

The json_decode() function option, JSON_OBJECT_AS_ARRAY, is now used if the second parameter (assoc) is null. Previously, JSON_OBJECT_AS_ARRAY was always ignored.

rand() and mt_rand() output

Sequences generated by rand() and mt_rand() for a specific seed may differ from PHP 7.1 on 64-bit machines (due to the fixing of a modulo bias bug in the implementation).

Removal of sql.safe_mode ini setting

The sql.safe_mode ini setting has now been removed.

Changes to date_parse() and date_parse_from_format()

The zone element of the array returned by date_parse() and date_parse_from_format() represents seconds instead of minutes now, and its sign is inverted. For instance -120 is now 7200.

Incoming Cookies

As of PHP 7.2.34, the names of incoming cookies are no longer url-decoded for security reasons.

PHP 7.1

Backward incompatible changes

Throw on passing too few function arguments

Previously, a warning would be emitted for invoking user-defined functions with too few arguments. Now, this warning has been promoted to an Error exception. This change only applies to user-defined functions, not internal functions. For example:

function test($param){}
test();

The above example will output something similar to:

Fatal error: Uncaught ArgumentCountError: Too few arguments to function test(), 0 passed in %s on line %d and exactly 1 expected in %s:%d

Forbid dynamic calls to scope introspection functions

Dynamic calls for certain functions have been forbidden (in the form of $func() or array_map('extract', ...), etc). These functions either inspect or modify another scope, and present with them ambiguous and unreliable behavior. The functions are as follows:

(function () {
$func = 'func_num_args';
$func();
})();

The above example will output:

Warning: Cannot call func_num_args() dynamically in %s on line %d

Invalid class, interface, and trait names

The following names cannot be used to name classes, interfaces, or traits:

Numerical string conversions now respect scientific notation

Integer operations and conversions on numerical strings now respect scientific notation. This also includes the (int) cast operation, and the following functions: intval() (where the base is 10), settype(), decbin(), decoct(), and dechex().

Fixes to mt_rand() algorithm

mt_rand() will now default to using the fixed version of the Mersenne Twister algorithm. If deterministic output from mt_rand() was relied upon, then MT_RAND_PHP can be used as optional second parameter to mt_srand() to preserve the old (incorrect) implementation.

rand() aliased to mt_rand() and srand() aliased to mt_srand()

rand() and srand() have now been made aliases to mt_rand() and mt_srand(), respectively. This means that the output for the following functions have changed: rand(), shuffle(), str_shuffle(), and array_rand().

Disallow the ASCII delete control character in identifiers

The ASCII delete control character (0x7F) can no longer be used in identifiers that are not quoted.

error_log changes with syslog value

If the error_log ini setting is set to syslog, the PHP error levels are mapped to the syslog error levels. This brings finer differentiation in the error logs in contrary to the previous approach where all the errors are logged with the notice level only.

Do not call destructors on incomplete objects

Destructors are now never called for objects that throw an exception during the execution of their constructor. In previous versions this behavior depended on whether the object was referenced outside the constructor (e.g. by an exception backtrace).

call_user_func() handling of reference arguments

call_user_func() will now always generate a warning upon calls to functions that expect references as arguments. Previously this depended on whether the call was fully qualified.

Additionally, call_user_func() and call_user_func_array() will no longer abort the function call in this case. The "expected reference" warning will be emitted, but the call will proceed as usual.

The empty index operator is not supported for strings anymore

Applying the empty index operator to a string (e.g. $str[] = $x) throws a fatal error instead of converting silently to array.

Assignment via string index access on an empty string

String modification by character on an empty string now works like for non-empty strings, i.e. writing to an out of range offset pads the string with spaces, where non-integer types are converted to integer, and only the first character of the assigned string is used. Formerly, empty strings where silently treated like an empty array.

$a = '';
$a[10] = 'foo';
var_dump($a);
?>

Output of the above example in PHP 7.0:

array(1) {
  [10]=>
  string(3) "foo"
}

Output of the above example in PHP 7.1:

string(11) "          f"

Removed ini directives

The following ini directives have been removed:

  • session.entropy_file
  • session.entropy_length
  • session.hash_function
  • session.hash_bits_per_character

Array ordering when elements are automatically created during by reference assignments has changed

The order of the elements in an array has changed when those elements have been automatically created by referencing them in a by reference assignment. For example:

$array = [];
$array["a"] =& $array["b"];
$array["b"] = 1;
var_dump($array);
?>

Output of the above example in PHP 7.0:

array(2) {
  ["a"]=>
  &int(1)
  ["b"]=>
  &int(1)
}

Output of the above example in PHP 7.1:

array(2) {
  ["b"]=>
  &int(1)
  ["a"]=>
  &int(1)
}

Sort order of equal elements

The internal sorting algorithm has been improved, what may result in different sort order of elements, which compare as equal, than before.

Note:

Don't rely on the order of elements which compare as equal; it might change anytime.

Error message for E_RECOVERABLE errors

The error message for E_RECOVERABLE errors has been changed from "Catchable fatal error" to "Recoverable fatal error".

$options parameter of unserialize()

The allowed_classes element of the $options parameter of unserialize() is now strictly typed, i.e. if anything other than an array or a bool is given, unserialize() returns false and issues an E_WARNING.

DateTime constructor incorporates microseconds

DateTime and DateTimeImmutable now properly incorporate microseconds when constructed from the current time, either explicitly or with a relative string (e.g. "first day of next month"). This means that naive comparisons of two newly created instances will now more likely return false instead of true:

new DateTime() == new DateTime();
?>

Fatal errors to Error exceptions conversions

In the Date extension, invalid serialization data for DateTime or DatePeriod classes, or timezone initialization failure from serialized data, will now throw an Error exception from the __wakeup() or __set_state() methods, instead of resulting in a fatal error.

In the DBA extension, data modification functions (such as dba_insert()) will now throw an Error exception instead of triggering a catchable fatal error if the key does not contain exactly two elements.

In the DOM extension, invalid schema or RelaxNG validation contexts will now throw an Error exception instead of resulting in a fatal error. Similarly, attempting to register a node class that does not extend the appropriate base class, or attempting to read an invalid property or write to a readonly property, will also now throw an Error exception.

In the IMAP extension, email addresses longer than 16385 bytes will throw an Error exception instead of resulting in a fatal error.

In the Intl extension, failing to call the parent constructor in a class extending Collator before invoking the parent methods will now throw an Error instead of resulting in a recoverable fatal error. Also, cloning a Transliterator object will now throw an Error exception on failure to clone the internal transliterator instead of resulting in a fatal error.

In the LDAP extension, providing an unknown modification type to ldap_batch_modify() will now throw an Error exception instead of resulting in a fatal error.

In the mbstring extension, the mb_ereg() and mb_eregi() functions will now throw a ParseError exception if an invalid PHP expression is provided and the 'e' option is used.

In the Mcrypt extension, the mcrypt_encrypt() and mcrypt_decrypt() will now throw an Error exception instead of resulting in a fatal error if mcrypt cannot be initialized.

In the mysqli extension, attempting to read an invalid property or write to a readonly property will now throw an Error exception instead of resulting in a fatal error.

In the Reflection extension, failing to retrieve a reflection object or retrieve an object property will now throw an Error exception instead of resulting in a fatal error.

In the Session extension, custom session handlers that do not return strings for session IDs will now throw an Error exception instead of resulting in a fatal error when a function is called that must generate a session ID.

In the SimpleXML extension, creating an unnamed or duplicate attribute will now throw an Error exception instead of resulting in a fatal error.

In the SPL extension, attempting to clone an SplDirectory object will now throw an Error exception instead of resulting in a fatal error. Similarly, calling ArrayIterator::append() when iterating over an object will also now throw an Error exception.

In the standard extension, the assert() function, when provided with a string argument as its first parameter, will now throw a ParseError exception instead of resulting in a catchable fatal error if the PHP code is invalid. Similarly, calling forward_static_call() outside of a class scope will now throw an Error exception.

In the Tidy extension, creating a tidyNode manually will now throw an Error exception instead of resulting in a fatal error.

In the WDDX extension, a circular reference when serializing will now throw an Error exception instead of resulting in a fatal error.

In the XML-RPC extension, a circular reference when serializing will now throw an instance of Error exception instead of resulting in a fatal error.

In the Zip extension, the ZipArchive::addGlob() method will now throw an Error exception instead of resulting in a fatal error if glob support is not available.

Lexically bound variables cannot reuse names

Variables bound to a closure via the use construct cannot use the same name as any superglobals, $this, or any parameter. For example, all of these function definition will result in a fatal error:

$f = function () use ($_SERVER) {};
$f = function () use ($this) {};
$f = function ($param) use ($param) {};

long2ip() parameter type change

long2ip() now expects an int instead of a string.

JSON encoding and decoding

The serialize_precision ini setting now controls the serialization precision when encoding floats.

Decoding an empty key now results in an empty property name, rather than _empty_ as a property name.

var_dump(json_decode(json_encode(['' => 1])));

The above example will output something similar to:

object(stdClass)#1 (1) {
  [""]=>
  int(1)
}

When supplying the JSON_UNESCAPED_UNICODE flag to json_encode(), the sequences U+2028 and U+2029 are now escaped.

Changes to mb_ereg() and mb_eregi() parameter semantics

The third parameter to the mb_ereg() and mb_eregi() functions (regs) will now be set to an empty array if nothing was matched. Formerly, the parameter would not have been modified.

Drop support for the sslv2 stream

The sslv2 stream has now been dropped in OpenSSL.

Forbid "return;" for typed returns already at compile-time

Return statements without argument in functions which declare a return type now trigger E_COMPILE_ERROR (unless the return type is declared as void), even if the return statement would never be reached.

PHP 7.0

Backward incompatible changes

Changes to error and exception handling

Many fatal and recoverable fatal errors have been converted to exceptions in PHP 7. These error exceptions inherit from the Error class, which itself implements the Throwable interface (the new base interface all exceptions inherit).

This means that custom error handlers may no longer be triggered because exceptions may be thrown instead (causing new fatal errors for uncaught Error exceptions).

A fuller description of how errors operate in PHP 7 can be found on the PHP 7 errors page. This migration guide will merely enumerate the changes that affect backward compatibility.

set_exception_handler() is no longer guaranteed to receive Exception objects

Code that implements an exception handler registered with set_exception_handler() using a type declaration of Exception will cause a fatal error when an Error object is thrown.

If the handler needs to work on both PHP 5 and 7, you should remove the type declaration from the handler, while code that is being migrated to work on PHP 7 exclusively can simply replace the Exception type declaration with Throwable instead.

// PHP 5 era code that will break.
function handler(Exception $e) { ... }
set_exception_handler('handler');

// PHP 5 and 7 compatible.
function handler($e) { ... }

// PHP 7 only.
function handler(Throwable $e) { ... }
?>

Internal constructors always throw exceptions on failure

Previously, some internal classes would return null or an unusable object when the constructor failed. All internal classes will now throw an Exception in this case in the same way that user classes already had to.

Parse errors throw ParseError

Parser errors now throw a ParseError object. Error handling for eval() should now include a catch block that can handle this error.

E_STRICT notices severity changes

All of the E_STRICT notices have been reclassified to other levels. E_STRICT constant is retained, so calls like error_reporting(E_ALL|E_STRICT) will not cause an error.

E_STRICT notices severity changes
Situation New level/behaviour
Indexing by a resource E_NOTICE
Abstract static methods Notice removed, triggers no error
"Redefining" a constructor Notice removed, triggers no error
Signature mismatch during inheritance E_WARNING
Same (compatible) property in two used traits Notice removed, triggers no error
Accessing static property non-statically E_NOTICE
Only variables should be assigned by reference E_NOTICE
Only variables should be passed by reference E_NOTICE
Calling non-static methods statically E_DEPRECATED

Changes to variable handling

PHP 7 now uses an abstract syntax tree when parsing source files. This has permitted many improvements to the language which were previously impossible due to limitations in the parser used in earlier versions of PHP, but has resulted in the removal of a few special cases for consistency reasons, which has resulted in backward compatibility breaks. These cases are detailed in this section.

Changes to the handling of indirect variables, properties, and methods

Indirect access to variables, properties, and methods will now be evaluated strictly in left-to-right order, as opposed to the previous mix of special cases. The table below shows how the order of evaluation has changed.

Old and new evaluation of indirect expressions
Expression PHP 5 interpretation PHP 7 interpretation
$$foo['bar']['baz'] ${$foo['bar']['baz']} ($$foo)['bar']['baz']
$foo->$bar['baz'] $foo->{$bar['baz']} ($foo->$bar)['baz']
$foo->$bar['baz']() $foo->{$bar['baz']}() ($foo->$bar)['baz']()
Foo::$bar['baz']() Foo::{$bar['baz']}() (Foo::$bar)['baz']()

Code that used the old right-to-left evaluation order must be rewritten to explicitly use that evaluation order with curly braces (see the above middle column). This will make the code both forwards compatible with PHP 7.x and backwards compatible with PHP 5.x.

This also affects the global keyword. The curly brace syntax can be used to emulate the previous behaviour if required:

function f() {
// Valid in PHP 5 only.
global $$foo->bar;

// Valid in PHP 5 and 7.
global ${$foo->bar};
}
?>

Changes to list() handling

list() no longer assigns variables in reverse order

list() will now assign values to variables in the order they are defined, rather than reverse order. In general, this only affects the case where list() is being used in conjunction with the array [] operator, as shown below:

list($a[], $a[], $a[]) = [1, 2, 3];
var_dump($a);
?>

Output of the above example in PHP 5:

array(3) {
  [0]=>
  int(3)
  [1]=>
  int(2)
  [2]=>
  int(1)
}

Output of the above example in PHP 7:

array(3) {
  [0]=>
  int(1)
  [1]=>
  int(2)
  [2]=>
  int(3)
}

In general, it is recommended not to rely on the order in which list() assignments occur, as this is an implementation detail that may change again in the future.

Empty list() assignments have been removed

list() constructs can no longer be empty. The following are no longer allowed:

list() = $a;
list(,,) = $a;
list($x, list(), $y) = $a;
?>
list() cannot unpack strings

list() can no longer unpack string variables. str_split() should be used instead.

Array ordering when elements are automatically created during by reference assignments has changed

The order of the elements in an array has changed when those elements have been automatically created by referencing them in a by reference assignment. For example:

$array = [];
$array["a"] =& $array["b"];
$array["b"] = 1;
var_dump($array);
?>

Output of the above example in PHP 5:

array(2) {
  ["b"]=>
  &int(1)
  ["a"]=>
  &int(1)
}

Output of the above example in PHP 7:

array(2) {
  ["a"]=>
  &int(1)
  ["b"]=>
  &int(1)
}

Parentheses around function arguments no longer affect behaviour

In PHP 5, using redundant parentheses around a function argument could quiet strict standards warnings when the function argument was passed by reference. The warning will now always be issued.

function getArray() {
return [1, 2, 3];
}

function squareArray(array &$a) {
foreach ($a as &$v) {
$v **= 2;
}
}

// Generates a warning in PHP 7.
squareArray((getArray()));
?>

The above example will output:

Notice: Only variables should be passed by reference in /tmp/test.php on line 13

Changes to foreach

Minor changes have been made to the behaviour of the foreach control structure, primarily around the handling of the internal array pointer and modification of the array being iterated over.

foreach no longer changes the internal array pointer

Prior to PHP 7, the internal array pointer was modified while an array was being iterated over with foreach. This is no longer the case, as shown in the following example:

$array = [0, 1, 2];
foreach ($array as &$val) {
var_dump(current($array));
}
?>

Output of the above example in PHP 5:

int(1)
int(2)
bool(false)

Output of the above example in PHP 7:

int(0)
int(0)
int(0)

foreach by-value operates on a copy of the array

When used in the default by-value mode, foreach will now operate on a copy of the array being iterated rather than the array itself. This means that changes to the array made during iteration will not affect the values that are iterated.

foreach by-reference has improved iteration behaviour

When iterating by-reference, foreach will now do a better job of tracking changes to the array made during iteration. For example, appending to an array while iterating will now result in the appended values being iterated over as well:

$array = [0];
foreach ($array as &$val) {
var_dump($val);
$array[1] = 1;
}
?>

Output of the above example in PHP 5:

int(0)

Output of the above example in PHP 7:

int(0)
int(1)

Iteration of non-Traversable objects

Iterating over a non-Traversable object will now have the same behaviour as iterating over by-reference arrays. This results in the improved behaviour when modifying an array during iteration also being applied when properties are added to or removed from the object.

Changes to int handling

Invalid octal literals

Previously, octal literals that contained invalid numbers were silently truncated (0128 was taken as 012). Now, an invalid octal literal will cause a parse error.

Negative bitshifts

Bitwise shifts by negative numbers will now throw an ArithmeticError:

var_dump(1 >> -1);
?>

Output of the above example in PHP 5:

int(0)

Output of the above example in PHP 7:

Fatal error: Uncaught ArithmeticError: Bit shift by negative number in /tmp/test.php:2
Stack trace:
#0 {main}
  thrown in /tmp/test.php on line 2

Out of range bitshifts

Bitwise shifts (in either direction) beyond the bit width of an int will always result in 0. Previously, the behaviour of such shifts was architecture dependent.

Changes to Division By Zero

Previously, when 0 was used as the divisor for either the divide (/) or modulus (%) operators, an E_WARNING would be emitted and false would be returned. Now, the divide operator returns a float as either +INF, -INF, or NAN, as specified by IEEE 754. The modulus operator E_WARNING has been removed and will throw a DivisionByZeroError exception.

var_dump(3/0);
var_dump(0/0);
var_dump(0%0);
?>

Output of the above example in PHP 5:

Warning: Division by zero in %s on line %d
bool(false)

Warning: Division by zero in %s on line %d
bool(false)

Warning: Division by zero in %s on line %d
bool(false)

Output of the above example in PHP 7:

Warning: Division by zero in %s on line %d
float(INF)

Warning: Division by zero in %s on line %d
float(NAN)

PHP Fatal error:  Uncaught DivisionByZeroError: Modulo by zero in %s line %d

Changes to string handling

Hexadecimal strings are no longer considered numeric

Strings containing hexadecimal numbers are no longer considered to be numeric. For example:

var_dump("0x123" == "291");
var_dump(is_numeric("0x123"));
var_dump("0xe" + "0x1");
var_dump(substr("foo", "0x1"));
?>

Output of the above example in PHP 5:

bool(true)
bool(true)
int(15)
string(2) "oo"

Output of the above example in PHP 7:

bool(false)
bool(false)
int(0)

Notice: A non well formed numeric value encountered in /tmp/test.php on line 5
string(3) "foo"

filter_var() can be used to check if a string contains a hexadecimal number, and also to convert a string of that type to an int:

$str = "0xffff";
$int = filter_var($str, FILTER_VALIDATE_INT, FILTER_FLAG_ALLOW_HEX);
if (false === $int) {
throw new Exception("Invalid integer!");
}
var_dump($int); // int(65535)
?>

\u{ may cause errors

Due to the addition of the new Unicode codepoint escape syntax, strings containing a literal \u{ followed by an invalid sequence will cause a fatal error. To avoid this, the leading backslash should be escaped.

Removed functions

call_user_method() and call_user_method_array()

These functions were deprecated in PHP 4.1.0 in favour of call_user_func() and call_user_func_array(). You may also want to consider using variable functions and/or the ... operator.

All ereg* functions

All ereg functions were removed. PCRE is a recommended alternative.

mcrypt aliases

The deprecated mcrypt_generic_end() function has been removed in favour of mcrypt_generic_deinit().

Additionally, the deprecated mcrypt_ecb(), mcrypt_cbc(), mcrypt_cfb() and mcrypt_ofb() functions have been removed in favour of using mcrypt_decrypt() with the appropriate MCRYPT_MODE_* constant.

All ext/mysql functions

All ext/mysql functions were removed. For details about choosing a different MySQL API, see Choosing a MySQL API.

All ext/mssql functions

All ext/mssql functions were removed.

intl aliases

The deprecated datefmt_set_timezone_id() and IntlDateFormatter::setTimeZoneID() aliases have been removed in favour of datefmt_set_timezone() and IntlDateFormatter::setTimeZone(), respectively.

set_magic_quotes_runtime()

set_magic_quotes_runtime(), along with its alias magic_quotes_runtime(), have been removed. They were deprecated in PHP 5.3.0, and became effectively non-functional with the removal of magic quotes in PHP 5.4.0.

set_socket_blocking()

The deprecated set_socket_blocking() alias has been removed in favour of stream_set_blocking().

dl() in PHP-FPM

dl() can no longer be used in PHP-FPM. It remains functional in the CLI and embed SAPIs.

GD Type1 functions

Support for PostScript Type1 fonts has been removed from the GD extension, resulting in the removal of the following functions:

  • imagepsbbox()
  • imagepsencodefont()
  • imagepsextendfont()
  • imagepsfreefont()
  • imagepsloadfont()
  • imagepsslantfont()
  • imagepstext()

Using TrueType fonts and their associated functions is recommended instead.

Removed INI directives

Removed features

The following INI directives have been removed as their associated features have also been removed:

  • always_populate_raw_post_data
  • asp_tags

xsl.security_prefs

The xsl.security_prefs directive has been removed. Instead, the XsltProcessor::setSecurityPrefs() method should be called to control the security preferences on a per-processor basis.

Other backward incompatible changes

New objects cannot be assigned by reference

The result of the new statement can no longer be assigned to a variable by reference:

class C {}
$c =& new C;
?>

Output of the above example in PHP 5:

Deprecated: Assigning the return value of new by reference is deprecated in /tmp/test.php on line 3

Output of the above example in PHP 7:

Parse error: syntax error, unexpected 'new' (T_NEW) in /tmp/test.php on line 3

Invalid class, interface and trait names

The following names cannot be used to name classes, interfaces or traits:

  • bool
  • int
  • float
  • string
  • null
  • true
  • false

Furthermore, the following names should not be used. Although they will not generate an error in PHP 7.0, they are reserved for future use and should be considered deprecated.

  • resource
  • object
  • mixed
  • numeric

ASP and script PHP tags removed

Support for using ASP and script tags to delimit PHP code has been removed. The affected tags are:

Removed ASP and script tags
Opening tag Closing tag
<% %>
<%= %>

Calls from incompatible context removed

Previously deprecated in PHP 5.6, static calls made to a non-static method with an incompatible context will now result in the called method having an undefined $this variable and a deprecation warning being issued.

class A {
public function test() { var_dump($this); }
}

// Note: Does NOT extend A
class B {
public function callNonStaticMethodOfA() { A::test(); }
}

(new B)->callNonStaticMethodOfA();
?>

Output of the above example in PHP 5.6:

Deprecated: Non-static method A::test() should not be called statically, assuming $this from incompatible context in /tmp/test.php on line 8
object(B)#1 (0) {
}

Output of the above example in PHP 7:

Deprecated: Non-static method A::test() should not be called statically in /tmp/test.php on line 8

Notice: Undefined variable: this in /tmp/test.php on line 3
NULL

yield is now a right associative operator

The yield construct no longer requires parentheses, and has been changed to a right associative operator with precedence between print and =>. This can result in changed behaviour:

echo yield -1;
// Was previously interpreted as
echo (yield) - 1;
// And is now interpreted as
echo yield (-1);

yield $foo or die;
// Was previously interpreted as
yield ($foo or die);
// And is now interpreted as
(yield $foo) or die;
?>

Parentheses can be used to disambiguate those cases.

Functions cannot have multiple parameters with the same name

It is no longer possible to define two or more function parameters with the same name. For example, the following function will trigger an E_COMPILE_ERROR:

function foo($a, $b, $unused, $unused) {
//
}
?>

Functions inspecting arguments report the current parameter value

func_get_arg(), func_get_args(), debug_backtrace() and exception backtraces will no longer report the original value that was passed to a parameter, but will instead provide the current value (which might have been modified).

function foo($x) {
$x++;
var_dump(func_get_arg(0));
}
foo(1);?>

Output of the above example in PHP 5:

1

Output of the above example in PHP 7:

2

Switch statements cannot have multiple default blocks

It is no longer possible to define two or more default blocks in a switch statement. For example, the following switch statement will trigger an E_COMPILE_ERROR:

switch (1) {
default:
break;
default:
break;
}
?>

$HTTP_RAW_POST_DATA removed

$HTTP_RAW_POST_DATA is no longer available. The php://input stream should be used instead.

# comments in INI files removed

Support for prefixing comments with # in INI files has been removed. ; (semi-colon) should be used instead. This change applies to php.ini, as well as files handled by parse_ini_file() and parse_ini_string().

JSON extension replaced with JSOND

The JSON extension has been replaced with JSOND, causing three minor BC breaks. Firstly, a number must not end in a decimal point (i.e. 34. must be changed to either 34.0 or 34). Secondly, when using scientific notation, the e exponent must not immediately follow a decimal point (i.e. 3.e3 must be changed to either 3.0e3 or 3e3). Finally, an empty string is no longer considered valid JSON.

Internal function failure on overflow

Previously, internal functions would silently truncate numbers produced from float-to-integer coercions when the float was too large to represent as an integer. Now, an E_WARNING will be emitted and null will be returned.

Fixes to custom session handler return values

Any predicate functions implemented by custom session handlers that return either false or -1 will be fatal errors. If any value from these functions other than a boolean, -1, or 0 is returned, then it will fail and an E_WARNING will be emitted.

Sort order of equal elements

The internal sorting algorithm has been improved, what may result in different sort order of elements, which compare as equal, than before.

Note:

Don't rely on the order of elements which compare as equal; it might change anytime.

Misplaced break and continue statements

break and continue statements outside of a loop or switch control structure are now detected at compile-time instead of run-time as before, and trigger an E_COMPILE_ERROR.

Mhash is not an extension anymore

The Mhash extension has been fully integrated into the Hash extension. Therefore, it is no longer possible to detect Mhash support with extension_loaded(); use function_exists() instead. Furthermore, Mhash is no longer reported by get_loaded_extensions() and related features.

declare(ticks)

The declare(ticks) directive does no longer leak into different compilation units.

PHP 5.6

Backward incompatible changes

Although most existing PHP 5 code should work without changes, please take note of some backward incompatible changes:

Array keys won't be overwritten when defining an array as a property of a class via an array literal

Previously, arrays declared as class properties which mixed explicit and implicit keys could have array elements silently overwritten if an explicit key was the same as a sequential implicit key. For example:

class C {
const ONE = 1;
public $array = [
self::ONE => 'foo',
'bar',
'quux',
];
}

var_dump((new C)->array);
?>

Output of the above example in PHP 5.5:

array(2) {
  [0]=>
  string(3) "bar"
  [1]=>
  string(4) "quux"
}

Output of the above example in PHP 5.6:

array(3) {
  [1]=>
  string(3) "foo"
  [2]=>
  string(3) "bar"
  [3]=>
  string(4) "quux"
}

json_decode() strictness

json_decode() now rejects non-lowercase variants of the JSON literals true, false and null at all times, as per the JSON specification, and sets json_last_error() accordingly. Previously, inputs to json_decode() that consisted solely of one of these values in upper or mixed case were accepted.

This change will only affect cases where invalid JSON was being passed to json_decode(): valid JSON input is unaffected and will continue to be parsed normally.

Stream wrappers now verify peer certificates and host names by default when using SSL/TLS

All encrypted client streams now enable peer verification by default. By default, this will use OpenSSL's default CA bundle to verify the peer certificate. In most cases, no changes will need to be made to communicate with servers with valid SSL certificates, as distributors generally configure OpenSSL to use known good CA bundles.

The default CA bundle may be overridden on a global basis by setting either the openssl.cafile or openssl.capath configuration setting, or on a per request basis by using the cafile or capath context options.

While not recommended in general, it is possible to disable peer certificate verification for a request by setting the verify_peer context option to false, and to disable peer name validation by setting the verify_peer_name context option to false.

GMP resources are now objects

GMP resources are now objects. The functional API implemented in the GMP extension has not changed, and code should run unmodified unless it checks explicitly for a resource using is_resource() or similar.

Mcrypt functions now require valid keys and IVs

mcrypt_encrypt(), mcrypt_decrypt(), mcrypt_cbc(), mcrypt_cfb(), mcrypt_ecb(), mcrypt_generic() and mcrypt_ofb() will no longer accept keys or IVs with incorrect sizes, and block cipher modes that require IVs will now fail if an IV isn't provided.

cURL file uploads

Uploads using the @file syntax now require CURLOPT_SAFE_UPLOAD to be set to false. CURLFile should be used instead.

PHP 5.5

Backward Incompatible Changes

Although most existing PHP 5 code should work without changes, please take note of some backward incompatible changes:

Windows XP and 2003 support dropped

Support for Windows XP and 2003 has been dropped. Windows builds of PHP now require Windows Vista or newer.

Case insensitivity no longer locale specific

All case insensitive matching for function, class and constant names is now performed in a locale independent manner according to ASCII rules. This improves support for languages using the Latin alphabet with unusual collating rules, such as Turkish and Azeri.

This may cause issues for code that uses case insensitive matches for non-ASCII characters in multibyte character sets (including UTF-8), such as accented characters in many European languages. If you have a non-English, non-ASCII code base, then you will need to test that you are not inadvertently relying on this behaviour before deploying PHP 5.5 to production systems.

pack() and unpack() changes

Changes were made to pack() and unpack() to make them more compatible with Perl:

  • pack() now supports the "Z" format code, which behaves identically to "a".
  • unpack() now support the "Z" format code for NULL padded strings, and behaves as "a" did in previous versions: it will strip trailing NULL bytes.
  • unpack() now keeps trailing NULL bytes when the "a" format code is used.
  • unpack() now strips all trailing ASCII whitespace when the "A" format code is used.

Writing backward compatible code that uses the "a" format code with unpack() requires the use of version_compare(), due to the backward compatibility break.

For example:

// Old code:
$data = unpack('a5', $packed);

// New code:
if (version_compare(PHP_VERSION, '5.5.0-dev', '>=')) {
  $data = unpack('Z5', $packed);
} else {
  $data = unpack('a5', $packed);
}
?>

json_encode() changes

When the value passed to json_encode() triggers a JSON encoding error, FALSE is returned instead of partial output, unless options contains JSON_PARTIAL_OUTPUT_ON_ERROR. See json_last_error() for the full list of reasons that can cause JSON encoding to fail. One of the potential failure reasons is that value contains strings containing invalid UTF-8.

self, parent and static are now always case insensitive

Prior to PHP 5.5, cases existed where the self, parent, and static keywords were treated in a case sensitive fashion. These have now been resolved, and these keywords are always handled case insensitively: SELF::CONSTANT is now treated identically to self::CONSTANT.

PHP logo GUIDs removed

The GUIDs that previously resulted in PHP outputting various logos have been removed. This includes the removal of the functions to return those GUIDs. The removed functions are:

Internal execution changes

Extension authors should note that the zend_execute() function can no longer be overridden, and that numerous changes have been made to the execute_data struct and related function and method handling opcodes.

Most extension authors are unlikely to be affected, but those writing extensions that hook deeply into the Zend Engine should read the notes on these changes.

PHP 5.4

Backward Incompatible Changes

Although most existing PHP 5 code should work without changes, please take note of some backward incompatible changes:

  • Safe mode is no longer supported. Any applications that rely on safe mode may need adjustment, in terms of security.
  • Magic quotes has been removed. Applications relying on this feature may need to be updated, to avoid security issues. get_magic_quotes_gpc() and get_magic_quotes_runtime() now always return FALSE. set_magic_quotes_runtime() raises an E_CORE_ERROR level error on trying to enable Magic quotes.
  • The register_globals and register_long_arrays php.ini directives have been removed.
  • The mbstring.script_encoding directive has been removed. Use zend.script_encoding instead.
  • Call-time pass by reference has been removed.
  • The break and continue statements no longer accept variable arguments (e.g., break 1 + foo() * $bar;). Static arguments still work, such as break 2;. As a side effect of this change break 0; and continue 0; are no longer allowed.
  • The default character set for htmlspecialchars(), htmlentities() and html_entity_decode() is now UTF-8, instead of ISO-8859-1. Note that changing your output charset via the default_charset configuration setting does not affect htmlspecialchars/htmlentities unless you are passing "" (an empty string) as the encoding parameter to your htmlspecialchars()/htmlentities()/html_entity_decode() calls. Generally we do not recommend doing this because you should be able to change your output charset without affecting the runtime charset used by these functions. The safest approach is to explicitly set the charset on each call to htmlspecialchars(), htmlentities() and html_entity_decode().
  • In the date and time extension, the timezone can no longer be set using the TZ environment variable. Instead you have to specify a timezone using the date.timezone php.ini option or date_default_timezone_set() function. PHP will no longer attempt to guess the timezone, and will instead fall back to "UTC" and issue a E_WARNING.
  • Non-numeric string offsets - e.g. $a['foo'] where $a is a string - now return false on isset() and true on empty(), and produce a E_WARNING if you try to use them. Offsets of types double, bool and null produce a E_NOTICE. Numeric strings (e.g. $a['2']) still work as before. Note that offsets like '12.3' and '5 foobar' are considered non-numeric and produce a E_WARNING, but are converted to 12 and 5 respectively, for backward compatibility reasons. Note: Following code returns different result. $str='abc';var_dump(isset($str['x'])); // false for PHP 5.4 or later, but true for 5.3 or less
  • Converting an array to a string will now generate an E_NOTICE level error, but the result of the cast will still be the string "Array".
  • Turning NULL, FALSE, or an empty string into an object by adding a property will now emit an E_WARNING level error, instead of E_STRICT.
  • Parameter names that shadow super globals now cause a fatal error. This prohibits code like function foo($_GET, $_POST) {}.
  • The Salsa10 and Salsa20 hash algorithms have been removed.
  • The Tiger hash algorithm now uses big-endian byte ordering. Please follow this example to write code that is compatible with both PHP 5.3 and 5.4.
  • array_combine() now returns array() instead of FALSE when two empty arrays are provided as parameters.
  • If you use htmlentities() with asian character sets, it works like htmlspecialchars() - this has always been the case in previous versions of PHP, but now an E_STRICT level error is emitted.
  • The third parameter of ob_start() has changed from boolean erase to integer flags. Note that code that explicitly set erase to FALSE will no longer behave as expected in PHP 5.4: please follow this example to write code that is compatible with PHP 5.3 and 5.4.

The following keywords are now reserved, and may not be used as names by functions, classes, etc.

The following functions have been removed from PHP:

PHP 5.3

Backward Incompatible Changes

Although most existing PHP 5 code should work without changes, please take note of some backward incompatible changes:

  • The newer internal parameter parsing API has been applied across all the extensions bundled with PHP 5.3.x. This parameter parsing API causes functions to return NULL when passed incompatible parameters. There are some exceptions to this rule, such as the get_class() function, which will continue to return FALSE on error.
  • clearstatcache() no longer clears the realpath cache by default.
  • realpath() is now fully platform-independent. Consequence of this is that invalid relative paths such as __FILE__ . "/../x" do not work anymore.
  • The call_user_func() family of functions now propagate $this even if the callee is a parent class.
  • The array functions natsort(), natcasesort(), usort(), uasort(), uksort(), array_flip(), and array_unique() no longer accept objects passed as arguments. To apply these functions to an object, cast the object to an array first.
  • The behaviour of functions with by-reference parameters called by value has changed. Where previously the function would accept the by-value argument, a fatal error is now emitted. Any previous code passing constants or literals to functions expecting references, will need altering to assign the value to a variable before calling the function.
  • The new mysqlnd library necessitates the use of MySQL 4.1's newer 41-byte password format. Continued use of the old 16-byte passwords will cause mysql_connect() and similar functions to emit the error, "mysqlnd cannot connect to MySQL 4.1+ using old authentication."
  • The new mysqlnd library does not read mysql configuration files (my.cnf/my.ini), as the older libmysqlclient library does. If your code relies on settings in the configuration file, you can load it explicitly with the mysqli_options() function. Note that this means the PDO specific constants PDO::MYSQL_ATTR_READ_DEFAULT_FILE and PDO::MYSQL_ATTR_READ_DEFAULT_GROUP are not defined if MySQL support in PDO is compiled with mysqlnd.
  • The trailing / has been removed from the SplFileInfo class and other related directory classes.
  • The __toString() magic method can no longer accept arguments.
  • The magic methods __get(), __set(), __isset(), __unset(), and __call() must always be public and can no longer be static. Method signatures are now enforced.
  • The __call() magic method is now invoked on access to private and protected methods.
  • func_get_arg(), func_get_args() and func_num_args() can no longer be called from the outermost scope of a file that has been included by calling include or require from within a function in the calling file.
  • An emulation layer for the MHASH extension to wrap around the Hash extension have been added. However not all the algorithms are covered, notable the s2k hashing algorithm. This means that s2k hashing is no longer available as of PHP 5.3.0.

The following keywords are now reserved and may not be used in function, class, etc. names.

PHP 5.2

Backward Incompatible Changes

Although most existing PHP 5 code should work without changes, you should pay attention to the following backward incompatible changes:

  • getrusage() returns NULL when passed incompatible arguments as of PHP 5.2.1.
  • ZipArchive::setCommentName() returns TRUE on success as of PHP 5.2.1.
  • ZipArchive::setCommentIndex() returns TRUE on success as of PHP 5.2.1.
  • SplFileObject::getFilename() returns the filename, not relative/path/to/file, as of PHP 5.2.1.
  • Changed priority of PHPRC environment variable on Win32 The PHPRC environment variable now takes priority over the path stored in the Windows registry.
  • CLI SAPI no longer checks cwd for php.ini or the php-cli.ini file In PHP 5.1.x an undocumented feature was added that made the CLI binary check the current working directory for a PHP configuration file, potentially leading to unpredictable behavior if an unexpected configuration file were read. This functionality was removed in 5.2.0, and PHP will no longer search CWD for the presence of php.ini or php-cli.ini files. See also the command line section of the manual.
  • Added a warning when performing modulus 0 operations In earlier versions of PHP, performing integer % 0 did not emit any warning messages, instead returning an unexpected return value of FALSE. As of PHP 5.2.0, this operation will emit an E_WARNING, as is the case in all other instances where division by zero is performed.
    print 10 % 0;
    /* Warning:  Division by zero in filename on line n */
    ?>
  • Changed __toString() to be called wherever applicable. The magic method __toString() will now be called in a string context, that is, anywhere an object is used as a string. The fallback of returning a string that contains the object identifier was dropped in PHP 5.2.0. It became problematic because an object identifier cannot be considered unique. This change will mean that your application is flawed if you have relied on the object identifier as a return value. An attempt to use that value as a string will now result in a catchable fatal error.
    class foo {}
    $foo = new foo;
    print     $foo;
    /* Catchable fatal error:  Object of class foo could
       not be converted to string in filename on line n */
    ?>
    Even with __toString(), objects cannot be used as array indices or keys. We may add built-in hash support for this at a later date, but as of PHP 5.2.x you will need to either provide your own hashing or use the new SPL function spl_object_hash(). Exceptions can not be thrown from __toString() methods.
    class foo {
        public function     __toString() {
            throw new     Exception;
        }
    }

    try {
        print new     foo;
            /* Fatal error:  Method foo::__toString() must
           not throw an exception in filename on line n */
    } catch(Exception $e) {}
    ?>
  • Dropped abstract static class functions. Due to an oversight, PHP 5.0.x and 5.1.x allowed abstract static functions in classes. As of PHP 5.2.x, only interfaces can have them.
    abstract class foo {
        abstract static function     bar();
            /* Strict Standards:  Static function foo::bar()
           should not be abstract in filename on line n */
    }
    ?>
  • Oracle extension requires at least Oracle 10 on Windows.
  • Added RFC2397 (data: stream) support. The introduction of the 'data' URL scheme has the potential to lead to a change of behavior under Windows. If you are working with a NTFS file system and making use of meta streams in your application, and if you just happen to be using a file with the name 'data:' that is accessed without any path information - it won't work any more. The fix is to use the 'file:' protocol when accessing it. See also » RFC 2397
    /* when allow_url_include is OFF (default) */
    include "data:;base64,PD9waHAgcGhwaW5mbygpOz8+";
    /* Warning:  include(): URL file-access is disabled
       in the server configuration in filename on line n */
    ?>
  • Regression in glob() patterns In version 5.2.4 a security fix caused a regression for patterns of the form "/foo/*/bar/*". Since version 5.2.5 instead of raising a warning the glob() function will return FALSE when openbase_dir restrictions are violated.

PHP 5.0

Backward Incompatible Changes

Although most existing PHP 4 code should work without changes, you should pay attention to the following backward incompatible changes:

  • There are some new reserved keywords.
  • strrpos() and strripos() now use the entire string as a needle.
  • Illegal use of string offsets causes E_ERROR instead of E_WARNING. An example illegal use is: $str = 'abc'; unset($str[0]);.
  • array_merge() was changed to accept only arrays. If a non-array variable is passed, a E_WARNING will be thrown for every such parameter. Be careful because your code may start emitting E_WARNING out of the blue.
  • PATH_TRANSLATED server variable is no longer set implicitly under Apache2 SAPI in contrast to the situation in PHP 4, where it is set to the same value as the SCRIPT_FILENAME server variable when it is not populated by Apache. This change was made to comply with the » CGI/1.1 specification. Please refer to » bug #23610 for further information, and see also the $_SERVER['PATH_TRANSLATED'] description in the manual. This issue also affects PHP versions >= 4.3.2.
  • The T_ML_COMMENT constant is no longer defined by the Tokenizer extension. If error_reporting is set to E_ALL, PHP will generate a notice. Although the T_ML_COMMENT was never used at all, it was defined in PHP 4. In both PHP 4 and PHP 5 // and /* */ are resolved as the T_COMMENT constant. However the PHPDoc style comments /** */, which starting PHP 5 are parsed by PHP, are recognized as T_DOC_COMMENT.
  • $_SERVER should be populated with argc and argv if variables_order includes "S". If you have specifically configured your system to not create $_SERVER, then of course it shouldn't be there. The change was to always make argc and argv available in the CLI version regardless of the variables_order setting. As in, the CLI version will now always populate the global $argc and $argv variables.
  • An object with no properties is no longer considered "empty".
  • In some cases classes must be declared before use. It only happens if some of the new features of PHP 5 (such as interfaces) are used. Otherwise the behaviour is the old.
  • get_class(), get_parent_class() and get_class_methods() now return the name of the classes/methods as they were declared (case-sensitive) which may lead to problems in older scripts that rely on the previous behaviour (the class/method name was always returned lowercased). A possible solution is to search for those functions in all your scripts and use strtolower(). This case sensitivity change also applies to the magical predefined constants __CLASS__, __METHOD__, and __FUNCTION__. The values are returned exactly as they're declared (case-sensitive).
  • ip2long() now returns FALSE when an invalid IP address is passed as argument to the function, and no longer -1.
  • If there are functions defined in the included file, they can be used in the main file independent if they are before return or after. If the file is included twice, PHP 5 issues fatal error because functions were already declared, while PHP 4 doesn't complain about it. It is recommended to use include_once instead of checking if the file was already included and conditionally return inside the included file.
  • include_once and require_once first normalize the path of included file on Windows so that including A.php and a.php include the file just once.
  • Passing an array to a function by value no longer resets the array's internal pointer for array accesses made within the function. In other words, in PHP 4 when you passed an array to a function, its internal pointer inside the function would be reset, while in PHP 5, when you pass an array to a function, its array pointer within the function will be wherever it was when the array was passed to the function.

Example #1 strrpos() and strripos() now use the entire string as a needle

var_dump(strrpos('ABCDEF','DEF')); //int(3)

var_dump(strrpos('ABCDEF','DAF')); //bool(false)
?>

Example #2 An object with no properties is no longer considered "empty"

class test { }
$t = new test();

var_dump(empty($t)); // echo bool(false)

if ($t) {
    // Will be executed
}
?>

Example #3 In some cases classes must be declared before used


//works with no errors:
$a = new a();
class a {
}


//throws an error:
$a = new b();

interface c{
}
class b implements c {
} 

?>

PHP 8.3

PHP 8.1

PHP 7.3

PHP 7.2

New functions

Sodium

PHP 7.0

PHP 5.6

PHP 5.5

New Functions

Intl

  • datefmt_format_object()
  • datefmt_get_calendar_object()
  • datefmt_get_timezone()
  • datefmt_set_timezone()
  • datefmt_get_calendar_object()
  • intlcal_create_instance()
  • intlcal_get_keyword_values_for_locale()
  • intlcal_get_now()
  • intlcal_get_available_locales()
  • intlcal_get()
  • intlcal_get_time()
  • intlcal_set_time()
  • intlcal_add()
  • intlcal_set_time_zone()
  • intlcal_after()
  • intlcal_before()
  • intlcal_set()
  • intlcal_roll()
  • intlcal_clear()
  • intlcal_field_difference()
  • intlcal_get_actual_maximum()
  • intlcal_get_actual_minimum()
  • intlcal_get_day_of_week_type()
  • intlcal_get_first_day_of_week()
  • intlcal_get_greatest_minimum()
  • intlcal_get_least_maximum()
  • intlcal_get_locale()
  • intlcal_get_maximum()
  • intlcal_get_minimal_days_in_first_week()
  • intlcal_get_minimum()
  • intlcal_get_time_zone()
  • intlcal_get_type()
  • intlcal_get_weekend_transition()
  • intlcal_in_daylight_time()
  • intlcal_is_equivalent_to()
  • intlcal_is_lenient()
  • intlcal_is_set()
  • intlcal_is_weekend()
  • intlcal_set_first_day_of_week()
  • intlcal_set_lenient()
  • intlcal_equals()
  • intlcal_get_repeated_wall_time_option()
  • intlcal_get_skipped_wall_time_option()
  • intlcal_set_repeated_wall_time_option()
  • intlcal_set_skipped_wall_time_option()
  • intlcal_from_date_time()
  • intlcal_to_date_time()
  • intlcal_get_error_code()
  • intlcal_get_error_message()
  • intlgregcal_create_instance()
  • intlgregcal_set_gregorian_change()
  • intlgregcal_get_gregorian_change()
  • intlgregcal_is_leap_year()
  • intltz_create_time_zone()
  • intltz_create_default()
  • intltz_get_id()
  • intltz_get_gmt()
  • intltz_get_unknown()
  • intltz_create_enumeration()
  • intltz_count_equivalent_ids()
  • intltz_create_time_zone_id_enumeration()
  • intltz_get_canonical_id()
  • intltz_get_region()
  • intltz_get_tz_data_version()
  • intltz_get_equivalent_id()
  • intltz_use_daylight_time()
  • intltz_get_offset()
  • intltz_get_raw_offset()
  • intltz_has_same_rules()
  • intltz_get_display_name()
  • intltz_get_dst_savings()
  • intltz_from_date_time_zone()
  • intltz_to_date_time_zone()
  • intltz_get_error_code()
  • intltz_get_error_message()

PHP 5.4

PHP 5.3

New Functions

PHP 5.3 introduced some new functions:

PHP Core:

Date/Time:

GMP:

Hash:

IMAP:

JSON:

MySQL Improved:

OpenSSL:

PCNTL:

PCRE:

  • preg_filter() - Perform a regular expression search and replace, returning only results which matched the pattern.

Semaphore:

The following functions are now natively implemented, making them available on all operating systems which can run PHP:

PHP 5.2

New Functions

PHP 5.2.x introduced some new functions:

PHP Core:

Image:

libXML:

mbstring:

  • mb_stripos() - Finds position of first occurrence of a string within another, case insensitive
  • mb_stristr() - Finds first occurrence of a string within another, case insensitive
  • mb_strrchr() - Finds the last occurrence of a character in a string within another
  • mb_strrichr() - Finds the last occurrence of a character in a string within another, case insensitive
  • mb_strripos() - Finds position of last occurrence of a string within another, case insensitive
  • mb_strstr() - Finds first occurrence of a string within another

ming (As of PHP 5.2.1):

  • void ming_setSWFCompression(int num) - Sets output compression
  • void swfmovie::namedanchor(string name) - Creates anchor
  • void swfmovie::protect([string password]) - Protects

openssl:

spl:

  • spl_object_hash() - Return hash id for given object
  • int iterator_apply(Traversable it, mixed function [, mixed params]) - Calls a function for every element in an iterator

pcre:

pgsql:

  • pg_field_table() - Returns the name of the table field belongs to, or table's oid if oid_only is TRUE

posix:

gmp:

xmlwriter:

PHP 5.0

New Functions

In PHP 5 there are some new functions. Here is the list of them:

Arrays:

  • array_combine() - Creates an array by using one array for keys and another for its values
  • array_diff_uassoc() - Computes the difference of arrays with additional index check which is performed by a user supplied callback function
  • array_udiff() - Computes the difference of arrays by using a callback function for data comparison
  • array_udiff_assoc() - Computes the difference of arrays with additional index check. The data is compared by using a callback function
  • array_udiff_uassoc() - Computes the difference of arrays with additional index check. The data is compared by using a callback function. The index check is done by a callback function also
  • array_walk_recursive() - Apply a user function recursively to every member of an array
  • array_uintersect_assoc() - Computes the intersection of arrays with additional index check. The data is compared by using a callback function
  • array_uintersect_uassoc() - Computes the intersection of arrays with additional index check. Both the data and the indexes are compared by using separate callback functions
  • array_uintersect() - Computes the intersection of arrays. The data is compared by using a callback function

InterBase:

iconv:

Streams:

Date and time related:

Strings:

  • str_split() - Convert a string to an array
  • strpbrk() - Search a string for any of a set of characters
  • substr_compare() - Binary safe optionally case insensitive comparison of two strings from an offset, up to length characters

Other:

Note:

The Tidy extension has also changed its API completely.

PHP 8.3

Deprecated Features

PHP Core

Saner Increment/Decrement operators

Using the increment operator (++) on empty, non-numeric, or non-alphanumeric strings is now deprecated. Moreover, incrementing non-numeric strings is soft deprecated. That means no E_DEPRECATED diagnostic is emitted, but this feature should not be used when producing new code. The new str_increment() function should be used instead.

Using the decrement operator (--) on empty or non-numeric strings is now deprecated.

get_class()/get_parent_class() call without arguments

Calling get_class() and get_parent_class() without arguments is now deprecated.

DBA

Calling dba_fetch() with $dba as the 3rd argument is now deprecated.

FFI

Calling FFI::cast(), FFI::new(), and FFI::type() statically is now deprecated.

Intl

The U_MULTIPLE_DECIMAL_SEP*E*RATORS constant had been deprecated, using the U_MULTIPLE_DECIMAL_SEP*A*RATORS constant instead is recommended.

The NumberFormatter::TYPE_CURRENCY constant has been deprecated.

LDAP

Calling ldap_connect() with separate $hostname and $port is deprecated.

MBString

Passing a negative $width to mb_strimwidth() is now deprecated.

Phar

Calling Phar::setStub() with a resource and a $length is now deprecated. Such calls should be replaced by: $phar->setStub(stream_get_contents($resource));

Random

The MT_RAND_PHP Mt19937 variant is deprecated.

Reflection

Calling ReflectionProperty::setValue() with only one parameter is deprecated. To set static properties, pass null as the first parameter.

Standard

The assert_options() function is now deprecated.

The ASSERT_ACTIVE, ASSERT_BAIL, ASSERT_CALLBACK, ASSERT_EXCEPTION, and ASSERT_WARNING constants have been deprecated.

The assert.* INI settings have been deprecated. See the Changes to INI File Handling page for further details.

SQLite3

Using exceptions is now preferred, warnings will be removed in the future. Calling SQLite3::enableExceptions(false) will trigger a deprecation warning in this version.

Zip

The ZipArchive::FL_RECOMPRESS constant is deprecated and will be removed in a future version of libzip.

PHP 8.2

Deprecated Features

PHP Core

Usage of dynamic properties

The creation of dynamic properties is deprecated, unless the class opts in by using the #[\AllowDynamicProperties] attribute. stdClass allows dynamic properties. Usage of the __get()/__set() magic methods is not affected by this change. A dynamic properties deprecation warning can be addressed by:

  • Declaring the property (preferred).
  • Adding the #[\AllowDynamicProperties] attribute to the class (which also applies to all child classes).
  • Using a WeakMap if additional data needs to be associated with an object which one does not own.

Relative callables

Callables that are not accepted by the $callable() syntax (but are accepted by call_user_func()) are deprecated. In particular:

  • "self::method"
  • "parent::method"
  • "static::method"
  • ["self", "method"]
  • ["parent", "method"]
  • ["static", "method"]
  • ["Foo", "Bar::method"]
  • [new Foo, "Bar::method"]
This does not affect normal method callables such as "A::method" or ["A", "method"].

"${var}" and "${expr}" style interpolation

The "${var}" and "${expr}" style of string interpolation is deprecated. Use "$var"/"{$var}" and "{${expr}}", respectively.

MBString

Usage of the QPrint, Base64, Uuencode, and HTML-ENTITIES 'text encodings' is deprecated for all MBString functions. Unlike all the other text encodings supported by MBString, these do not encode a sequence of Unicode codepoints, but rather a sequence of raw bytes. It is not clear what the correct return values for most MBString functions should be when one of these non-encodings is specified. Moreover, PHP has separate, built-in implementations of all of them; for example, UUencoded data can be handled using convert_uuencode()/convert_uudecode().

SPL

The internal SplFileInfo::_bad_state_ex() method has been deprecated.

Standard

utf8_encode() and utf8_decode() have been deprecated.

PHP 8.1

Deprecated Features

PHP Core

Implementing Serializable without __serialize() and __unserialize()

Either only the new methods should be implemented, if no support for PHP prior to version 7.4 is provided, or both should be implemented.

Passing null to non-nullable parameters of built-in functions

Scalar types for built-in functions are nullable by default. This behaviour is deprecated to align with the behaviour of user-defined functions, where scalar types need to be marked as nullable explicitly.

var_dump(str_contains("foobar", null));
// Deprecated: Passing null to parameter #2 ($needle) of type string
// is deprecated
?>

Implicit incompatible float to int conversions

The implicit conversion of float to int which leads to a loss in precision is now deprecated. This affects array keys, int type declarations in coercive mode, and operators working on ints.

$a = [];
$a[15.5]; // deprecated, as key value loses the 0.5 component
$a[15.0]; // ok, as 15.0 == 15
?>

Calling a static element on a trait

Calling a static method, or accessing a static property directly on a trait is deprecated. Static methods and properties should only be accessed on a class using the trait.

Returning a non-array from __sleep()

Returning a value which is not an array from __sleep() now generates a diagnostic.

Returning by reference from a void function

function &test(): void {}
?>
Such a function is contradictory, and already emits the following E_NOTICE when called: Only variable references should be returned by reference.

Autovivification from false

Autovivification is the process of creating a new array when appending to a value. Autovivification is prohibited from scalar values, false however was an exception. This is now deprecated.

$arr = false;
$arr[] = 2; // deprecated
?>

Note:

Autovivification from null and undefined values is still allowed:

// From undefined
$arr[] = 'some value';
$arr['doesNotExist'][] = 2;
// From null
$arr = null;
$arr[] = 2;
?>

ctype

Verifying non-string arguments

Passing a non-string argument is deprecated. In the future, the argument will be interpreted as a string instead of an ASCII codepoint. Depending on the intended behavior, the argument should either be cast to string or an explicit call to chr() should be made. All ctype_*() functions are affected.

Date

date_sunrise() and date_sunset() have been deprecated in favor of date_sun_info().

strptime() has been deprecated. Use date_parse_from_format() instead (for locale-independent parsing), or IntlDateFormatter::parse() (for locale-dependent parsing).

strftime() and gmstrftime() have been deprecated. Use date() instead (for locale-independent formatting), or IntlDateFormatter::format() (for locale-dependent formatting).

Filter

The FILTER_SANITIZE_STRING and FILTER_SANITIZE_STRIPPED filters are deprecated.

The filter.default INI directive is deprecated.

GD

The num_points of imagepolygon(), imageopenpolygon() and imagefilledpolygon() has been deprecated.

Hash

The mhash(), mhash_keygen_s2k(), mhash_count(), mhash_get_block_size(), and mhash_get_hash_name() have been deprecated. Use the hash_*() functions instead.

IMAP

The NIL constant has been deprecated. Use 0 instead.

Intl

Calling IntlCalendar::roll() with a bool argument is deprecated. Use 1 and -1 instead of true and false respectively.

Multibyte String

Calling mb_check_encoding() without any arguments is deprecated.

MySQLi

The mysqli_driver::$driver_version property has been deprecated. It was meaningless and outdated, use PHP_VERSION_ID instead.

Calling mysqli::get_client_info() or mysqli_get_client_info() with the mysqli argument has been deprecated. Call mysqli_get_client_info() without any arguments to obtain the version information of the client library.

The mysqli::init() method has been deprecated. Replace calls to parent::init() with parent::__construct().

OCI8

The oci8.old_oci_close_semantics INI directive is deprecated.

ODBC

odbc_result_all() has been deprecated.

PDO

The PDO::FETCH_SERIALIZE fetch mode has been deprecated.

PgSQL

Not passing the connection argument to all pgsql_*() functions has been deprecated.

SOAP

The ssl_method option of SoapClient::__construct() has been deprecated in favor of SSL stream context options.

Standard

Calling key(), current(), next(), prev(), reset(), or end() on objects is deprecated. Either convert the object to an array using get_mangled_object_vars() first, or use the methods provided by a class that implements Iterator, such as ArrayIterator, instead.

The auto_detect_line_endings INI directive is deprecated. If necessary, handle "\r" line breaks manually instead.

The FILE_BINARY and FILE_TEXT constants have been deprecated. They never had any effect.

PHP 8.0

Deprecated Features

PHP Core

  • If a parameter with a default value is followed by a required parameter, the default value has no effect. This is deprecated as of PHP 8.0.0 and can generally be resolved by dropping the default value, without a change in functionality:

    function test($a = [], $b) {} // Before
    function test($a, $b) {} // After
    ?>

    One exception to this rule are parameters of the form Type $param = null, where the null default makes the type implicitly nullable. This usage remains allowed, but it is recommended to use an explicit nullable type instead:

    function test(A $a = null, $b) {} // Still allowed
    function test(?A $a, $b) {} // Recommended
    ?>

  • Calling get_defined_functions() with exclude_disabled explicitly set to false is deprecated and no longer has an effect. get_defined_functions() will never include disabled functions.

Enchant

LibXML

libxml_disable_entity_loader() has been deprecated. As libxml 2.9.0 is now required, external entity loading is guaranteed to be disabled by default, and this function is no longer needed to protect against XXE attacks, unless the (still vulnerable) LIBXML_NOENT is used. In that case, it is recommended to refactor the code using libxml_set_external_entity_loader() to suppress loading of external entities.

PGSQL / PDO PGSQL

Standard Library

  • Sort comparison functions that return true or false will now throw a deprecation warning, and should be replaced with an implementation that returns an integer less than, equal to, or greater than zero.

    // Replace
    usort($array, fn($a, $b) => $a > $b);
    // With
    usort($array, fn($a, $b) => $a <=> $b);
    ?>

Zip

  • Using an empty file as ZipArchive is deprecated. Libzip 1.6.0 does not accept empty files as valid zip archives any longer. The existing workaround will be removed in the next version.

  • The procedural API of Zip is deprecated. Use ZipArchive instead. Iteration over all entries can be accomplished using ZipArchive::statIndex() and a for loop:

    // iterate using the procedural API
    assert(is_resource($zip));
    while (    $entry = zip_read($zip)) {
    echo     zip_entry_name($entry);
    }

    // iterate using the object-oriented API
    assert($zip instanceof ZipArchive);
    for (    $i = 0; $entry = $zip->statIndex($i); $i++) {
    echo     $entry['name'];
    }
    ?>

Reflection

PHP 7.4

Deprecated Features

PHP Core

Nested ternary operators without explicit parentheses

Nested ternary operations must explicitly use parentheses to dictate the order of the operations. Previously, when used without parentheses, the left-associativity would not result in the expected behaviour in most cases.

1 ? 2 : 3 ? 4 : 5; // deprecated
(1 ? 2 : 3) ? 4 : 5; // ok
1 ? 2 : (3 ? 4 : 5); // ok
?>

Parentheses are not required when nesting into the middle operand, as this is always unambiguous and not affected by associativity:

1 ? 2 ? 3 : 4 : 5 // ok

Array and string offset access using curly braces

The array and string offset access syntax using curly braces is deprecated. Use $var[$idx] instead of $var{$idx}.

(real) cast and is_real() function

The (real) cast is deprecated, use (float) instead.

The is_real() function is also deprecated, use is_float() instead.

Unbinding $this when $this is used

Unbinding $this of a non-static closure that uses $this is deprecated.

parent keyword without parent class

Using parent inside a class without a parent is deprecated, and will throw a compile-time error in the future. Currently an error will only be generated if/when the parent is accessed at run-time.

allow_url_include INI option

The allow_url_include ini directive is deprecated. Enabling it will generate a deprecation notice at startup.

Invalid characters in base conversion functions

Passing invalid characters to base_convert(), bindec(), octdec() and hexdec() will now generate a deprecation notice. The result will still be computed as if the invalid characters did not exist. Leading and trailing whitespace, as well as prefixes of type 0x (depending on base) continue to be allowed.

Using array_key_exists() on objects

Using array_key_exists() on objects is deprecated. Instead either isset() or property_exists() should be used.

Magic quotes functions

The get_magic_quotes_gpc() and get_magic_quotes_runtime() functions are deprecated. They always return false.

hebrevc() function

The hebrevc() function is deprecated. It can be replaced with nl2br(hebrev($str)) or, preferably, the use of Unicode RTL support.

convert_cyr_string() function

The convert_cyr_string() function is deprecated. It can be replaced by one of mb_convert_string(), iconv() or UConverter.

money_format() function

The money_format() function is deprecated. It can be replaced by the intl NumberFormatter functionality.

ezmlm_hash() function

The ezmlm_hash() function is deprecated.

restore_include_path() function

The restore_include_path() function is deprecated. It can be replaced by ini_restore('include_path').

Implode with historical parameter order

Passing parameters to implode() in reverse order is deprecated, use implode($glue, $parts) instead of implode($parts, $glue).

COM

Importing type libraries with case-insensitive constant registering has been deprecated.

Filter

FILTER_SANITIZE_MAGIC_QUOTES is deprecated, use FILTER_SANITIZE_ADD_SLASHES instead.

Multibyte String

Passing a non-string pattern to mb_ereg_replace() is deprecated. Currently, non-string patterns are interpreted as ASCII codepoints. In PHP 8, the pattern will be interpreted as a string instead.

Passing the encoding as 3rd parameter to mb_strrpos() is deprecated. Instead pass a 0 offset, and encoding as 4th parameter.

Lightweight Directory Access Protocol

ldap_control_paged_result_response() and ldap_control_paged_result() are deprecated. Pagination controls can be sent along with ldap_search() instead.

Reflection

Calls to ReflectionType::__toString() now generate a deprecation notice. This method has been deprecated in favor of ReflectionNamedType::getName() in the documentation since PHP 7.1, but did not throw a deprecation notice for technical reasons.

The export() methods on all Reflection classes are deprecated. Construct a Reflection object and convert it to string instead:

// ReflectionClass::export(Foo::class, false) is:
echo new ReflectionClass(Foo::class), "\n";

// $str = ReflectionClass::export(Foo::class, true) is:
$str = (string) new ReflectionClass(Foo::class);
?>

Socket

The AI_IDN_ALLOW_UNASSIGNED and AI_IDN_USE_STD3_ASCII_RULES flags for socket_addrinfo_lookup() are deprecated, due to an upstream deprecation in glibc.

PHP 7.3

Deprecated Features

PHP Core

Case-Insensitive Constants

The declaration of case-insensitive constants has been deprecated. Passing true as the third argument to define() will now generate a deprecation warning. The use of case-insensitive constants with a case that differs from the declaration is also deprecated.

Namespaced assert()

Declaring a function called assert() inside a namespace is deprecated. The assert() function is subject to special handling by the engine, which may lead to inconsistent behavior when defining a namespaced function with the same name.

Strip-Tags Streaming

The fgetss() function and the string.strip_tags stream filter have been deprecated. This also affects the SplFileObject::fgetss() method and gzgetss() function.

Data Filtering

The explicit usage of the constants FILTER_FLAG_SCHEME_REQUIRED and FILTER_FLAG_HOST_REQUIRED is now deprecated; both are implied for FILTER_VALIDATE_URL anyway.

Image Processing and GD

image2wbmp() has been deprecated.

Internationalization Functions

Usage of the Normalizer::NONE form throws a deprecation warning, if PHP is linked with ICU ≥ 56.

Multibyte String

The following undocumented mbereg_*() aliases have been deprecated. Use the corresponding mb_ereg_*() variants instead.

  • mbregex_encoding()
  • mbereg()
  • mberegi()
  • mbereg_replace()
  • mberegi_replace()
  • mbsplit()
  • mbereg_match()
  • mbereg_search()
  • mbereg_search_pos()
  • mbereg_search_regs()
  • mbereg_search_init()
  • mbereg_search_getregs()
  • mbereg_search_getpos()
  • mbereg_search_setpos()

ODBC and DB2 Functions (PDO_ODBC)

The pdo_odbc.db2_instance_name ini setting has been formally deprecated. It is deprecated in the documentation as of PHP 5.1.1.

PHP 7.2

Deprecated features in PHP 7.2.x

Unquoted strings

Unquoted strings that are non-existent global constants are taken to be strings of themselves. This behaviour used to emit an E_NOTICE, but will now emit an E_WARNING. In the next major version of PHP, an Error exception will be thrown instead.


var_dump(NONEXISTENT);

/* Output:
Warning: Use of undefined constant NONEXISTENT - assumed 'NONEXISTENT' (this will throw an Error in a future version of PHP) in %s on line %d
string(11) "NONEXISTENT"
*/

png2wbmp() and jpeg2wbmp()

The png2wbmp() and jpeg2wbmp() functions from the GD extension have now been deprecated and will be removed in the next major version of PHP.

INTL_IDNA_VARIANT_2003 variant

The Intl extension has deprecated the INTL_IDNA_VARIANT_2003 variant, which is currently being used as the default for idn_to_ascii() and idn_to_utf8(). PHP 7.4 will see these defaults changed to INTL_IDNA_VARIANT_UTS46, and the next major version of PHP will remove INTL_IDNA_VARIANT_2003 altogether.

__autoload() method

The __autoload() method has been deprecated because it is inferior to spl_autoload_register() (due to it not being able to chain autoloaders), and there is no interoperability between the two autoloading styles.

track_errors ini setting and $php_errormsg variable

When the track_errors ini setting is enabled, a $php_errormsg variable is created in the local scope when a non-fatal error occurs. Given that the preferred way of retrieving such error information is by using error_get_last(), this feature has been deprecated.

create_function() function

Given the security issues of this function (being a thin wrapper around eval()), this dated function has now been deprecated. The preferred alternative is to use anonymous functions.

mbstring.func_overload ini setting

Given the interoperability problems of string-based functions being used in environments with this setting enabled, it has now been deprecated.

(unset) cast

Casting any expression to this type will always result in null, and so this superfluous casting type has now been deprecated.

parse_str() without a second argument

Without the second argument to parse_str(), the query string parameters would populate the local symbol table. Given the security implications of this, using parse_str() without a second argument has now been deprecated. The function should always be used with two arguments, as the second argument causes the query string to be parsed into an array.

gmp_random() function

This function generates a random number based upon a range that is calculated by an unexposed, platform-specific limb size. Because of this, the function has now been deprecated. The preferred way of generating a random number using the GMP extension is by gmp_random_bits() and gmp_random_range().

each() function

This function is far slower at iteration than a normal foreach, and causes implementation issues for some language changes. It has therefore been deprecated.

assert() with a string argument

Using assert() with a string argument required the string to be eval()'ed. Given the potential for remote code execution, using assert() with a string argument has now been deprecated in favour of using boolean expressions.

$errcontext argument of error handlers

The $errcontext argument contains all local variables of the error site. Given its rare usage, and the problems it causes with internal optimisations, it has now been deprecated. Instead, a debugger should be used to retrieve information on local variables at the error site.

read_exif_data() function

The read_exif_data() alias has been deprecated. The exif_read_data() function should be used instead.

PHP 7.1

Deprecated features in PHP 7.1.x

ext/mcrypt

The mcrypt extension has been abandonware for nearly a decade now, and was also fairly complex to use. It has therefore been deprecated in favour of OpenSSL, where it will be removed from the core and into PECL in PHP 7.2.

Eval option for mb_ereg_replace() and mb_eregi_replace()

The e pattern modifier has been deprecated for the mb_ereg_replace() and mb_eregi_replace() functions.

PHP 7.0

Deprecated features in PHP 7.0.x

PHP 4 style constructors

PHP 4 style constructors (methods that have the same name as the class they are defined in) are deprecated, and will be removed in the future. PHP 7 will emit E_DEPRECATED if a PHP 4 constructor is the only constructor defined within a class. Classes that implement a __construct() method are unaffected.

class foo {
function foo() {
echo 'I am the constructor';
}
}
?>

The above example will output:

Deprecated: Methods with the same name as their class will not be constructors in a future version of PHP; foo has a deprecated constructor in example.php on line 3

Static calls to non-static methods

Static calls to methods that are not declared static are deprecated, and may be removed in the future.

class foo {
function bar() {
echo 'I am not static!';
}
}

foo::bar();
?>

The above example will output:

Deprecated: Non-static method foo::bar() should not be called statically in - on line 8
I am not static!

password_hash() salt option

The salt option for the password_hash() function has been deprecated to prevent developers from generating their own (usually insecure) salts. The function itself generates a cryptographically secure salt when no salt is provided by the developer - therefore custom salt generation should not be needed.

capture_session_meta SSL context option

The capture_session_meta SSL context option has been deprecated. SSL metadata is now available through the stream_get_meta_data() function.

LDAP deprecations

The following function has been deprecated:

PHP 5.6

Deprecated features in PHP 5.6.x

Calls from incompatible context

Methods called from an incompatible context are now deprecated, and will generate E_DEPRECATED errors when invoked instead of E_STRICT. Support for these calls will be removed in a future version of PHP.

An example of such a call is:

class A {
function f() { echo get_class($this); }
}

class B {
function f() { A::f(); }
}

(new B)->f();
?>

The above example will output:

Deprecated: Non-static method A::f() should not be called statically, assuming $this from incompatible context in - on line 7
B

$HTTP_RAW_POST_DATA and always_populate_raw_post_data

always_populate_raw_post_data will now generate an E_DEPRECATED error when $HTTP_RAW_POST_DATA is populated. New code should use php://input instead of $HTTP_RAW_POST_DATA, which will be removed in a future release. You can opt in for the new behaviour (in which $HTTP_RAW_POST_DATA is never defined hence no E_DEPRECATED error will be generated) by setting always_populate_raw_post_data to -1.

iconv and mbstring encoding settings

The iconv and mbstring configuration options related to encoding have been deprecated in favour of default_charset. The deprecated options are:

PHP 5.5

Deprecated features in PHP 5.5.x

ext/mysql deprecation

The original MySQL extension is now deprecated, and will generate E_DEPRECATED errors when connecting to a database. Instead, use the MySQLi or PDO_MySQL extensions.

preg_replace() /e modifier

The preg_replace() /e modifier is now deprecated. Instead, use the preg_replace_callback() function.

intl deprecations

IntlDateFormatter::setTimeZoneID() and datefmt_set_timezone_id() are now deprecated. Instead, use the IntlDateFormatter::setTimeZone() method and datefmt_set_timezone() function, respectively.

mcrypt deprecations

The following functions have been deprecated:

PHP 5.3

Deprecated features in PHP 5.3.x

PHP 5.3.0 introduces two new error levels: E_DEPRECATED and E_USER_DEPRECATED. The E_DEPRECATED error level is used to indicate that a function or feature has been deprecated. The E_USER_DEPRECATED level is intended for indicating deprecated features in user code, similarly to the E_USER_ERROR and E_USER_WARNING levels.

The following is a list of deprecated INI directives. Use of any of these INI directives will cause an E_DEPRECATED error to be thrown at startup.

Deprecated functions:

Deprecated features:

  • Assigning the return value of new by reference is now deprecated.
  • Call-time pass-by-reference is now deprecated.

PHP 8.3

New Features

PHP Core

Readonly Amendments

Anonymous classes may now be marked as readonly.

Readonly properties can now be reinitialized during cloning.

Typed Class Constants

Class, interface, trait, and enum constants now support type declarations.

Closures created from magic methods

Closures created from magic methods can now accept named arguments.

The final modifier with a method from a trait

The final modifier may now be used when using a method from a trait.

Override Attribute

Added the #[\Override] attribute to check that a method exists in a parent class or implemented interface.

Fetch class constant dynamically syntax

Class constants can now be accessed dynamically using the C::{$name} syntax.

Static variable Initializers

Static variable initializers can now contain arbitrary expressions.

Fallback value syntax for ini variables

php.ini now supports fallback/default value syntax.

/*
On /path/to/user.ini contains the following settings:

listen = localhost:${DRUPAL_FPM_PORT:-9000}
*/

$user_ini = parse_ini_file('/path/to/user.ini');
echo $user_ini['listen']; // localhost:9000

CLI

It is now possible to lint multiple files.

DOM

Added properties DOMElement::$className and DOMElement::$id. These are not binary-safe at the moment because of underlying limitations of libxml2. This means that the property values will be cut off at a NUL byte.

Added properties DOMNode::$isConnected and DOMNameSpaceNode::$isConnected.

Added properties DOMNode::$parentElement and DOMNameSpaceNode::$parentElement.

FFI

It is now possible to assign FFI\CData to other FFI\CData. Meaning CData can now be assigned to structs and fields.

Opcache

opcache_get_status()['scripts'][n]['revalidate'] now contains a Unix timestamp of when the next revalidation of the scripts timestamp is due, dictated by the opcache.revalidate_freq INI directive.

POSIX

posix_getrlimit() now takes an optional $res parameter to allow fetching a single resource limit.

posix_isatty() now raises type warnings for integers following the usual ZPP semantics.

posix_ttyname() now raises type warnings for integers following the usual ZPP semantics and value warnings for invalid file descriptor integers.

Streams

Streams can now emit the STREAM_NOTIFY_COMPLETED notification. This was previously not implemented.

PHP 8.2

New Features

PHP Core

SensitiveParameter Attribute

Added the #[\SensitiveParameter] attribute to redact sensitive data in backtraces.

error_log_mode INI directive

The error_log_mode INI directive has been added which allows setting the permissions for the error log file.

Enumerations properties in constant expressions

It is now possible to fetch properties of Enumerations in constant expressions.

Type System Improvements

It is now possible to use null and false as stand-alone types.

The true type has been added.

It is now possible to combine intersection and union types. The type needs to be written in DNF.

Constants in Traits

It is now possible to define constants in traits.

Readonly Classes

Support for readonly on classes has been added.

cURL

Added the CURLINFO_EFFECTIVE_METHOD option, which returns the effective HTTP method in the return value of curl_getinfo().

Exposed multiple new constants from libcurl 7.62 to 7.80.

Added the curl_upkeep() function to perform any connection upkeep checks.

DBA

The LMDB Driver now accepts the DBA_LMDB_USE_SUB_DIR or DBA_LMDB_NO_SUB_DIR flags to determine if it should create a subdirectory or not when creating a database file.

OCI8

Added the oci8.prefetch_lob_size INI directive and oci_set_prefetch_lob() function to tune LOB query performance by reducing the number of round-trips between PHP and Oracle Databases when fetching LOBS. This is usable with Oracle Database 12.2 or later.

OpenSSL

Added AEAD support for the chacha20-poly1305 algorithm.

ODBC

Added the odbc_connection_string_is_quoted(), odbc_connection_string_should_quote(), and odbc_connection_string_quote() functions. These are primarily used behind the scenes in the ODBC and PDO_ODBC extensions, but are exposed to userland for easier unit testing, and for user applications and libraries to perform quoting themselves.

PCRE

Added support for the n (NO_AUTO_CAPTURE) modifier, which makes simple (xyz) groups non-capturing. Only named groups like (?xyz) are capturing. This only affects which groups are capturing, it is still possible to use numbered subpattern references, and the matches array will still contain numbered results.

Random

This is a new extension which organises and consolidates existing implementations related to random number generators. New and better RNGs are available with scope issues eliminated.

PHP 8.1

New Features

PHP Core

Integer Octal Literal Prefix

Octal integers can now use an explicit 0o/0O prefix in integer literals, similarly to binary and hexadecimal integer literals.

014; // Non-prefix octal literal
0o14; // Prefixed octal literal
?>

Array Unpacking with String Keys

Added support for array unpacking with strings keys.

$arr1 = [1, 'a' => 'b'];
$arr2 = [...$arr1, 'c' => 'd']; //[1, 'a' => 'b', 'c' => 'd']
?>

Named Argument After Argument Unpacking

It is now possible to specify named arguments after an argument unpack. e.g. foo(...$args, named: $arg).

full-path Key for File Uploads

File uploads now provide an additional full_path key, which contains the full path (rather than just the basename) of the uploaded file. This is intended for use in conjunction with "upload webkitdirectory".

Enumerations

Support for Enumerations has been added.

Fibers

Support for Fibers has been added.

First Class Callable Syntax

Closures for callables can now be created using the syntax myFunc(...), which is identical to Closure::fromCallable('myFunc').

Note: The ... is part of the syntax, and not an omission.

Intersection Types

Support for intersection types has been added.

Caution

Intersection types cannot be used together with union types

Never type

A new return only type never has been added. This indicates that a function either exit(), throws an exception, or doesn't terminate.

new in Initializers

It is now possible to use new ClassName() expressions as the default value of a parameter, static variable, global constant initializers, and as attribute arguments. Objects can also be passed to define() now.

Readonly properties

Support for readonly has been added.

Final class constants

Added support for the final modifier for class constants. Also, interface constants become overridable by default.

CURL

Added the CURLOPT_DOH_URL option.

Added options for blob certificate when libcurl >= 7.71.0:

  • CURLOPT_ISSUERCERT_BLOB
  • CURLOPT_PROXY_ISSUERCERT
  • CURLOPT_PROXY_ISSUERCERT_BLOB
  • CURLOPT_PROXY_SSLCERT_BLOB
  • CURLOPT_PROXY_SSLKEY_BLOB
  • CURLOPT_SSLCERT_BLOB
  • CURLOPT_SSLKEY_BLOB

Added CURLStringFile, which can be used to post a file from a string rather than a file:

$file = new CURLStringFile($data, 'filename.txt', 'text/plain');
curl_setopt($curl, CURLOPT_POSTFIELDS, ['file' => $file]);
?>

FPM

Added openmetrics status format. It can be used by Prometheus to fetch FPM metrics.

Added new pool option for the dynamic process manager called pm.max_spawn_rate. It allows to start a number of children at a faster rate when dynamic pm is selected. The default value is 32 which was the previous hard coded value.

GD

Avif support is now available through imagecreatefromavif() and imageavif(), if libgd has been built with Avif support.

Hash

The following functions hash(), hash_file(), and hash_init() now support an additional optional options argument, which can be used to pass algorithm specific data.

MurmurHash3

Added support for MurmurHash3 with streaming support. The following variants are implemented:

  • murmur3a, 32-bit hash
  • murmur3c, 128-bit hash for x86
  • murmur3f, 128-bit hash for x64

The initial hash state can be passed through the seed key in the options array, for example:

$h = hash("murmur3f", $data, options: ["seed" => 42]);
echo $h, "\n";
?>
A valid seed value is within the range from 0 to the platform defined UINT_MAX, usually 4294967295.

xxHash

Added support for xxHash. The following variants are implemented:

  • xxh32, 32-bit hash
  • xxh64, 64-bit hash
  • xxh3, 64-bit hash
  • xxh128, 128-bit hash

The initial hash state can be passed through the seed key in the options array, for example:

$h = hash("xxh3", $data, options: ["seed" => 42]);
echo $h, "\n";
?>
Secret usage is supported through passing the secret key in the options array, too:
$h = hash("xxh3", $data, options: ["secret" => "at least 136 bytes long secret here"]);
echo $h, "\n";
?>
The quality of the custom secret is crucial for the quality of the resulting hash. It is highly recommended for the secret to use the best possible entropy.

MySQLi

New INI directive mysqli.local_infile_directory

The mysqli.local_infile_directory INI directive has been added, which can be used to specify a directory from which files are allowed to be loaded. It is only meaningful if mysqli.allow_local_infile is not enabled, as all directories are allowed in that case.

Binding parameters in execute

It is now possible to bind parameters by passing them as an array to mysqli_stmt::execute(). All values will be bound as strings. Only list arrays are allowed. This new feature is not available when MySQLi is compiled with libmysqlclient.

$stmt = $mysqli->prepare('INSERT INTO users(id, name) VALUES(?,?)');
$stmt->execute([1, $username]);
?>

New method mysqli_result::fetch_column()

mysqli_result::fetch_column() has been added to allow fetching a single scalar value from the result set. The new method accepts an optional 0-based column parameter of type int specifying which column to fetch from.

$result = $mysqli->query('SELECT username FROM users WHERE id = 123');
echo $result->fetch_column();
?>

PDO

The PDO::MYSQL_ATTR_LOCAL_INFILE_DIRECTORY attribute has been added, which can be used to specify a directory from which files are allowed to be loaded. It is only meaningful if PDO::MYSQL_ATTR_LOCAL_INFILE is not enabled, as all directories are allowed in that case.

PDO_SQLite

SQLite's "file:" DSN syntax is now supported, which allows specifying additional flags. This feature is not available if open_basedir is set.

new PDO('sqlite:file:path/to/sqlite.db?mode=ro')
?>

POSIX

Added POSIX_RLIMIT_KQUEUES and POSIX_RLIMIT_NPTS. These rlimits are only available on FreeBSD.

Standard

fputcsv() now accepts a new eol argument which allows to define a custom End of Line sequence, the default remains the same and is "\n".

SPL

SplFileObject::fputcsv() now accepts a new eol argument which allows to define a custom End of Line sequence, the default remains the same and is "\n".

PHP 8.0

New Features

PHP Core

Named Arguments

Support for Named Arguments has been added.

Attributes

Support for Attributes has been added.

Constructor Property Promotion

Support for constructor property promotion (declaring properties in the constructor signature) has been added.

Union Types

Support for union types has been added.

Match Expression

Support for match expressions has been added.

Nullsafe Operator

Support for the nullsafe operator (?->) has been added.

Other new Features

  • The WeakMap class has been added.

  • The ValueError class has been added.

  • Any number of function parameters may now be replaced by a variadic argument, as long as the types are compatible. For example, the following code is now allowed:

    class A {
    public function     method(int $many, string $parameters, $here) {}
    }
    class     B extends A {
    public function     method(...$everything) {}
    }
    ?>

  • static (as in "late static binding") can now be used as a return type:

    class Test {
    public function     create(): static {
    return new static();
    }
    }
    ?>

  • It is now possible to fetch the class name of an object using $object::class. The result is the same as get_class($object).

  • new and instanceof can now be used with arbitrary expressions, using new (expression)(...$args) and $obj instanceof (expression).

  • Some consistency fixes to variable syntax have been applied, for example writing Foo::BAR::$baz is now allowed.

  • Added Stringable interface, which is automatically implemented if a class defines a __toString() method.

  • Traits can now define abstract private methods. Such methods must be implemented by the class using the trait.

  • throw can now be used as an expression. That allows usages like:

    $fn = fn() => throw new Exception('Exception in arrow function');
    $user = $session->user ?? throw new Exception('Must have user');

  • An optional trailing comma is now allowed in parameter lists.

    function functionWithLongSignature(
    Type1 $parameter1,
    Type2 $parameter2, // <-- This comma is now allowed.
    ) {
    }

  • It is now possible to write catch (Exception) to catch an exception without storing it in a variable.

  • Support for mixed type has been added.

  • Private methods declared on a parent class no longer enforce any inheritance rules on the methods of a child class (with the exception of final private constructors). The following example illustrates which restrictions have been removed:

    class ParentClass {
    private function     method1() {}
    private function     method2() {}
    private static function     method3() {}
    // Throws a warning, as "final" no longer has an effect:
    private final function method4() {}
    }
    class     ChildClass extends ParentClass {
    // All of the following are now allowed, even though the modifiers aren't
    // the same as for the private methods in the parent class.
    public abstract function method1() {}
    public static function     method2() {}
    public function     method3() {}
    public function     method4() {}
    }
    ?>

  • get_resource_id() has been added, which returns the same value as (int) $resource. It provides the same functionality under a clearer API.

  • The InternalIterator has been added.

Date and Time

DOM

DOMParentNode and DOMChildNode with new traversal and manipulation APIs have been added.

Filter

FILTER_VALIDATE_BOOL has been added as an alias for FILTER_VALIDATE_BOOLEAN. The new name is preferred, as it uses the canonical type name.

Enchant

enchant_dict_add(), enchant_dict_is_added(), and LIBENCHANT_VERSION have been added.

FPM

Added a new option pm.status_listen that allows getting the status from different endpoint (e.g. port or UDS file) which is useful for getting the status when all children are busy with serving long running requests.

Hash

HashContext objects can now be serialized.

Internationalization Functions

The IntlDateFormatter::RELATIVE_FULL, IntlDateFormatter::RELATIVE_LONG, IntlDateFormatter::RELATIVE_MEDIUM, and IntlDateFormatter::RELATIVE_SHORT constants have been added.

LDAP

ldap_count_references() has been added, which returns the number of reference messages in a search result.

OPcache

If the opcache.record_warnings ini setting is enabled, OPcache will record compile-time warnings and replay them on the next include, even if it is served from cache.

OpenSSL

Added Cryptographic Message Syntax (CMS) (» RFC 5652) support composed of functions for encryption, decryption, signing, verifying and reading. The API is similar to the API for PKCS #7 functions with an addition of new encoding constants: OPENSSL_ENCODING_DER, OPENSSL_ENCODING_SMIME and OPENSSL_ENCODING_PEM:

  • openssl_cms_encrypt() encrypts the message in the file with the certificates and outputs the result to the supplied file.
  • openssl_cms_decrypt() that decrypts the S/MIME message in the file and outputs the results to the supplied file.
  • openssl_cms_read() that exports the CMS file to an array of PEM certificates.
  • openssl_cms_sign() that signs the MIME message in the file with a cert and key and output the result to the supplied file.
  • openssl_cms_verify() that verifies that the data block is intact, the signer is who they say they are, and returns the certs of the signers.

Regular Expressions (Perl-Compatible)

preg_last_error_msg() has been added, which returns a human-readable message for the last PCRE error. It complements preg_last_error(), which returns an integer enum value instead.

Reflection

SQLite3

SQLite3::setAuthorizer() and respective class constants have been added to set a userland callback that will be used to authorize or not an action on the database.

Standard Library

  • str_contains(), str_starts_with() and str_ends_with() have been added, which check whether haystack contains, starts with or ends with needle, respectively.

  • fdiv() has been added, which performs a floating-point division under IEEE 754 semantics. Division by zero is considered well-defined and will return one of Inf, -Inf or NaN.

  • get_debug_type() has been added, which returns a type useful for error messages. Unlike gettype(), it uses canonical type names, returns class names for objects, and indicates the resource type for resources.

  • printf() and friends now support the %h and %H format specifiers. These are the same as %g and %G, but always use "." as the decimal separator, rather than determining it through the LC_NUMERIC locale.

  • printf() and friends now support using "*" as width or precision, in which case the width/precision is passed as an argument to printf. This also allows using precision -1 with %g, %G, %h and %H. For example, the following code can be used to reproduce PHP's default floating point formatting:

    printf("%.*H", (int) ini_get("precision"), $float);
    printf("%.*H", (int) ini_get("serialize_precision"), $float);
    ?>

  • proc_open() now supports pseudo-terminal (PTY) descriptors. The following attaches stdin, stdout and stderr to the same PTY:

    $proc = proc_open($command, [['pty'], ['pty'], ['pty']], $pipes);
    ?>

  • proc_open() now supports socket pair descriptors. The following attaches a distinct socket pair to stdin, stdout and stderr:

    $proc = proc_open($command, [['socket'], ['socket'], ['socket']], $pipes);
    ?>

    Unlike pipes, sockets do not suffer from blocking I/O issues on Windows. However, not all programs may work correctly with stdio sockets.

  • Sorting functions are now stable, which means that equal-comparing elements will retain their original order.

  • array_diff(), array_intersect() and their variations can now be used with a single array as argument. This means that usages like the following are now possible:

    // OK even if $excludes is empty:
    array_diff($array, ...$excludes);
    // OK even if $arrays only contains a single array:
    array_intersect(...$arrays);
    ?>

  • The flag parameter of ob_implicit_flush() was changed to accept a bool rather than an int.

Tokenizer

PhpToken adds an object-based interface to the tokenizer. It provides a more uniform and ergonomic representation, while being more memory efficient and faster.

Zip

PHP 7.4

New Features

PHP Core

Typed properties

Class properties now support type declarations.

class User {
public int $id;
public string $name;
}
?>
The above example will enforce that $user->id can only be assigned int values and $user->name can only be assigned string values.

Arrow functions

Arrow functions provide a shorthand syntax for defining functions with implicit by-value scope binding.

$factor = 10;
$nums = array_map(fn($n) => $n * $factor, [1, 2, 3, 4]);
// $nums = array(10, 20, 30, 40);
?>

Limited return type covariance and argument type contravariance

The following code will now work:

class A {}
class B extends A {}

class Producer {
public function method(): A {}
}
class ChildProducer extends Producer {
public function method(): B {}
}
?>
Full variance support is only available if autoloading is used. Inside a single file only non-cyclic type references are possible, because all classes need to be available before they are referenced.

Null coalescing assignment operator

$array['key'] ??= computeDefault();
// is roughly equivalent to
if (!isset($array['key'])) {
$array['key'] = computeDefault();
}
?>

Unpacking inside arrays

$parts = ['apple', 'pear'];
$fruits = ['banana', 'orange', ...$parts, 'watermelon'];
// ['banana', 'orange', 'apple', 'pear', 'watermelon'];
?>

Numeric literal separator

Numeric literals can contain underscores between digits.

6.674_083e-11; // float
299_792_458; // decimal
0xCAFE_F00D; // hexadecimal
0b0101_1111; // binary
?>

Weak references

Weak references allow the programmer to retain a reference to an object that does not prevent the object from being destroyed.

Allow exceptions from __toString()

Throwing exceptions from __toString() is now permitted. Previously this resulted in a fatal error. Existing recoverable fatal errors in string conversions have been converted to Error exceptions.

CURL

CURLFile now supports stream wrappers in addition to plain file names, if the extension has been built against libcurl >= 7.56.0.

Filter

The FILTER_VALIDATE_FLOAT filter now supports the min_range and max_range options, with the same semantics as FILTER_VALIDATE_INT.

FFI

FFI is a new extension, which provides a simple way to call native functions, access native variables, and create/access data structures defined in C libraries.

GD

Added the IMG_FILTER_SCATTER image filter to apply a scatter filter to images.

Hash

Added crc32c hash using Castagnoli's polynomial. This CRC32 variant is used by storage systems, such as iSCSI, SCTP, Btrfs and ext4.

Multibyte String

Added the mb_str_split() function, which provides the same functionality as str_split(), but operating on code points rather than bytes.

OPcache

Support for preloading code has been added.

Regular Expressions (Perl-Compatible)

The preg_replace_callback() and preg_replace_callback_array() functions now accept an additional flags argument, with support for the PREG_OFFSET_CAPTURE and PREG_UNMATCHED_AS_NULL flags. This influences the format of the matches array passed to the callback function.

PDO

The username and password can now be specified as part of the PDO DSN for the mysql, mssql, sybase, dblib, firebird and oci drivers. Previously this was only supported by the pgsql driver. If a username/password is specified both in the constructor and the DSN, the constructor takes precedence.

It is now possible to escape question marks in SQL queries to avoid them being interpreted as parameter placeholders. Writing ?? allows sending a single question mark to the database and e.g. use the PostgreSQL JSON key exists (?) operator.

PDO_OCI

PDOStatement::getColumnMeta() is now available.

PDO_SQLite

PDOStatement::getAttribute(PDO::SQLITE_ATTR_READONLY_STATEMENT) allows checking whether the statement is read-only, i.e. if it doesn't modify the database.

PDO::setAttribute(PDO::SQLITE_ATTR_EXTENDED_RESULT_CODES, true) enables the use of SQLite3 extended result codes in PDO::errorInfo() and PDOStatement::errorInfo().

SQLite3

Added SQLite3::lastExtendedErrorCode() to fetch the last extended result code.

Added SQLite3::enableExtendedResultCodes($enable = true), which will make SQLite3::lastErrorCode() return extended result codes.

Standard

strip_tags() with array of tag names

strip_tags() now also accepts an array of allowed tags: instead of strip_tags($str, '

')

you can now write strip_tags($str, ['a', 'p']).

Custom object serialization

A new mechanism for custom object serialization has been added, which uses two new magic methods: __serialize and __unserialize.

// Returns array containing all the necessary state of the object.
public function __serialize(): array;

// Restores the object state from the given data array.
public function __unserialize(array $data): void;
?>
The new serialization mechanism supersedes the Serializable interface, which will be deprecated in the future.

Array merge functions without arguments

array_merge() and array_merge_recursive() may now be called without any arguments, in which case they will return an empty array. This is useful in conjunction with the spread operator, e.g. array_merge(...$arrays).

proc_open() function

proc_open() now accepts an array instead of a string for the command. In this case the process will be opened directly (without going through a shell) and PHP will take care of any necessary argument escaping.

proc_open(['php', '-r', 'echo "Hello World\n";'], $descriptors, $pipes);
?>

proc_open() now supports redirect and null descriptors.

// Like 2>&1 on the shell
proc_open($cmd, [1 => ['pipe', 'w'], 2 => ['redirect', 1]], $pipes);
// Like 2>/dev/null or 2>nul on the shell
proc_open($cmd, [1 => ['pipe', 'w'], 2 => ['null']], $pipes);
?>

argon2i(d) without libargon

password_hash() now has the argon2i and argon2id implementations from the sodium extension when PHP is built without libargon.

PHP 7.3

New Features

PHP Core

More Flexible Heredoc and Nowdoc Syntax

The closing marker for doc strings is no longer required to be followed by a semicolon or newline. Additionally the closing marker may be indented, in which case the indentation will be stripped from all lines in the doc string.

Array Destructuring supports Reference Assignments

Array destructuring now supports reference assignments using the syntax [&$a, [$b, &$c]] = $d. The same is also supported for list().

Instanceof Operator accepts Literals

instanceof now allows literals as the first operand, in which case the result is always false.

CompileError Exception instead of some Compilation Errors

A new CompileError exception has been added, from which ParseError inherits. A small number of compilation errors will now throw a CompileError instead of generating a fatal error. Currently this only affects compilation errors that may be thrown by token_get_all() in TOKEN_PARSE mode, but more errors may be converted in the future.

Trailing Commas are allowed in Calls

Trailing commas in function and method calls are now allowed.

Argon2id Support

The --with-password-argon2[=dir] configure argument now provides support for both Argon2i and Argon2id hashes in the password_hash(), password_verify(), password_get_info(), and password_needs_rehash() functions. Passwords may be hashed and verified using the PASSWORD_ARGON2ID constant. Support for both Argon2i and Argon2id in the password_*() functions now requires PHP be linked against libargon2 reference library ≥ 20161029.

FastCGI Process Manager

New options have been added to customize the FPM logging:

log_limit
This global option can be used for setting the log limit for the logged line which allows to log messages longer than 1024 characters without wrapping. It also fixes various wrapping issues.
log_buffering
This global option allows an experimental logging without extra buffering.
decorate_workers_output
This pool option allows to disable the output decoration for workers output when catch_workers_output is enabled.

BC Math Functions

bcscale() can now also be used as getter to retrieve the current scale in use.

Lightweight Directory Access Protocol

Full support for LDAP Controls has been added to the LDAP querying functions and ldap_parse_result():

Multibyte String Functions

Full Case-Mapping and Case-Folding Support

Support for full case-mapping and case-folding has been added. Unlike simple case-mapping, full case-mapping may change the length of the string. For example:

mb_strtoupper("Straße");
// Produces STRAßE on PHP 7.2
// Produces STRASSE on PHP 7.3
?>
The different casing mapping and folding modes are available through mb_convert_case():
  • MB_CASE_LOWER (used by mb_strtolower())
  • MB_CASE_UPPER (used by mb_strtoupper())
  • MB_CASE_TITLE
  • MB_CASE_FOLD
  • MB_CASE_LOWER_SIMPLE
  • MB_CASE_UPPER_SIMPLE
  • MB_CASE_TITLE_SIMPLE
  • MB_CASE_FOLD_SIMPLE (used by case-insensitive operations)
Only unconditional, language agnostic full case-mapping is performed.

Case-Insensitive String Operations use Case-Folding

Case-insensitive string operations now use case-folding instead of case- mapping during comparisons. This means that more characters will be considered (case insensitively) equal now.

MB_CASE_TITLE performs Title-Case Conversion

mb_convert_case() with MB_CASE_TITLE now performs title-case conversion based on the Cased and CaseIgnorable derived Unicode properties. In particular this also improves handling of quotes and apostrophes.

Unicode 11 Support

The Multibyte String data tables have been updated for Unicode 11.

Long String Support

The Multibyte String Functions now correctly support strings larger than 2GB.

Performance Improvements

Performance of the Multibyte String extension has been significantly improved across the board. The largest improvements are in case conversion functions.

Named Captures Support

The mb_ereg_* functions now support named captures. Matching functions like mb_ereg() will now return named captures both using their group number and their name, similar to PCRE:

mb_ereg('(?\w+)', '国', $matches);
// => [0 => "国", 1 => "国", "word" => "国"];
?>
Additionally, mb_ereg_replace() now supports the \k<> and \k'' notations to reference named captures in the replacement string:
mb_ereg_replace('\s*(?\w+)\s*', "_\k_\k'word'_", ' foo ');
// => "_foo_foo_"
?>
\k<> and \k'' can also be used for numbered references, which also works with group numbers greater than 9.

Readline

Support for the completion_append_character and completion_suppress_append options has been added to readline_info(). These options are only available if PHP is linked against libreadline (rather than libedit).

PHP 7.2

New features

New object type

A new type, object, has been introduced that can be used for (contravariant) parameter typing and (covariant) return typing of any objects.


function test(object $obj) : object
{
return new SplQueue();
}

test(new stdClass());

Extension loading by name

Shared extensions no longer require their file extension (.so for Unix or .dll for Windows) to be specified. This is enabled in the php.ini file, as well as in the dl() function.

Abstract method overriding

Abstract methods can now be overridden when an abstract class extends another abstract class.


abstract class A
{
abstract function test(string $s);
}
abstract class B extends A
{
// overridden - still maintaining contravariance for parameters and covariance for return
abstract function test($s) : int;
}

Sodium is now a core extension

The modern Sodium cryptography library has now become a core extension in PHP.

For a complete function reference, see the Sodium chapter.

Password hashing with Argon2

Argon2 has been added to the password hashing API, where the following constants have been exposed:

  • PASSWORD_ARGON2I
  • PASSWORD_ARGON2_DEFAULT_MEMORY_COST
  • PASSWORD_ARGON2_DEFAULT_TIME_COST
  • PASSWORD_ARGON2_DEFAULT_THREADS

Extended string types for PDO

PDO's string type has been extended to support the national character type when emulating prepares. This has been done with the following constants:

  • PDO::PARAM_STR_NATL
  • PDO::PARAM_STR_CHAR
  • PDO::ATTR_DEFAULT_STR_PARAM

These constants are utilised by bitwise OR'ing them with PDO::PARAM_STR:


$db->quote('über', PDO::PARAM_STR | PDO::PARAM_STR_NATL);

Additional emulated prepares debugging information for PDO

The PDOStatement::debugDumpParams() method has been updated to include the SQL being sent to the DB, where the full, raw query (including the replaced placeholders with their bounded values) will be shown. This has been added to aid with debugging emulated prepares (and so it will only be available when emulated prepares are turned on).

Support for extended operations in LDAP

Support for EXOP has been added to the LDAP extension. This has been done by exposing the following functions and constants:

Address Information additions to the Sockets extension

The sockets extension now has the ability to lookup address information, as well as connect to it, bind to it, and explain it. The following four functions have been added for this:

Parameter type widening

Parameter types from overridden methods and from interface implementations may now be omitted. This is still in compliance with LSP, since parameters types are contravariant.


interface A
{
public function Test(array $input);
}

class B implements A
{
public function Test($input){} // type omitted for $input
}

Allow a trailing comma for grouped namespaces

A trailing comma can now be added to the group-use syntax introduced in PHP 7.0.


use Foo\Bar\{
Foo,
Bar,
Baz,
};

proc_nice() support on Windows

The proc_nice() function is now supported on Windows.

pack() and unpack() endian support

The pack() and unpack() functions now support float and double in both little and big endian.

Enhancements to the EXIF extension

The EXIF extension has been updated to support a much larger range of formats. This means that their format specific tags are now properly translated when parsing images with the exif_read_data() function. The following new formats are now supported:

  • Samsung
  • DJI
  • Panasonic
  • Sony
  • Pentax
  • Minolta
  • Sigma/Foveon
  • AGFA
  • Kyocera
  • Ricoh
  • Epson

The EXIF functions exif_read_data() and exif_thumbnail() now support passing streams as their first argument.

New features in PCRE

  • The J modifier for setting PCRE_DUPNAMES has been added.

SQLite3 allows writing BLOBs

SQLite3::openBlob() now allows to open BLOB fields in write mode; formerly only read mode was supported.

Oracle OCI8 Transparent Application Failover Callbacks

Support for Oracle Database Transparent Application Failover (TAF) callbacks has been added. TAF allows PHP OCI8 applications to automatically reconnect to a preconfigured database when a connection is broken. The new TAF callback support allows PHP applications to monitor and control reconnection during failover.

Enhancements to the ZIP extension

Read and write support for encrypted archives has been added (requires libzip 1.2.0).

The ZipArchive class now implements the Countable interface.

The zip:// stream now accepts a 'password' context option.

PHP 7.1

New features

Nullable types

Type declarations for parameters and return values can now be marked as nullable by prefixing the type name with a question mark. This signifies that as well as the specified type, null can be passed as an argument, or returned as a value, respectively.


function testReturn(): ?string
{
return 'elePHPant';
}

var_dump(testReturn());

function testReturn(): ?string
{
return null;
}

var_dump(testReturn());

function test(?string $name)
{
var_dump($name);
}

test('elePHPant');
test(null);
test();

The above example will output:

string(10) "elePHPant"
NULL
string(10) "elePHPant"
NULL
Uncaught Error: Too few arguments to function test(), 0 passed in...

Void functions

A void return type has been introduced. Functions declared with void as their return type must either omit their return statement altogether, or use an empty return statement. null is not a valid return value for a void function.

function swap(&$left, &$right): void
{
if ($left === $right) {
return;
}

$tmp = $left;
$left = $right;
$right = $tmp;
}

$a = 1;
$b = 2;
var_dump(swap($a, $b), $a, $b);

The above example will output:

null
int(2)
int(1)

Attempting to use a void function's return value simply evaluates to null, with no warnings emitted. The reason for this is because warnings would implicate the use of generic higher order functions.

Symmetric array destructuring

The shorthand array syntax ([]) may now be used to destructure arrays for assignments (including within foreach), as an alternative to the existing list() syntax, which is still supported.

$data = [
[1, 'Tom'],
[2, 'Fred'],
];

// list() style
list($id1, $name1) = $data[0];

// [] style
[$id1, $name1] = $data[0];

// list() style
foreach ($data as list($id, $name)) {
// logic here with $id and $name
}

// [] style
foreach ($data as [$id, $name]) {
// logic here with $id and $name
}

Class constant visibility

Support for specifying the visibility of class constants has been added.

class ConstDemo
{
const PUBLIC_CONST_A = 1;
public const PUBLIC_CONST_B = 2;
protected const PROTECTED_CONST = 3;
private const PRIVATE_CONST = 4;
}

iterable pseudo-type

A new pseudo-type (similar to callable) called iterable has been introduced. It may be used in parameter and return types, where it accepts either arrays or objects that implement the Traversable interface. With respect to subtyping, parameter types of child classes may broaden a parent's declaration of array or Traversable to iterable. With return types, child classes may narrow a parent's return type of iterable to array or an object that implements Traversable.

function iterator(iterable $iter)
{
foreach ($iter as $val) {
//
}
}

Multi catch exception handling

Multiple exceptions per catch block may now be specified using the pipe character (|). This is useful for when different exceptions from different class hierarchies are handled the same.

try {
// some code
} catch (FirstException | SecondException $e) {
// handle first and second exceptions
}

Support for keys in list()

You can now specify keys in list(), or its new shorthand [] syntax. This enables destructuring of arrays with non-integer or non-sequential keys.

$data = [
["id" => 1, "name" => 'Tom'],
["id" => 2, "name" => 'Fred'],
];

// list() style
list("id" => $id1, "name" => $name1) = $data[0];

// [] style
["id" => $id1, "name" => $name1] = $data[0];

// list() style
foreach ($data as list("id" => $id, "name" => $name)) {
// logic here with $id and $name
}

// [] style
foreach ($data as ["id" => $id, "name" => $name]) {
// logic here with $id and $name
}

Support for negative string offsets

Support for negative string offsets has been added to the string manipulation functions accepting offsets, as well as to string indexing with [] or {}. In such cases, a negative offset is interpreted as being an offset from the end of the string.

var_dump("abcdef"[-2]);
var_dump(strpos("aabbcc", "b", -3));

The above example will output:

string (1) "e"
int(3)

Negative string and array offsets are now also supported in the simple variable parsing syntax inside of strings.

$string = 'bar';
echo "The last character of '$string' is '$string[-1]'.\n";
?>

The above example will output:

The last character of 'bar' is 'r'.

Support for AEAD in ext/openssl

Support for AEAD (modes GCM and CCM) have been added by extending the openssl_encrypt() and openssl_decrypt() functions with additional parameters.

Convert callables to Closures with Closure::fromCallable()

A new static method has been introduced to the Closure class to allow for callables to be easily converted into Closure objects.

class Test
{
public function exposeFunction()
{
return Closure::fromCallable([$this, 'privateFunction']);
}

private function privateFunction($param)
{
var_dump($param);
}
}

$privFunc = (new Test)->exposeFunction();
$privFunc('some value');

The above example will output:

string(10) "some value"

Asynchronous signal handling

A new function called pcntl_async_signals() has been introduced to enable asynchronous signal handling without using ticks (which introduce a lot of overhead).

pcntl_async_signals(true); // turn on async signals

pcntl_signal(SIGHUP, function($sig) {
echo "SIGHUP\n";
});

posix_kill(posix_getpid(), SIGHUP);

The above example will output:

SIGHUP

HTTP/2 server push support in ext/curl

Support for server push has been added to the CURL extension (requires version 7.46 and above). This can be leveraged through the curl_multi_setopt() function with the new CURLMOPT_PUSHFUNCTION constant. The constants CURL_PUSH_OK and CURL_PUSH_DENY have also been added so that the execution of the server push callback can either be approved or denied.

Stream Context Options

The tcp_nodelay stream context option has been added.

PHP 7.0

New features

Scalar type declarations

Scalar type declarations come in two flavours: coercive (default) and strict. The following types for parameters can now be enforced (either coercively or strictly): strings (string), integers (int), floating-point numbers (float), and booleans (bool). They augment the other types introduced in PHP 5: class names, interfaces, array and callable.

// Coercive mode
function sumOfInts(int ...$ints)
{
return array_sum($ints);
}

var_dump(sumOfInts(2, '3', 4.1));

The above example will output:

int(9)

To enable strict mode, a single declare directive must be placed at the top of the file. This means that the strictness of typing for scalars is configured on a per-file basis. This directive not only affects the type declarations of parameters, but also a function's return type (see return type declarations, built-in PHP functions, and functions from loaded extensions.

Full documentation and examples of scalar type declarations can be found in the type declaration reference.

Return type declarations

PHP 7 adds support for return type declarations. Similarly to argument type declarations, return type declarations specify the type of the value that will be returned from a function. The same types are available for return type declarations as are available for argument type declarations.


function arraysSum(array ...$arrays): array
{
return array_map(function(array $array): int {
return array_sum($array);
}, $arrays);
}

print_r(arraysSum([1,2,3], [4,5,6], [7,8,9]));

The above example will output:

Array
(
    [0] => 6
    [1] => 15
    [2] => 24
)

Full documentation and examples of return type declarations can be found in the return type declarations. reference.

Null coalescing operator

The null coalescing operator (??) has been added as syntactic sugar for the common case of needing to use a ternary in conjunction with isset(). It returns its first operand if it exists and is not null; otherwise it returns its second operand.

// Fetches the value of $_GET['user'] and returns 'nobody'
// if it does not exist.
$username = $_GET['user'] ?? 'nobody';
// This is equivalent to:
$username = isset($_GET['user']) ? $_GET['user'] : 'nobody';

// Coalescing can be chained: this will return the first
// defined value out of $_GET['user'], $_POST['user'], and
// 'nobody'.
$username = $_GET['user'] ?? $_POST['user'] ?? 'nobody';
?>

Spaceship operator

The spaceship operator is used for comparing two expressions. It returns -1, 0 or 1 when $a is respectively less than, equal to, or greater than $b. Comparisons are performed according to PHP's usual type comparison rules.

// Integers
echo 1 <=> 1; // 0
echo 1 <=> 2; // -1
echo 2 <=> 1; // 1

// Floats
echo 1.5 <=> 1.5; // 0
echo 1.5 <=> 2.5; // -1
echo 2.5 <=> 1.5; // 1

// Strings
echo "a" <=> "a"; // 0
echo "a" <=> "b"; // -1
echo "b" <=> "a"; // 1
?>

Constant arrays using define()

Array constants can now be defined with define(). In PHP 5.6, they could only be defined with const.

define('ANIMALS', [
'dog',
'cat',
'bird'
]);

echo ANIMALS[1]; // outputs "cat"
?>

Anonymous classes

Support for anonymous classes has been added via new class. These can be used in place of full class definitions for throwaway objects:

interface Logger {
public function log(string $msg);
}

class Application {
private $logger;

public function getLogger(): Logger {
return $this->logger;
}

public function setLogger(Logger $logger) {
$this->logger = $logger;
}
}

$app = new Application;
$app->setLogger(new class implements Logger {
public function log(string $msg) {
echo $msg;
}
});

var_dump($app->getLogger());
?>

The above example will output:

object(class@anonymous)#2 (0) {
}

Full documentation can be found in the anonymous class reference.

Unicode codepoint escape syntax

This takes a Unicode codepoint in hexadecimal form, and outputs that codepoint in UTF-8 to a double-quoted string or a heredoc. Any valid codepoint is accepted, with leading 0's being optional.

echo "\u{aa}";
echo "\u{0000aa}";
echo "\u{9999}";

The above example will output:

ª
ª (same as before but with optional leading 0's)
香

Closure::call()

Closure::call() is a more performant, shorthand way of temporarily binding an object scope to a closure and invoking it.

class A {private $x = 1;}

// Pre PHP 7 code
$getX = function() {return $this->x;};
$getXCB = $getX->bindTo(new A, 'A'); // intermediate closure
echo $getXCB();

// PHP 7+ code
$getX = function() {return $this->x;};
echo $getX->call(new A);

The above example will output:

1
1

Filtered unserialize()

This feature seeks to provide better security when unserializing objects on untrusted data. It prevents possible code injections by enabling the developer to whitelist classes that can be unserialized.


// converts all objects into __PHP_Incomplete_Class object
$data = unserialize($foo, ["allowed_classes" => false]);

// converts all objects into __PHP_Incomplete_Class object except those of MyClass and MyClass2
$data = unserialize($foo, ["allowed_classes" => ["MyClass", "MyClass2"]]);

// default behaviour (same as omitting the second argument) that accepts all classes
$data = unserialize($foo, ["allowed_classes" => true]);

IntlChar

The new IntlChar class seeks to expose additional ICU functionality. The class itself defines a number of static methods and constants that can be used to manipulate unicode characters.


printf('%x', IntlChar::CODEPOINT_MAX);
echo IntlChar::charName('@');
var_dump(IntlChar::ispunct('!'));

The above example will output:

10ffff
COMMERCIAL AT
bool(true)

In order to use this class, the Intl extension must be installed.

Expectations

Expectations are a backwards compatible enhancement to the older assert() function. They allow for zero-cost assertions in production code, and provide the ability to throw custom exceptions when the assertion fails.

While the old API continues to be maintained for compatibility, assert() is now a language construct, allowing the first parameter to be an expression rather than just a string to be evaluated or a bool value to be tested.

ini_set('assert.exception', 1);

class CustomError extends AssertionError {}

assert(false, new CustomError('Some error message'));
?>

The above example will output:

Fatal error: Uncaught CustomError: Some error message

Full details on this feature, including how to configure it in both development and production environments, can be found on the manual page of the assert() language construct.

Group use declarations

Classes, functions and constants being imported from the same namespace can now be grouped together in a single use statement.

// Pre PHP 7 code
use some\namespace\ClassA;
use some\namespace\ClassB;
use some\namespace\ClassC as C;

use function some\namespace\fn_a;
use function some\namespace\fn_b;
use function some\namespace\fn_c;

use const some\namespace\ConstA;
use const some\namespace\ConstB;
use const some\namespace\ConstC;

// PHP 7+ code
use some\namespace\{ClassA, ClassB, ClassC as C};
use function some\namespace\{fn_a, fn_b, fn_c};
use const some\namespace\{ConstA, ConstB, ConstC};
?>

Generator Return Expressions

This feature builds upon the generator functionality introduced into PHP 5.5. It enables for a return statement to be used within a generator to enable for a final expression to be returned (return by reference is not allowed). This value can be fetched using the new Generator::getReturn() method, which may only be used once the generator has finished yielding values.


$gen = (function() {
yield 1;
yield 2;

return 3;
})();

foreach ($gen as $val) {
echo $val, PHP_EOL;
}

echo $gen->getReturn(), PHP_EOL;

The above example will output:

1
2
3

Being able to explicitly return a final value from a generator is a handy ability to have. This is because it enables for a final value to be returned by a generator (from perhaps some form of coroutine computation) that can be specifically handled by the client code executing the generator. This is far simpler than forcing the client code to firstly check whether the final value has been yielded, and then if so, to handle that value specifically.

Generator delegation

Generators can now delegate to another generator, Traversable object or array automatically, without needing to write boilerplate in the outermost generator by using the yield from construct.

function gen()
{
yield 1;
yield 2;
yield from gen2();
}

function gen2()
{
yield 3;
yield 4;
}

foreach (gen() as $val)
{
echo $val, PHP_EOL;
}
?>

The above example will output:

1
2
3
4

Integer division with intdiv()

The new intdiv() function performs an integer division of its operands and returns it.

var_dump(intdiv(10, 3));
?>

The above example will output:

int(3)

Session options

session_start() now accepts an array of options that override the session configuration directives normally set in php.ini.

These options have also been expanded to support session.lazy_write, which is on by default and causes PHP to only overwrite any session file if the session data has changed, and read_and_close, which is an option that can only be passed to session_start() to indicate that the session data should be read and then the session should immediately be closed unchanged.

For example, to set session.cache_limiter to private and immediately close the session after reading it:

session_start([
'cache_limiter' => 'private',
'read_and_close' => true,
]);
?>

preg_replace_callback_array()

The new preg_replace_callback_array() function enables code to be written more cleanly when using the preg_replace_callback() function. Prior to PHP 7, callbacks that needed to be executed per regular expression required the callback function to be polluted with lots of branching.

Now, callbacks can be registered to each regular expression using an associative array, where the key is a regular expression and the value is a callback.

CSPRNG Functions

Two new functions have been added to generate cryptographically secure integers and strings in a cross platform way: random_bytes() and random_int().

list() can always unpack objects implementing ArrayAccess

Previously, list() was not guaranteed to operate correctly with objects implementing ArrayAccess. This has been fixed.

Other Features

  • Class member access on cloning has been added, e.g. (clone $foo)->bar().

PHP 5.6

New features

Constant expressions

It is now possible to provide a scalar expression involving numeric and string literals and/or constants in contexts where PHP previously expected a static value, such as constant and property declarations and default function arguments.

const ONE = 1;
const TWO = ONE * 2;

class C {
const THREE = TWO + 1;
const ONE_THIRD = ONE / self::THREE;
const SENTENCE = 'The value of THREE is '.self::THREE;

public function f($a = ONE + self::THREE) {
return $a;
}
}

echo (new C)->f()."\n";
echo C::SENTENCE;
?>

The above example will output:

4
The value of THREE is 3

It is also now possible to define a constant array using the const keyword:

const ARR = ['a', 'b'];

echo ARR[0];
?>

The above example will output:

a

Variadic functions via ...

Variadic functions can now be implemented using the ... operator, instead of relying on func_get_args().

function f($req, $opt = null, ...$params) {
// $params is an array containing the remaining arguments.
printf('$req: %d; $opt: %d; number of params: %d'."\n",
$req, $opt, count($params));
}

f(1);
f(1, 2);
f(1, 2, 3);
f(1, 2, 3, 4);
f(1, 2, 3, 4, 5);
?>

The above example will output:

$req: 1; $opt: 0; number of params: 0
$req: 1; $opt: 2; number of params: 0
$req: 1; $opt: 2; number of params: 1
$req: 1; $opt: 2; number of params: 2
$req: 1; $opt: 2; number of params: 3

Argument unpacking via ...

Arrays and Traversable objects can be unpacked into argument lists when calling functions by using the ... operator. This is also known as the splat operator in other languages, including Ruby.

function add($a, $b, $c) {
return $a + $b + $c;
}

$operators = [2, 3];
echo add(1, ...$operators);
?>

The above example will output:

6

Exponentiation via **

A right associative ** operator has been added to support exponentiation, along with a **= shorthand assignment operator.

printf("2 ** 3 == %d\n", 2 ** 3);
printf("2 ** 3 ** 2 == %d\n", 2 ** 3 ** 2);

$a = 2;
$a **= 3;
printf("a == %d\n", $a);
?>

The above example will output:

2 ** 3 ==      8
2 ** 3 ** 2 == 512
a ==           8

use function and use const

The use operator has been extended to support importing functions and constants in addition to classes. This is achieved via the use function and use const constructs, respectively.

namespace Name\Space {
const FOO = 42;
function f() { echo __FUNCTION__."\n"; }
}

namespace {
use const Name\Space\FOO;
use function Name\Space\f;

echo FOO."\n";
f();
}
?>

The above example will output:

42
Name\Space\f

phpdbg

PHP now includes an interactive debugger called phpdbg implemented as a SAPI module. For more information, please visit the phpdbg documentation.

Default character encoding

default_charset is now used as the default character set for the htmlentities(), html_entity_decode() and htmlspecialchars() functions. Note that if the (now deprecated) iconv and mbstring encoding settings are set, they will take precedence over default_charset for iconv and mbstring functions, respectively.

The default value for this setting is UTF-8.

php://input is reusable

php://input may now be reopened and read as many times as required. This work has also resulted in a major reduction in the amount of memory required to deal with POST data.

Large file uploads

Files larger than 2 gigabytes in size are now accepted.

GMP supports operator overloading

GMP objects now support operator overloading and casting to scalar types. This allows for more expressive code using GMP:

$a = gmp_init(42);
$b = gmp_init(17);

if (version_compare(PHP_VERSION, '5.6', '<')) {
echo gmp_intval(gmp_add($a, $b)), PHP_EOL;
echo gmp_intval(gmp_add($a, 17)), PHP_EOL;
echo gmp_intval(gmp_add(42, $b)), PHP_EOL;
} else {
echo $a + $b, PHP_EOL;
echo $a + 17, PHP_EOL;
echo 42 + $b, PHP_EOL;
}
?>

The above example will output:

59
59
59

hash_equals() for timing attack safe string comparison

The hash_equals() function has been added to compare two strings in constant time. This should be used to mitigate timing attacks; for instance, when testing crypt() password hashes (assuming that you are unable to use password_hash() and password_verify(), which aren't susceptible to timing attacks).

$expected = crypt('12345', '$2a$07$usesomesillystringforsalt$');
$correct = crypt('12345', '$2a$07$usesomesillystringforsalt$');
$incorrect = crypt('1234', '$2a$07$usesomesillystringforsalt$');

var_dump(hash_equals($expected, $correct));
var_dump(hash_equals($expected, $incorrect));
?>

The above example will output:

bool(true)
bool(false)

__debugInfo()

The __debugInfo() magic method has been added to allow objects to change the properties and values that are shown when the object is output using var_dump().

class C {
private $prop;

public function __construct($val) {
$this->prop = $val;
}

public function __debugInfo() {
return [
'propSquared' => $this->prop ** 2,
];
}
}

var_dump(new C(42));
?>

The above example will output:

object(C)#1 (1) {
  ["propSquared"]=>
  int(1764)
}

gost-crypto hash algorithm

The gost-crypto hash algorithm has been added. This implements the GOST hash function using the CryptoPro S-box tables as specified by » RFC 4357, section 11.2.

SSL/TLS improvements

A wide range of improvements have been made to the SSL/TLS support in PHP 5.6. These include enabling peer verification by default, supporting certificate fingerprint matching, mitigating against TLS renegotiation attacks, and many new SSL context options to allow more fine grained control over protocol and verification settings when using encrypted streams.

These changes are described in more detail in the OpenSSL changes in PHP 5.6.x section of this migration guide.

pgsql async support

The pgsql extension now supports asynchronous connections and queries, thereby enabling non-blocking behaviour when interacting with PostgreSQL databases. Asynchronous connections may be established via the PGSQL_CONNECT_ASYNC constant, and the new pg_connect_poll(), pg_socket(), pg_consume_input() and pg_flush() functions may be used to handle asynchronous connections and queries.

PHP 5.5

New features

Generators added

Support for generators has been added via the yield keyword. Generators provide an easy way to implement simple iterators without the overhead or complexity of implementing a class that implements the Iterator interface.

A simple example that reimplements the range() function as a generator (at least for positive step values):

function xrange($start, $limit, $step = 1) {
    for ($i = $start; $i <= $limit; $i += $step) {
        yield $i;
    }
}

echo 'Single digit odd numbers: ';

/*
 * Note that an array is never created or returned,
 * which saves memory.
 */
foreach (xrange(1, 9, 2) as $number) {
    echo "$number ";
}

echo "\n";
?>

The above example will output:

Single digit odd numbers: 1 3 5 7 9

finally keyword added

try-catch blocks now support a finally block for code that should be run regardless of whether an exception has been thrown or not.

New password hashing API

A new password hashing API that makes it easier to securely hash and manage passwords using the same underlying library as crypt() in PHP has been added. See the documentation for password_hash() for more detail.

foreach now supports list()

The foreach control structure now supports unpacking nested arrays into separate variables via the list() construct. For example:

$array = [
    [1, 2],
    [3, 4],
];

foreach ($array as list($a, $b)) {
    echo "A: $a; B: $b\n";
}
?>

The above example will output:

A: 1; B: 2
A: 3; B: 4

Further documentation is available on the foreach manual page.

empty() supports arbitrary expressions

Passing an arbitrary expression instead of a variable to empty() is now supported. For example:

function always_false() {
    return false;
}

if (empty(always_false())) {
    echo "This will be printed.\n";
}

if (empty(true)) {
    echo "This will not be printed.\n";
}
?>

The above example will output:

This will be printed.

array and string literal dereferencing

Array and string literals can now be dereferenced directly to access individual elements and characters:

echo 'Array dereferencing: ';
echo [1, 2, 3][0];
echo "\n";

echo 'String dereferencing: ';
echo 'PHP'[0];
echo "\n";
?>

The above example will output:

Array dereferencing: 1
String dereferencing: P

Class name resolution via ::class

It is possible to use ClassName::class to get a fully qualified name of class ClassName. For example:

namespace Name\Space;
class ClassName {}

echo ClassName::class;

echo "\n";
?>

The above example will output:

Name\Space\ClassName

OPcache extension added

The Zend Optimiser+ opcode cache has been added to PHP as the new OPcache extension. OPcache improves PHP performance by storing precompiled script bytecode in shared memory, thereby removing the need for PHP to load and parse scripts on each request. See the installation instructions for more detail on enabling and using OPcache.

foreach now supports non-scalar keys

foreach now supports keys of any type. While non-scalar keys cannot occur in native PHP arrays, it is possible for Iterator::key() to return a value of any type, and this will now be handled correctly.

Apache 2.4 handler supported on Windows

The Apache 2.4 handler SAPI is now supported on Windows.

Improvements to GD

Various improvements have been made to the GD extension, these include:

PHP 5.4

New features

PHP 5.4.0 offers a wide range of new features:

  • Support for traits has been added.
  • Short array syntax has been added, e.g. $a = [1, 2, 3, 4]; or $a = ['one' => 1, 'two' => 2, 'three' => 3, 'four' => 4];.
  • Function array dereferencing has been added, e.g. foo()[0].
  • Closures now support $this.
  • = is now always available, regardless of the short_open_tag php.ini option.
  • Class member access on instantiation has been added, e.g. (new Foo)->bar().
  • Class::{expr}() syntax is now supported.
  • Binary number format has been added, e.g. 0b001001101.
  • Improved parse error messages and improved incompatible arguments warnings.
  • The session extension can now track the upload progress of files.
  • Built-in development web server in CLI mode.
  • The GD extension now supports reading and writing of WebP images via imagecreatefromwebp() and imagewebp(), respectively.

PHP 5.3

New features

PHP 5.3.0 offers a wide range of new features:

  • Support for namespaces has been added.
  • Support for Late Static Bindings has been added.
  • Support for jump labels (limited goto) has been added.
  • Support for native Closures (Lambda/Anonymous functions) has been added.
  • There are two new magic methods, __callStatic() and __invoke().
  • Nowdoc syntax is now supported, similar to Heredoc syntax, but with single quotes.
  • It is now possible to use Heredocs to initialize static variables and class properties/constants.
  • Heredocs may now be declared using double quotes, complementing the Nowdoc syntax.
  • Constants can now be declared outside a class using the const keyword.
  • The ternary operator now has a shorthand form: ?:.
  • The HTTP stream wrapper now considers all status codes from 200 to 399 to be successful.
  • Dynamic access to static methods is now possible:
    class C {
       public static     $foo = 123;
    }

    $a = "C";
    echo     $a::$foo;
    ?>

    The above example will output:

    123
  • Exceptions can now be nested:
    class MyCustomException extends Exception {}

    try {
        throw new     MyCustomException("Exceptional", 112);
    } catch (    Exception $e) {
            /* Note the use of the third parameter to pass $e
         * into the RuntimeException. */
            throw new RuntimeException("Rethrowing", 911, $e);
    }
    ?>
  • A garbage collector for circular references has been added, and is enabled by default.
  • The mail() function now supports logging of sent email via the mail.log configuration directive. (Note: This only applies to email sent through this function.)

PHP 8.3

New Global Constants

cURL

  • CURLINFO_CAPATH (libcurl >= 7.84.0)
  • CURLINFO_CAINFO (libcurl >= 7.84.0)
  • CURLOPT_MIME_OPTIONS (libcurl >= 7.81.0)
  • CURLMIMEOPT_FORMESCAPE (libcurl >= 7.81.0)
  • CURLOPT_WS_OPTIONS (libcurl >= 7.86.0)
  • CURLWS_RAW_MODE (libcurl >= 7.86.0)
  • CURLOPT_SSH_HOSTKEYFUNCTION (libcurl >= 7.84.0)
  • CURLOPT_PROTOCOLS_STR (libcurl >= 7.85.0)
  • CURLOPT_REDIR_PROTOCOLS_STR (libcurl >= 7.85.0)
  • CURLOPT_CA_CACHE_TIMEOUT (libcurl >= 7.87.0)
  • CURLOPT_QUICK_EXIT (libcurl >= 7.87.0)
  • CURLKHMATCH_OK (libcurl >= 7.19.6)
  • CURLKHMATCH_MISMATCH (libcurl >= 7.19.6)
  • CURLKHMATCH_MISSING (libcurl >= 7.19.6)
  • CURLKHMATCH_LAST (libcurl >= 7.19.6)

Intl

OpenSSL

  • OPENSSL_CMS_OLDMIMETYPE
  • PKCS7_NOOLDMIMETYPE

PCNTL

  • SIGINFO

PDO_ODBC

  • PDO_ODBC_TYPE

Posix

  • POSIX_SC_ARG_MAX
  • POSIX_SC_PAGESIZE
  • POSIX_SC_NPROCESSORS_CONF
  • POSIX_SC_NPROCESSORS_ONLN
  • POSIX_PC_LINK_MAX
  • POSIX_PC_MAX_CANON
  • POSIX_PC_MAX_INPUT
  • POSIX_PC_NAME_MAX
  • POSIX_PC_PATH_MAX
  • POSIX_PC_PIPE_BUF
  • POSIX_PC_CHOWN_RESTRICTED
  • POSIX_PC_NO_TRUNC
  • POSIX_PC_ALLOC_SIZE_MIN
  • POSIX_PC_SYMLINK_MAX

Sockets

The following socket options are now defined if they are supported:

  • SO_ATTACH_REUSEPORT_CBPF (Linux)
  • SO_DETACH_BPF (Linux)
  • SO_DETACH_FILTER (Linux)
  • TCP_QUICKACK (Linux)
  • IP_DONTFRAG (FreeBSD)
  • IP_MTU_DISCOVER (Linux)
  • IP_PMTUDISC_DO (Linux)
  • IP_PMTUDISC_DONT (Linux)
  • IP_PMTUDISC_WANT (Linux)
  • IP_PMTUDISC_PROBE (Linux)
  • IP_PMTUDISC_INTERFACE (Linux)
  • IP_PMTUDISC_OMIT (Linux)
  • AF_DIVERT (FreeBSD)
  • SOL_UDPLITE
  • UDPLITE_RECV_CSCOV
  • UDPLITE_SEND_CSCOV
  • SO_RERROR (NetBSD)
  • SO_ZEROIZE (OpenBSD)
  • SO_SPLICE (OpenBSD)
  • TCP_REPAIR (Linux)
  • SO_REUSEPORT_LB (FreeBSD)
  • IP_BIND_ADDRESS_NO_PORT (Linux)

Zip

  • ZipArchive::ER_DATA_LENGTH (libzip >= 1.10)
  • ZipArchive::ER_NOT_ALLOWED (libzip >= 1.10)
  • ZipArchive::AFL_RDONLY (libzip >= 1.10)
  • ZipArchive::AFL_IS_TORRENTZIP (libzip >= 1.10)
  • ZipArchive::AFL_WANT_TORRENTZIP (libzip >= 1.10)
  • ZipArchive::AFL_CREATE_OR_KEEP_FILE_FOR_EMPTY_ARCHIVE (libzip >= 1.10)
  • ZipArchive::FL_OPEN_FILE_NOW
  • ZipArchive::LENGTH_TO_END as default value for ZipArchive::addFile() and ZipArchive::replaceFile()
  • ZipArchive::LENGTH_UNCHECKED (libzip >= 1.10)

PHP 8.2

New Global Constants

COM

  • DISP_E_PARAMNOTFOUND
  • LOCALE_NEUTRAL

cURL

  • CURLALTSVC_H1 (libcurl >= 7.64.1)
  • CURLALTSVC_H2 (libcurl >= 7.64.1)
  • CURLALTSVC_H3 (libcurl >= 7.64.1)
  • CURLALTSVC_READONLYFILE (libcurl >= 7.64.1)
  • CURLAUTH_AWS_SIGV4 (libcurl >= 7.75.0)
  • CURLE_PROXY (libcurl >= 7.73.0)
  • CURLFTPMETHOD_DEFAULT
  • CURLHSTS_ENABLE (libcurl >= 7.74.0)
  • CURLHSTS_READONLYFILE (libcurl >= 7.74.0)
  • CURLINFO_PROXY_ERROR (libcurl >= 7.73.0)
  • CURLINFO_REFERER (libcurl >= 7.76.0)
  • CURLINFO_RETRY_AFTER (libcurl >= 7.66.0)
  • CURLMOPT_MAX_CONCURRENT_STREAMS (libcurl >= 7.67.0)
  • CURLOPT_ALTSVC_CTRL (libcurl >= 7.64.1)
  • CURLOPT_ALTSVC (libcurl >= 7.64.1)
  • CURLOPT_AWS_SIGV4 (libcurl >= 7.75.0)
  • CURLOPT_CAINFO_BLOB (libcurl >= 7.77.0)
  • CURLOPT_DOH_SSL_VERIFYHOST (libcurl >= 7.76.0)
  • CURLOPT_DOH_SSL_VERIFYPEER (libcurl >= 7.76.0)
  • CURLOPT_DOH_SSL_VERIFYSTATUS (libcurl >= 7.76.0)
  • CURLOPT_HSTS_CTRL (libcurl >= 7.74.0)
  • CURLOPT_HSTS (libcurl >= 7.74.0)
  • CURLOPT_MAIL_RCPT_ALLLOWFAILS (libcurl >= 7.69.0)
  • CURLOPT_MAXAGE_CONN (libcurl >= 7.65.0)
  • CURLOPT_MAXFILESIZE_LARGE
  • CURLOPT_MAXLIFETIME_CONN (libcurl >= 7.80.0)
  • CURLOPT_PROXY_CAINFO_BLOB (libcurl >= 7.77.0)
  • CURLOPT_SASL_AUTHZID (libcurl >= 7.66.0)
  • CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 (libcurl >= 7.80.0)
  • CURLOPT_SSL_EC_CURVES (libcurl >= 7.73.0)
  • CURLOPT_UPKEEP_INTERVAL_MS (libcurl >= 7.62.0)
  • CURLOPT_UPLOAD_BUFFERSIZE (libcurl >= 7.62.0)
  • CURLOPT_XFERINFOFUNCTION (libcurl >= 7.32.0)
  • CURLPROTO_MQTT (libcurl >= 7.71.0)
  • CURLPX_BAD_ADDRESS_TYPE (libcurl >= 7.73.0)
  • CURLPX_BAD_VERSION (libcurl >= 7.73.0)
  • CURLPX_CLOSED (libcurl >= 7.73.0)
  • CURLPX_GSSAPI (libcurl >= 7.73.0)
  • CURLPX_GSSAPI_PERMSG (libcurl >= 7.73.0)
  • CURLPX_GSSAPI_PROTECTION (libcurl >= 7.73.0)
  • CURLPX_IDENTD_DIFFER (libcurl >= 7.73.0)
  • CURLPX_IDENTD (libcurl >= 7.73.0)
  • CURLPX_LONG_HOSTNAME (libcurl >= 7.73.0)
  • CURLPX_LONG_PASSWD (libcurl >= 7.73.0)
  • CURLPX_LONG_USER (libcurl >= 7.73.0)
  • CURLPX_NO_AUTH (libcurl >= 7.73.0)
  • CURLPX_OK (libcurl >= 7.73.0)
  • CURLPX_RECV_ADDRESS (libcurl >= 7.73.0)
  • CURLPX_RECV_AUTH (libcurl >= 7.73.0)
  • CURLPX_RECV_CONNECT (libcurl >= 7.73.0)
  • CURLPX_RECV_REQACK (libcurl >= 7.73.0)
  • CURLPX_REPLY_ADDRESS_TYPE_NOT_SUPPORTED (libcurl >= 7.73.0)
  • CURLPX_REPLY_COMMAND_NOT_SUPPORTED (libcurl >= 7.73.0)
  • CURLPX_REPLY_CONNECTION_REFUSED (libcurl >= 7.73.0)
  • CURLPX_REPLY_GENERAL_SERVER_FAILURE (libcurl >= 7.73.0)
  • CURLPX_REPLY_HOST_UNREACHABLE (libcurl >= 7.73.0)
  • CURLPX_REPLY_NETWORK_UNREACHABLE (libcurl >= 7.73.0)
  • CURLPX_REPLY_NOT_ALLOWED (libcurl >= 7.73.0)
  • CURLPX_REPLY_TTL_EXPIRED (libcurl >= 7.73.0)
  • CURLPX_REPLY_UNASSIGNED (libcurl >= 7.73.0)
  • CURLPX_REQUEST_FAILED (libcurl >= 7.73.0)
  • CURLPX_RESOLVE_HOST (libcurl >= 7.73.0)
  • CURLPX_SEND_AUTH (libcurl >= 7.73.0)
  • CURLPX_SEND_CONNECT (libcurl >= 7.73.0)
  • CURLPX_SEND_REQUEST (libcurl >= 7.73.0)
  • CURLPX_UNKNOWN_FAIL (libcurl >= 7.73.0)
  • CURLPX_UNKNOWN_MODE (libcurl >= 7.73.0)
  • CURLPX_USER_REJECTED (libcurl >= 7.73.0)
  • CURLSSLOPT_AUTO_CLIENT_CERT (libcurl >= 7.77.0)
  • CURLSSLOPT_NATIVE_CA (libcurl >= 7.71.0)
  • CURLSSLOPT_NO_PARTIALCHAIN (libcurl >= 7.68.0)
  • CURLSSLOPT_REVOKE_BEST_EFFORT (libcurl >= 7.70.0)
  • CURL_VERSION_GSASL (libcurl >= 7.76.0)
  • CURL_VERSION_HSTS (libcurl >= 7.74.0)
  • CURL_VERSION_HTTP3 (libcurl >= 7.66.0)
  • CURL_VERSION_UNICODE (libcurl >= 7.72.0)
  • CURL_VERSION_ZSTD (libcurl >= 7.72.0)

DBA

  • DBA_LMDB_USE_SUB_DIR
  • DBA_LMDB_NO_SUB_DIR

Filter

  • FILTER_FLAG_GLOBAL_RANGE

Sockets

The following socket options are now defined if they are supported:

  • SO_INCOMING_CPU
  • SO_MEMINFO
  • SO_RTABLE (OpenBSD)
  • TCP_KEEPALIVE (MacOS)
  • TCP_KEEPCNT (Linux, others)
  • TCP_KEEPIDLE (Linux, others)
  • TCP_KEEPINTVL (Linux, others)
  • TCP_NOTSENT_LOWAT
  • LOCAL_CREDS_PERSISTENT (FreeBSD)
  • SCM_CREDS2 (FreeBSD)
  • LOCAL_CREDS (NetBSD)
  • SO_BPF_EXTENSIONS
  • SO_SETFIB
  • TCP_CONGESTION (Linux, FreeBSD)
  • SO_ZEROCOPY (Linux)
  • MSG_ZEROCOPY (Linux)

PHP 8.1

New Global Constants

cURL

  • CURLOPT_DOH_URL
  • CURLOPT_ISSUERCERT_BLOB
  • CURLOPT_PROXY_ISSUERCERT
  • CURLOPT_PROXY_ISSUERCERT_BLOB
  • CURLOPT_PROXY_SSLCERT_BLOB
  • CURLOPT_PROXY_SSLKEY_BLOB
  • CURLOPT_SSLCERT_BLOB
  • CURLOPT_SSLKEY_BLOB

GD

  • IMG_AVIF
  • IMG_WEBP_LOSSLESS

MySQLi

  • MYSQLI_REFRESH_REPLICA

    This constant has been added as a replacement for MYSQLI_REFRESH_SLAVE, in line with an upstream change in MySQL. The old constant is still available for backwards-compatibility reasons, but may be deprecated/removed in the future.

PCNTL

  • PRIO_DARWIN_BG
  • PRIO_DARWIN_THREAD

POSIX

  • POSIX_RLIMIT_KQUEUES
  • POSIX_RLIMIT_NPTS

Sockets

The following socket options are now defined if they are supported:

  • SO_ACCEPTFILTER
  • SO_DONTTRUNC
  • SO_WANTMORE
  • SO_MARK
  • TCP_DEFER_ACCEPT

Sodium

  • SODIUM_CRYPTO_STREAM_XCHACHA20_NONCEBYTES
  • SODIUM_CRYPTO_STREAM_XCHACHA20_KEYBYTES
  • SODIUM_CRYPTO_SCALARMULT_RISTRETTO255_BYTES
  • SODIUM_CRYPTO_SCALARMULT_RISTRETTO255_SCALARBYTES
  • SODIUM_CRYPTO_CORE_RISTRETTO255_BYTES
  • SODIUM_CRYPTO_CORE_RISTRETTO255_HASHBYTES
  • SODIUM_CRYPTO_CORE_RISTRETTO255_SCALARBYTES
  • SODIUM_CRYPTO_CORE_RISTRETTO255_NONREDUCEDSCALARBYTES

Tokenizer

  • T_READONLY

PHP 7.4

New Global Constants

PHP Core

  • PHP_WINDOWS_EVENT_CTRL_C
  • PHP_WINDOWS_EVENT_CTRL_BREAK

Multibyte String

  • MB_ONIGURUMA_VERSION

Sockets

Added the following FreeBSD-specific socket options:

  • SO_LABEL
  • SO_PEERLABEL
  • SO_LISTENQLIMIT
  • SO_LISTENQLEN
  • SO_USER_COOKIE

Tidy

  • TIDY_TAG_ARTICLE
  • TIDY_TAG_ASIDE
  • TIDY_TAG_AUDIO
  • TIDY_TAG_BDI
  • TIDY_TAG_CANVAS
  • TIDY_TAG_COMMAND
  • TIDY_TAG_DATALIST
  • TIDY_TAG_DETAILS
  • TIDY_TAG_DIALOG
  • TIDY_TAG_FIGCAPTION
  • TIDY_TAG_FIGURE
  • TIDY_TAG_FOOTER
  • TIDY_TAG_HEADER
  • TIDY_TAG_HGROUP
  • TIDY_TAG_MAIN
  • TIDY_TAG_MARK
  • TIDY_TAG_MENUITEM
  • TIDY_TAG_METER
  • TIDY_TAG_NAV
  • TIDY_TAG_OUTPUT
  • TIDY_TAG_PROGRESS
  • TIDY_TAG_SECTION
  • TIDY_TAG_SOURCE
  • TIDY_TAG_SUMMARY
  • TIDY_TAG_TEMPLATE
  • TIDY_TAG_TIME
  • TIDY_TAG_TRACK
  • TIDY_TAG_VIDEO

PHP 7.3

New Global Constants

PHP Core

  • PASSWORD_ARGON2ID

Client URL Library

  • CURLAUTH_BEARER
  • CURLAUTH_GSSAPI
  • CURLE_WEIRD_SERVER_REPLY
  • CURLINFO_APPCONNECT_TIME_T
  • CURLINFO_CONNECT_TIME_T
  • CURLINFO_CONTENT_LENGTH_DOWNLOAD_T
  • CURLINFO_CONTENT_LENGTH_UPLOAD_T
  • CURLINFO_FILETIME_T
  • CURLINFO_HTTP_VERSION
  • CURLINFO_NAMELOOKUP_TIME_T
  • CURLINFO_PRETRANSFER_TIME_T
  • CURLINFO_PROTOCOL
  • CURLINFO_PROXY_SSL_VERIFYRESULT
  • CURLINFO_REDIRECT_TIME_T
  • CURLINFO_SCHEME
  • CURLINFO_SIZE_DOWNLOAD_T
  • CURLINFO_SIZE_UPLOAD_T
  • CURLINFO_SPEED_DOWNLOAD_T
  • CURLINFO_SPEED_UPLOAD_T
  • CURLINFO_STARTTRANSFER_TIME_T
  • CURLINFO_TOTAL_TIME_T
  • CURL_LOCK_DATA_CONNECT
  • CURL_LOCK_DATA_PSL
  • CURL_MAX_READ_SIZE
  • CURLOPT_ABSTRACT_UNIX_SOCKET
  • CURLOPT_DISALLOW_USERNAME_IN_URL
  • CURLOPT_DNS_SHUFFLE_ADDRESSES
  • CURLOPT_HAPPY_EYEBALLS_TIMEOUT_MS
  • CURLOPT_HAPROXYPROTOCOL
  • CURLOPT_KEEP_SENDING_ON_ERROR
  • CURLOPT_PRE_PROXY
  • CURLOPT_PROXY_CAINFO
  • CURLOPT_PROXY_CAPATH
  • CURLOPT_PROXY_CRLFILE
  • CURLOPT_PROXY_KEYPASSWD
  • CURLOPT_PROXY_PINNEDPUBLICKEY
  • CURLOPT_PROXY_SSLCERT
  • CURLOPT_PROXY_SSLCERTTYPE
  • CURLOPT_PROXY_SSL_CIPHER_LIST
  • CURLOPT_PROXY_SSLKEY
  • CURLOPT_PROXY_SSLKEYTYPE
  • CURLOPT_PROXY_SSL_OPTIONS
  • CURLOPT_PROXY_SSL_VERIFYHOST
  • CURLOPT_PROXY_SSL_VERIFYPEER
  • CURLOPT_PROXY_SSLVERSION
  • CURLOPT_PROXY_TLS13_CIPHERS
  • CURLOPT_PROXY_TLSAUTH_PASSWORD
  • CURLOPT_PROXY_TLSAUTH_TYPE
  • CURLOPT_PROXY_TLSAUTH_USERNAME
  • CURLOPT_REQUEST_TARGET
  • CURLOPT_SOCKS5_AUTH
  • CURLOPT_SSH_COMPRESSION
  • CURLOPT_SUPPRESS_CONNECT_HEADERS
  • CURLOPT_TIMEVALUE_LARGE
  • CURLOPT_TLS13_CIPHERS
  • CURLPROXY_HTTPS
  • CURLSSH_AUTH_GSSAPI
  • CURL_SSLVERSION_MAX_DEFAULT
  • CURL_SSLVERSION_MAX_NONE
  • CURL_SSLVERSION_MAX_TLSv1_0
  • CURL_SSLVERSION_MAX_TLSv1_1
  • CURL_SSLVERSION_MAX_TLSv1_2
  • CURL_SSLVERSION_MAX_TLSv1_3
  • CURL_SSLVERSION_TLSv1_3
  • CURL_VERSION_ALTSVC (as of PHP 7.3.6)
  • CURL_VERSION_ASYNCHDNS
  • CURL_VERSION_BROTLI
  • CURL_VERSION_CONV
  • CURL_VERSION_CURLDEBUG (as of PHP 7.3.6)
  • CURL_VERSION_DEBUG
  • CURL_VERSION_GSSAPI
  • CURL_VERSION_GSSNEGOTIATE
  • CURL_VERSION_HTTPS_PROXY
  • CURL_VERSION_IDN
  • CURL_VERSION_LARGEFILE
  • CURL_VERSION_MULTI_SSL
  • CURL_VERSION_NTLM
  • CURL_VERSION_NTLM_WB
  • CURL_VERSION_PSL (as of PHP 7.3.6)
  • CURL_VERSION_SPNEGO
  • CURL_VERSION_SSPI
  • CURL_VERSION_TLSAUTH_SRP

Data Filtering

  • FILTER_SANITIZE_ADD_SLASHES

JavaScript Object Notation

  • JSON_THROW_ON_ERROR

Lightweight Directory Access Protocol

  • LDAP_CONTROL_ASSERT
  • LDAP_CONTROL_MANAGEDSAIT
  • LDAP_CONTROL_PROXY_AUTHZ
  • LDAP_CONTROL_SUBENTRIES
  • LDAP_CONTROL_VALUESRETURNFILTER
  • LDAP_CONTROL_PRE_READ
  • LDAP_CONTROL_POST_READ
  • LDAP_CONTROL_SORTREQUEST
  • LDAP_CONTROL_SORTRESPONSE
  • LDAP_CONTROL_PAGEDRESULTS
  • LDAP_CONTROL_AUTHZID_REQUEST
  • LDAP_CONTROL_AUTHZID_RESPONSE
  • LDAP_CONTROL_SYNC
  • LDAP_CONTROL_SYNC_STATE
  • LDAP_CONTROL_SYNC_DONE
  • LDAP_CONTROL_DONTUSECOPY
  • LDAP_CONTROL_PASSWORDPOLICYREQUEST
  • LDAP_CONTROL_PASSWORDPOLICYRESPONSE
  • LDAP_CONTROL_X_INCREMENTAL_VALUES
  • LDAP_CONTROL_X_DOMAIN_SCOPE
  • LDAP_CONTROL_X_PERMISSIVE_MODIFY
  • LDAP_CONTROL_X_SEARCH_OPTIONS
  • LDAP_CONTROL_X_TREE_DELETE
  • LDAP_CONTROL_X_EXTENDED_DN
  • LDAP_CONTROL_VLVREQUEST
  • LDAP_CONTROL_VLVRESPONSE

Multibyte String

  • MB_CASE_FOLD
  • MB_CASE_LOWER_SIMPLE
  • MB_CASE_UPPER_SIMPLE
  • MB_CASE_TITLE_SIMPLE
  • MB_CASE_FOLD_SIMPLE

OpenSSL

  • STREAM_CRYPTO_PROTO_SSLv3
  • STREAM_CRYPTO_PROTO_TLSv1_0
  • STREAM_CRYPTO_PROTO_TLSv1_1
  • STREAM_CRYPTO_PROTO_TLSv1_2

PostgreSQL

  • PGSQL_DIAG_SCHEMA_NAME
  • PGSQL_DIAG_TABLE_NAME
  • PGSQL_DIAG_COLUMN_NAME
  • PGSQL_DIAG_DATATYPE_NAME
  • PGSQL_DIAG_CONSTRAINT_NAME
  • PGSQL_DIAG_SEVERITY_NONLOCALIZED

PHP 7.2

New global constants

JSON

  • JSON_INVALID_UTF8_IGNORE
  • JSON_INVALID_UTF8_SUBSTITUTE

Sodium

PHP 7.1

New global constants

Core Predefined Constants

  • PHP_FD_SETSIZE

CURL

  • CURLMOPT_PUSHFUNCTION
  • CURL_PUSH_OK
  • CURL_PUSH_DENY

Data Filtering

  • FILTER_FLAG_EMAIL_UNICODE

Image Processing and GD

  • IMAGETYPE_WEBP

JSON

  • JSON_UNESCAPED_LINE_TERMINATORS

LDAP

  • LDAP_OPT_X_SASL_NOCANON
  • LDAP_OPT_X_SASL_USERNAME
  • LDAP_OPT_X_TLS_CACERTDIR
  • LDAP_OPT_X_TLS_CACERTFILE
  • LDAP_OPT_X_TLS_CERTFILE
  • LDAP_OPT_X_TLS_CIPHER_SUITE
  • LDAP_OPT_X_TLS_KEYFILE
  • LDAP_OPT_X_TLS_RANDOM_FILE
  • LDAP_OPT_X_TLS_CRLCHECK
  • LDAP_OPT_X_TLS_CRL_NONE
  • LDAP_OPT_X_TLS_CRL_PEER
  • LDAP_OPT_X_TLS_CRL_ALL
  • LDAP_OPT_X_TLS_DHFILE
  • LDAP_OPT_X_TLS_CRLFILE
  • LDAP_OPT_X_TLS_PROTOCOL_MIN
  • LDAP_OPT_X_TLS_PROTOCOL_SSL2
  • LDAP_OPT_X_TLS_PROTOCOL_SSL3
  • LDAP_OPT_X_TLS_PROTOCOL_TLS1_0
  • LDAP_OPT_X_TLS_PROTOCOL_TLS1_1
  • LDAP_OPT_X_TLS_PROTOCOL_TLS1_2
  • LDAP_OPT_X_TLS_PACKAGE
  • LDAP_OPT_X_KEEPALIVE_IDLE
  • LDAP_OPT_X_KEEPALIVE_PROBES
  • LDAP_OPT_X_KEEPALIVE_INTERVAL

PostgreSQL

  • PGSQL_NOTICE_LAST
  • PGSQL_NOTICE_ALL
  • PGSQL_NOTICE_CLEAR

SPL

  • MT_RAND_PHP

PHP 7.0

New Global Constants

GD

  • IMG_WEBP (as of PHP 7.0.10)

JSON

  • JSON_ERROR_INVALID_PROPERTY_NAME
  • JSON_ERROR_UTF16

LibXML

  • LIBXML_BIGLINES

PCRE

  • PREG_JIT_STACKLIMIT_ERROR

POSIX

  • POSIX_RLIMIT_AS
  • POSIX_RLIMIT_CORE
  • POSIX_RLIMIT_CPU
  • POSIX_RLIMIT_DATA
  • POSIX_RLIMIT_FSIZE
  • POSIX_RLIMIT_LOCKS
  • POSIX_RLIMIT_MEMLOCK
  • POSIX_RLIMIT_MSGQUEUE
  • POSIX_RLIMIT_NICE
  • POSIX_RLIMIT_NOFILE
  • POSIX_RLIMIT_NPROC
  • POSIX_RLIMIT_RSS
  • POSIX_RLIMIT_RTPRIO
  • POSIX_RLIMIT_RTTIME
  • POSIX_RLIMIT_SIGPENDING
  • POSIX_RLIMIT_STACK
  • POSIX_RLIMIT_INFINITY

Zlib

  • ZLIB_ENCODING_RAW
  • ZLIB_ENCODING_DEFLATE
  • ZLIB_ENCODING_GZIP
  • ZLIB_FILTERED
  • ZLIB_HUFFMAN_ONLY
  • ZLIB_FIXED
  • ZLIB_RLE
  • ZLIB_DEFAULT_STRATEGY
  • ZLIB_BLOCK
  • ZLIB_FINISH
  • ZLIB_FULL_FLUSH
  • ZLIB_NO_FLUSH
  • ZLIB_PARTIAL_FLUSH
  • ZLIB_SYNC_FLUSH

PHP 5.6

New global constants

GD

  • IMG_WEBP (as of PHP 5.6.25)

LDAP

  • LDAP_ESCAPE_DN
  • LDAP_ESCAPE_FILTER

OpenSSL

  • OPENSSL_DEFAULT_STREAM_CIPHERS
  • STREAM_CRYPTO_METHOD_ANY_CLIENT
  • STREAM_CRYPTO_METHOD_ANY_SERVER
  • STREAM_CRYPTO_METHOD_TLSv1_0_CLIENT
  • STREAM_CRYPTO_METHOD_TLSv1_0_SERVER
  • STREAM_CRYPTO_METHOD_TLSv1_1_CLIENT
  • STREAM_CRYPTO_METHOD_TLSv1_1_SERVER
  • STREAM_CRYPTO_METHOD_TLSv1_2_CLIENT
  • STREAM_CRYPTO_METHOD_TLSv1_2_SERVER

PostgreSQL

  • PGSQL_CONNECT_ASYNC
  • PGSQL_CONNECTION_AUTH_OK
  • PGSQL_CONNECTION_AWAITING_RESPONSE
  • PGSQL_CONNECTION_MADE
  • PGSQL_CONNECTION_SETENV
  • PGSQL_CONNECTION_SSL_STARTUP
  • PGSQL_CONNECTION_STARTED
  • PGSQL_DML_ESCAPE
  • PGSQL_POLLING_ACTIVE
  • PGSQL_POLLING_FAILED
  • PGSQL_POLLING_OK
  • PGSQL_POLLING_READING
  • PGSQL_POLLING_WRITING

PHP 8.3

Other Changes

Core changes

FFI

FFI::load() is now allowed during preloading when opcache.preload_user is the current system user. Previously, calling FFI::load() was not possible during preloading if the opcache.preload_user directive was set.

FPM

FPM CLI test now fails if the socket path is longer than supported by OS.

Opcache

In the CLI and phpdbg SAPIs, preloading does not require the opcache.preload_user directive to be set anymore when running as root. In other SAPIs, this directive is required when running as root because preloading is done before the SAPI switches to an unprivileged user.

Streams

Blocking fread() on socket connection returns immediately if there are any buffered data instead of waiting for more data.

A memory stream no longer fails if the seek offset is past the end. Instead, the memory will be increased on the next write and the data between the old end and the offset is filled with zero bytes, similar to how files work.

stat() access operations like file_exists() and similar will now use real path instead of the actual stream path. This is consistent with stream opening.

Changes in SAPI Modules

CLI

The STDOUT, STDERR and STDIN streams are no longer closed on resource destruction which is mostly when the CLI finishes. It is however still possible to explicitly close those streams using fclose() and similar.

Changed Functions

Core

gc_status() has added the following 8 fields:

  • "running" => bool
  • "protected" => bool
  • "full" => bool
  • "buffer_size" => int
  • "application_time" => float: Total application time, in seconds (including collector_time)
  • "collector_time" => float: Time spent collecting cycles, in seconds (including destructor_time and free_time)
  • "destructor_time" => float: Time spent executing destructors during cycle collection, in seconds
  • "free_time" => float: Time spent freeing values during cycle collection, in seconds

class_alias() now supports creating an alias of an internal class.

Setting open_basedir at runtime using ini_set('open_basedir', ...); no longer accepts paths containing the parent directory (..). Previously, only paths starting with .. were disallowed. This could easily be circumvented by prepending ./ to the path.

User exception handlers now catch exceptions during shutdown.

The resultant HTML of highlight_string() and highlight_file() has changed. Whitespace between outer HTML tags is removed. Newlines and spaces are no longer converted to HTML entities. The whole HTML is now wrapped in a 

 tag. The outer 
    tag has been merged with the  tag.
   


  


  

   
Calendar


   

    easter_date() now supports years from 1970 to
    2,000,000,000 on 64-bit systems, previously it only supported years in the
    range from 1970 to 2037.
   

  


  

   
Curl


   

    curl_getinfo() now supports two new constants:
    CURLINFO_CAPATH and
    CURLINFO_CAINFO. If option is null, the following
    two additional keys are present:
    "capath" and "cainfo".
   

  


  

   
DOM


   

    Changed DOMCharacterData::appendData() tentative
    return type to true.
   


   

    DOMDocument::loadHTML(),
    DOMDocument::loadHTMLFile(), and
    DOMDocument::loadXML() now have a tentative
    return type of bool. Previously, this was documented as having a return
    type of DOMDocument|bool, but, as of PHP 8.0.0,
    DOMDocument
    cannot be returned as it is no longer statically callable.
   


  


  

   
Gd


   

    The signature of imagerotate() has changed.
    The $ignore_transparent parameter has been removed,
    as it was ignored since PHP 5.5.0.
   

  


  

   
Intl


   

    datefmt_set_timezone() (and its alias
    IntlDateformatter::setTimeZone())
    now returns true on success, previously null was returned.
   


   

    IntlBreakiterator::setText() now returns false
    on failure, previously null was returned.
    It now returns true on success, previously null was returned.
   


   

    IntlChar::enumCharNames() is now returning a boolean.
    Previously it returned null on success and false on failure.
   


   

    IntlDateFormatter::__construct() throws an U_ILLEGAL_ARGUMENT_ERROR
    exception when an invalid locale had been set.
   

  


  

   
MBString


   

    mb_strtolower() and mb_convert_case()
    implement conditional casing rules for the Greek letter sigma.
    For mb_convert_case(),
    conditional casing only applies to MB_CASE_LOWER
    and MB_CASE_TITLE modes, not to
    MB_CASE_LOWER_SIMPLE and
    MB_CASE_TITLE_SIMPLE.
   


   

    mb_decode_mimeheader() interprets underscores in
    QPrint-encoded MIME encoded words as required by RFC 2047; they are
    converted to spaces.
    Underscores must be encoded as "=5F" in such MIME
    encoded words.
   


   

    In rare cases, mb_encode_mimeheader() will transfer-encode
    its input string where it would pass it through as raw ASCII in PHP 8.2.
   


   

    mb_encode_mimeheader() no longer drops NUL (zero)
    bytes when QPrint-encoding the input string.
    This previously caused strings in certain text encodings, especially
    UTF-16 and UTF-32, to be corrupted by mb_encode_mimeheader.
   


   

    mb_detect_encoding()'s "non-strict" mode now behaves
    as described in the documentation.
    Previously, it would return false if the same byte (for example, the first
    byte) of the input string was invalid in all candidate encodings.
    More generally, it would eliminate candidate encodings from consideration
    when an invalid byte was seen, and if the same input byte eliminated all
    remaining encodings still under consideration, it would return false.
    On the other hand, if all candidate encodings but one were eliminated
    from consideration, it would return the last remaining one without regard
    for how many encoding errors might be encountered later in the string.
    This is different from the behavior described in the documentation, which
    says: "If strict is set to false, the closest matching encoding will be
    returned."
   

  


  

   
mysqli


   

    mysqli_fetch_object() now raises a
    ValueError instead of an Exception
    when the $constructor_args argument is non empty with
    the class not having constructor.
   


   

    mysqli_poll() now raises a ValueError
    when neither the $read
    nor the $error arguments are passed.
   


   

    mysqli_field_seek() and
    mysqli_result::field_seek() now specify the return
    type as true instead of bool.
   

  


  

   
ODBC


   

    odbc_autocommit() now accepts null for the
    $enable parameter.
    Passing null has the same behaviour as passing only 1 parameter,
    namely indicating if the autocommit feature is enabled or not.
   

  


  

   
PGSQL


   

    pg_fetch_object() now raises a
    ValueError instead of an Exception
    when the $constructor_args argument is non empty with
    the class not having constructor.
   


   

    pg_insert() now raises a ValueError
    instead of a E_WARNING when the table specified is invalid.
   


   

    pg_insert() and pg_convert() raises
    a ValueError or a TypeError
    instead of a E_WARNING when the value/type of a field
    does not match properly with a PostgreSQL's type.
   


   

    The $row parameter of
    pg_fetch_result(),
    pg_field_prtlen(), and
    pg_field_is_null() is now nullable.
   

  


  

   
Random


   

    Changed mt_srand() and srand() to
    not check the number of arguments to determine whether a random seed should
    be used. Passing null will generate a random seed, 0
    will use zero as the seed. The functions are now consistent with
    Random\Engine\Mt19937::__construct().
   


  


  

   
Reflection


   

    Return type of ReflectionClass::getStaticProperties()
    is no longer nullable.
   

  


  

   
Standard


   

    E_NOTICEs emitted by unserialize()
    have been promoted to E_WARNING.
    
   


   

    unserialize() now emits a new E_WARNING
    if the input contains unconsumed bytes.
    
   


   

    array_pad() is now only limited by the maximum number of
    elements an array can have. Before, it was only possible to add at most 1048576
    elements at a time.
   


   

    strtok() raises an E_WARNING in the
    case token is not provided when starting tokenization.
   


   

    password_hash() will now chain the underlying
    Random\RandomException
    as the ValueError's $previous
    Exception when salt generation fails.
   


   

    If using an array as the $command
    for proc_open(), it must now have at least one
    non empty element. Otherwise a ValueError
    is thrown.
   


   

    proc_open() returns false if $command
    array is invalid command instead of resource object that produces warning later.
    This was already the case for Windows but it is now also the case if posix_spawn
    implementation is in use (most Linux, BSD and MacOS platforms). There are still
    some old platforms where this behavior is not changed as posix_spawn is not
    supported there.
   


   

    array_sum() and array_product() now
    warn when values in the array cannot be converted to int/float.
    Previously arrays and objects where ignored whilst every other value was
    cast to int. Moreover, objects that define a numeric cast (e.g.
    GMP) are now casted instead of ignored.
    
   


   

    The $decimal of number_format()
    now properly handles negative integers.
    Rounding with a negative value for $decimal means
    that $num is rounded to $decimals
    significant digits before the decimal point.
    Previously negative $decimals were silently
    ignored and the number got rounded to zero decimal places.
   


   

    A new $before_needle argument has been added to
    strrchr(). It behaves like its counterpart in the
    strstr() or stristr() functions.
   


   

    str_getcsv() and fgetcsv() now return
    an empty string instead of a string with a single null byte for the last field
    which only contains an unterminated enclosure.
   

  


 


 

  
Other Changes to Extensions


  

   
Core


   

    Using the increment/decrement
    operators (++/--) on values of type
    bool now emit warnings.
    This is because it currently has no effect, but will behave like
    $bool += 1 in the future.
   


   

    Using the decrement
    operator (--) on values of type null now emit warnings.
    This is because it currently has no effect, but will behave like
    $null -= 1 in the future.
   


   

    Internal objects that implement an _IS_NUMBER cast but not a do_operator
    handler that overrides addition and subtraction now can be incremented
    and decrement as if one would do $o += 1 or $o -= 1
   

  


  

   
DOM


   

    The DOM lifetime mechanism has been reworked such that implicitly removed
    nodes can still be fetched. Previously this resulted in an exception.
   

  


  

   
SQLite3


   

    The SQLite3 class now throws
    SQLite3Exception (extends
    Exception) instead of Exception.
   


   

    The SQLite error code is now passed in the exception error code instead of
    being included in the error message.
   


  

 


 

  
Changes to INI File Handling


  
  • 
    
    
     The assert.* INI settings have been deprecated.
     This comprises the following INI settings:
     
    
     If the value of the setting is equal to the default value, no deprecation
     notice is emitted.
     The zend.assertions INI setting
     should be used instead.
    
   
    • 
   
  • 
    
    
     zend.max_allowed_stack_size
    is a new INI directive to set the maximum allowed stack size.
    Possible values are 0 (detect the process or thread maximum stack size),
    -1 (no limit), or a positive number of bytes.
    The default is 0.
    When it is not possible to detect the process or thread maximum stack
    size, a known system default is used.
    Setting this value too high has the same effect as disabling the stack size limit.
    Fibers use
    fiber.stack_size
    as maximum allowed stack size.
    An Error is thrown when the process call stack exceeds
    zend.max_allowed_stack_size-zend.reserved_stack_size
    bytes, to prevent stack-overflow-induced segmentation faults, with
    the goal of making debugging easier.
    The stack size increases during uncontrolled recursions involving internal functions
    or the magic methods
    __toString(),
    __clone(),
    __sleep(),
    __destruct().
    This is not related to stack buffer overflows, and is not a security feature.
    
    
   
    • 
   
  • 
    
    
     zend.reserved_stack_size
     is a new INI directive to set the reserved stack size, in bytes.
     This is subtracted from the max allowed stack size,
     as a buffer, when checking the stack size.
    
    
   
    • 
   


 

  
Performance


  

   
DOM


   

    Looping over a DOMNodeList now uses caching. Therefore
    requesting items no longer takes quadratic time by default.
   


   

    Getting text content from nodes now avoids an allocation, resulting in a
    performance gain.
   


   

    DOMChildNode::remove() now runs in O(1) performance.
   

  


  

   
Standard


   

    The file() flags error check is now about 7% faster.
   

  


  

   
SPL


   

    RecursiveDirectoryIterator now performs less I/O
    when looping over a directory.
   

  

 



PHP 8.2

    

 
Other Changes


 

  
Core changes


  

   The iterable type is now a built-in compile time alias for
   array|Traversable.
   Error messages relating to iterable will therefore
   now use array|Traversable.
   Type Reflection is preserved for single iterable
   (and ?iterable) to produce a
   ReflectionNamedType with name iterable,
   however usage of iterable in union types will be
   converted to array|Traversable.
  


  

   The date format of sent cookies is now 'D, d M Y H:i:s \G\M\T';
   previously it was 'D, d-M-Y H:i:s T'.
  

 


 

  
Changes in SAPI Modules


  

   
CLI


   

    The STDOUT, STDERR and STDIN streams are no longer closed on resource destruction
    which is mostly when the CLI finishes. It is however still possible to
    explicitly close those streams using fclose() and similar.
   

  

 


 

  
Changed Functions


  

   
Core


   

    The strcmp(), strcasecmp(),
    strncmp(), strncasecmp(), and
    substr_compare() functions, using binary safe string
    comparison now return -1, 0 and 1.
   

  


  

   
DBA


   

    dba_open() and dba_popen()
    now have the following enforced signature:
    

     dba_open(
    string $path,
    string $mode,
    ?string $handler = null,
    int $permission = 0644,
    int $map_size = 0,
    ?int $flags = null
): resource|false


   
   

    dba_fetch()'s optional skip argument is now at the end
    in line with PHP userland semantics. Its signature is now:
    
dba_fetch(string|array $key, resource $handle, int $skip): string|false



    The overloaded signature:
    
dba_fetch(string|array $key, int $skip, resource $handle): string|false


    is still accepted, but it is recommended to use the new standard variant.
   
  


  

   
Random


   

    random_bytes() and random_int()
    now throw a \Random\RandomException on CSPRNG failures.
    Previously a plain \Exception was thrown instead.
   

  


  

   
SPL


   

    The iterator parameter of
    iterator_to_array() and iterator_count()
    is widened to iterable from Iterator,
    allowing arrays to be passed.
    
   

  

 


 

  
Other Changes to Extensions


  

   
Date


   

    The properties of DatePeriod are now properly declared.
   

  


  

   
Intl


   

    Instances of
    IntlBreakIterator,
    IntlRuleBasedBreakIterator,
    IntlCodePointBreakIterator,
    IntlPartsIterator,
    IntlCalendar,
    Collator,
    IntlIterator,
    UConverter,
    IntlDateFormatter,
    IntlDatePatternGenerator,
    MessageFormatter,
    ResourceBundle,
    Spoofchecker,
    IntlTimeZone,
    and Transliterator
    are no longer serializable. Previously, they could be serialized, but
    unserialization yielded unusable objects or failed.
   

  


  

   
MySQLi


   

    The support for libmysql has been removed and it is no longer
    possible to compile mysqli with libmysql.
    From now on, the mysqli extension can be compiled only with mysqlnd.
    All libmysql features unavailable in mysqlnd have been removed:
    


  

   
OCI8


   

    The minimum Oracle Client library version required is now 11.2.
   

  


  

   
PCRE


   

    NUL characters (\0) in pattern strings are now supported.
   

  


  

   
Session


   

    Trying to change the
    session.cookie_samesite
    INI directive while the session is active or output has already been sent
    will now fail and emit a warning.
    This aligns the behaviour with all other session INI settings.
   

  


  

   
SQLite3


   

    sqlite3.defensive
    is now INI_USER.
   

  


  

   
Standard


   

    getimagesize() now reports the actual image dimensions,
    bits and channels of AVIF images. Previously, the dimensions have been reported as 0x0,
    and bits and channels have not been reported at all.
   

  


  

   
Tidy


   

    The properties of the tidy class are now properly declared.
    And those of the tidyNode class are now properly declared as readonly.
   

  


  

   
Zip


   

    The Zip extension has been updated to version 1.20.0,
    which adds the following methods:
    

 


 

  
Changes to INI File Handling


  
  

   Support for binary (0b/0B) and octal
   (0o/0O) prefixes has been added to integer INI settings.
   Integer INI settings that start with a zero (0)
   continue to be interpreted as an octal integer.
  


  

   Parsing of some ill-formatted values will now trigger a warning when this
   was silently ignored before.
   For backwards compatibility, interpretation of these values has not changed.
   This affects the following settings:

   
   



PHP 8.1

    

 
Other Changes


 

  
Changes in SAPI Modules


  

   
CLI


   

    Using -a without the readline extension will now result in an error.
    Previously, -a without readline had the same behavior as
    calling php without any arguments, apart from printing an additional
    "Interactive mode enabled" message.
    This mode was not interactive.
   

  


  

   
PHPDBG


   

    Remote functionality from phpdbg has been removed.
   

  

 


 

  
Changed Functions


  

   
Core


   

    The order of properties used in foreach, var_dump(),
    serialize(), object comparison, etc. was changed.
    Properties are now ordered naturally according to their declaration
    and inheritance. Properties declared in a base class are going
    to be before the child properties.
   

   

    This order is consistent with internal layout of properties in
    zend_object structure and repeats the order in
    default_properties_table[] and properties_info_table[].
    The old order was not documented and was caused by class inheritance implementation details.
   

  


  

   
Filter


   

    The FILTER_FLAG_ALLOW_OCTAL flag of the
    FILTER_VALIDATE_INT filter
    now accept octal string with the leading octal prefix
    ("0o"/"0O").
   

  


  

   
GMP


   

    All GMP functions now accept octal string with the leading octal prefix
    ("0o"/"0O").
   

  


  

   
PDO ODBC


   

    PDO::getAttribute() with
    PDO::ATTR_SERVER_INFO and
    PDO::ATTR_SERVER_VERSION
    now return values instead of throwing PDOException.
   

  


  

   
Reflection


   

    ReflectionProperty::setAccessible() and
    ReflectionMethod::setAccessible()
    no longer have an effect.
    Properties and methods are now always considered accessible via Reflection.
   

  


  

   
Standard


   

    syslog() is now binary safe.
   

  

 


 

  
Other Changes to Extensions


  

   
GD


   

    imagewebp() can now do lossless WebP encoding
    by passing IMG_WEBP_LOSSLESS as the quality.
   

   

    This constant is only defined, if the used libgd supports
    lossless WebP encoding.
   

  


  

   
MySQLi


   

    mysqli_stmt::next_result() and
    mysqli::fetch_all()
    are now available when linking against libmysqlclient.
   

  


  

   
OpenSSL


   
  • 
     
    
      The OpenSSL extension now requires at least OpenSSL version 1.0.2.
     
    
    
    • 
    
  • 
     
    
      OpenSSL 3.0 is now supported. Be aware that many ciphers are no longer
      enabled by default (part of the legacy provider), and that parameter
      validation (e.g. minimum key sizes) is stricter now.
     
    
    
    • 
   


  

   
Phar


   
  • 
     
    
      SHA256 is now used by default for signatures.
     
    
    
    • 
    
  • 
     
    
      Added support for OpenSSL_SHA256 and OpenSSL_SHA512 signatures.
     
    
    
    • 
   


  

   
SNMP


   
  • 
     
    
      Added support for SHA256 and SHA512 for the security protocol.
     
    
    
    • 
   


  

   
Standard


   

    --with-password-argon2 now uses pkg-config to detect libargon2.
    As such, an alternative libargon2 location should now be specified using
    PKG_CONFIG_PATH.
   

  

 


 

  
Changes to INI File Handling


  
  • 
    
    
     The log_errors_max_len
     INI directive has been removed.
     It no longer had an effect since PHP 8.0.0.
    
    
   
    • 
   
  • 
    
    
     A leading dollar in a quoted string can now be escaped: "\${" will now be
     interpreted as a string with contents ${.
    
    
   
    • 
   
  • 
    
    
     Backslashes in double quoted strings are now more consistently treated as
     escape characters. Previously, "foo\\" followed by
     something other than a newline was not considered as a terminated string.
     It is now interpreted as a string with contents foo\.
     However, as an exception, the string "foo\"
     followed by a newline will continue to be treated as a valid string with
     contents foo\ rather than an unterminated string.
     This exception exists to support naive uses of Windows file paths such as
     "C:\foo\".
    
    
   
    • 
  



PHP 8.0

    

 
Other Changes


 

  
Changes in SAPI Modules


  

   
Apache2Handler


   

    The PHP module has been renamed from php7_module to
    php_module.
   

  

 


 

  
Changed Functions


  

   
Reflection


   

    ReflectionClass::getConstants() and
    ReflectionClass::getReflectionConstants() results can be now filtered via
    a new parameter filter. Three new constants were added to be used with it:
   

   

    
  • ReflectionClassConstant::IS_PUBLIC
    • 
     
  • ReflectionClassConstant::IS_PROTECTED
    • 
     
  • ReflectionClassConstant::IS_PRIVATE
    • 
    


  

   
Standard


   

    The math functions abs(), ceil(),
    floor() and round() now properly heed
    the strict_types directive.
    Previously, they coerced the first argument even in strict type mode.
   

  


  

   
Zip


   

 


 

  
Other Changes to Extensions


  

   
CURL


   
  • 
     
    
      The CURL extension now requires at least libcurl 7.29.0.
     
    
    
    • 
    
  • 
     
    
      The deprecated parameter version of curl_version() has
      been removed.
     
    
    
    • 
   


  

   
Date and Time


   

    DatePeriod now implements IteratorAggregate
    (instead of Traversable).
   

  


  

   
DOM


   

    DOMNamedNodeMap and DOMNodeList now implement
    IteratorAggregate (instead of
    Traversable).
   

  


  

   
Intl


   

    IntlBreakIterator and ResourceBundle now implement
    IteratorAggregate (instead of Traversable).
   

  


  

   
Enchant


   

    The enchant extension now uses libenchant-2 by default when available. libenchant version 1 is
    still supported but is deprecated and could be removed in the future.
   

  


  

   
GD


   


  

   
JSON


   

    The JSON extension cannot be disabled anymore and is always an integral part of any PHP build,
    similar to the date extension.
   

  


  

   
MBString


   

    The Unicode data tables have been updated to version 13.0.0.
   

  


  

   
PDO


   

    PDOStatement now implements
    IteratorAggregate (instead of
    Traversable).
   

  


  

   
LibXML


   

    The minimum required libxml version is now 2.9.0. This means that external entity loading is now
    guaranteed to be disabled by default, and no extra steps need to be taken to protect against XXE
    attacks.
   

  


  

   
MySQLi / PDO MySQL


   


  

   
PGSQL / PDO PGSQL


   

    The PGSQL and PDO PGSQL extensions now require at least libpq 9.1.
   

  


  

   
Readline


   

    Calling readline_completion_function() before the interactive prompt starts
    (e.g. in auto_prepend_file) will now override the
    default interactive prompt completion function. Previously,
    readline_completion_function() only worked when called after starting the
    interactive prompt.
   

  


  

   
SimpleXML


   

    SimpleXMLElement now implements
    RecursiveIterator and absorbed the functionality of
    SimpleXMLIterator. SimpleXMLIterator is an empty
    extension of SimpleXMLElement.
   

  

 


 

  
Changes to INI File Handling


  
  • 
    
    
     com.dotnet_version
     is a new INI directive to choose the version of the .NET framework to use for
     dotnet objects.
    
    
   
    • 
   
  • 
    
    
     zend.exception_string_param_max_len
     is a new INI directive to set the maximum string length in an argument of a stringified
     stack strace.
    
    
   
    • 
   


 

  
EBCDIC


  

   EBCDIC targets are no longer supported, though it's unlikely that they were still working in the
   first place.
  

 


 

  
Performance


  
  • 
    
    
     A Just-In-Time (JIT) compiler has been added to the opcache extension.
     
    
    
   
    • 
   
  • 
    
    
     array_slice() on an array without gaps will no longer scan the whole array
     to find the start offset. This may significantly reduce the runtime of the function with large
     offsets and small lengths.
    
    
   
    • 
   
  • 
    
    
     strtolower() now uses a SIMD implementation when using the
     "C" LC_CTYPE locale (which is the default).
    
    
   
    • 
  



PHP 7.4

    

 
Other Changes


 

  
Performance Improvements


  

   
PHP Core

   

    A specialized VM opcode for the array_key_exists()
    function has been added, which improves performance of this function
    if it can be statically resolved. In namespaced code, this may require
    writing \array_key_exists() or explicitly importing
    the function.
   

  


  

   
Regular Expressions (Perl-Compatible)

   

    When preg_match() in UTF-8 mode ("u" modifier)
    is repeatedly called on the same string (but possibly different offsets),
    it will only be checked for UTF-8 validity once.
   

  

 


 

  
Changes to INI File Handling

  

   zend.exception_ignore_args is a new INI directive
   for including or excluding arguments from stack traces generated
   from exceptions.
  

  

   opcache.preload_user is a new INI directive
   for specifying the user account under which preloading
   code is execute if it would otherwise be run as root (which is not
   allowed for security reasons).
  

 


 

  
Migration to pkg-config

  

   A number of extensions have been migrated to exclusively use pkg-config for the
   detection of library dependencies. Generally, this means that instead of using
   --with-foo-dir=DIR or similar only
   --with-foo is used. Custom library paths can be
   specified either by adding additional directories to PKG_CONFIG_PATH
   or by explicitly specifying compilation options through FOO_CFLAGS
   and FOO_LIBS.
  

  

   The following extensions and SAPIs are affected:
  


  
  • 
    CURL:
    
    • 
      
       --with-curl no longer accepts a directory.
      
     
      • 
    
    • 

   
  • 
    Enchant:
    
    • 
      
       --with-enchant no longer accepts a directory.
      
     
      • 
    
    • 

   
  • 
    FPM:
    
    • 
      
       --with-fpm-systemd now uses only pkg-config
       for libsystem checks. The libsystemd minimum required version is 209.
      
     
      • 
    
    • 

   
  • 
    GD:
    
    • 
      
       --with-gd becomes
       --enable-gd
       (whether to enable the extension at all) and
       --with-external-gd
       (to opt into using an external libgd, rather than the bundled one).
      
     
      • 
     
    • 
      
       --with-png-dir has been removed. libpng is required.
      
     
      • 
     
    • 
      
       --with-zlib-dir has been removed. zlib is required.
      
     
      • 
     
    • 
      
       --with-freetype-dir
       becomes --with-freetype
      
     
      • 
     
    • 
      
       --with-jpeg-dir becomes
       --with-jpeg
      
     
      • 
     
    • 
      
       --with-webp-dir becomes
       --with-webp
      
     
      • 
     
    • 
      
       --with-xpm-dir becomes
       --with-xpm
      
     
      • 
    
    • 

   
  • 
    IMAP:
    
    • 
      
       --with-kerberos-systemd no longer accepts a directory.
      
     
      • 
    
    • 

   
  • 
    Intl:
    
    • 
      
       --with-icu-dir has been removed.
       If --enable-intl is passed,
       then libicu is always required.
      
     
      • 
    
    • 

   
  • 
    LDAP:
    
    • 
      
       --with-ldap-sasl no longer accepts a directory.
      
     
      • 
    
    • 

   
  • 
    Libxml:
    
    • 
      
       --with-libxml-dir has been removed.
      
     
      • 
     
    • 
      
       --enable-libxml becomes
       --with-libxml.
      
     
      • 
     
    • 
      
       --with-libexpat-dir has been renamed to
       --with-expat and no longer accepts a directory.
      
     
      • 
    
    • 

   
  • 
    Litespeed:
    
    • 
      
       --with-litespeed becomes
       --enable-litespeed.
      
     
      • 
    
    • 

   
  • 
    Mbstring:
    
    • 
      
       --with-onig has been removed.
       Unless --disable-mbregex
       has been passed, libonig is required.
      
     
      • 
    
    • 

   
  • 
    ODBC:
    
    • 
      
       --with-iodbc no longer accepts a directory.
      
     
      • 
     
    • 
      
       --with-unixODBC without a directory now uses
       pkg-config (preferred). Directory is still accepted for old versions without libodbc.pc.
      
     
      • 
    
    • 

   
  • 
    OpenSSL:
    
    • 
      
       --with-openssl no longer accepts a directory.
      
     
      • 
    
    • 

   
  • 
    PCRE:
    
    • 
      
       --with-pcre-regex has been removed.
       Instead --with-external-pcre
       is provided to opt into using an external PCRE library, rather
       than the bundled one.
      
     
      • 
    
    • 

   
  • 
    PDO_SQLite:
    
    • 
      
       --with-pdo-sqlite no longer accepts a directory.
      
     
      • 
    
    • 

   
  • 
    Readline:
    
    • 
      
       --with-libedit no longer accepts a directory.
      
     
      • 
    
    • 

   
  • 
    Sodium:
    
    • 
      
       --with-sodium no longer accepts a directory.
      
     
      • 
    
    • 

   
  • 
    SQLite3:
    
    • 
      
       --with-sqlite3 no longer accepts a directory.
      
     
      • 
    
    • 

   
  • 
    XSL:
    
    • 
      
       --with-xsl no longer accepts a directory.
      
     
      • 
    
    • 

   
  • 
    Zip:
    
    • 
      
       --with-libzip has been removed.
      
     
      • 
     
    • 
      
       --enable-zip becomes
       --with-zip.
      
     
      • 
    
    • 

  


 

  
CSV escaping

  

   fputcsv(),
   fgetcsv(),
   SplFileObject::fputcsv(), 
   SplFileObject::fgetcsv(), and
   SplFileObject::setCsvControl()
   now accept an empty string as $escape argument,
   which disables the proprietary PHP escaping mechanism.
  

  

   The behavior of str_getcsv() has been
   adjusted accordingly (formerly, an empty string was identical
   to using the default).
  

  

   SplFileObject::getCsvControl() now may also
   return an empty string for the third array element, accordingly.
  

 


 

  
Data Filtering

  

   The filter extension no longer exposes
   --with-pcre-dir for Unix builds and can now reliably
   be built as shared when using ./configure
  

 


 

  
GD

  

   The behavior of imagecropauto() in the bundled
   libgd has been synced with that of system libgd:
  

  
  • 
    
     IMG_CROP_DEFAULT is no longer falling
     back to IMG_CROP_SIDES
    
   
    • 
   
  • 
    
     Threshold-cropping now uses the algorithm of system libgd
    
   
    • 
  

   The default $mode parameter of
   imagecropauto() has been changed to
   IMG_CROP_DEFAULT; passing -1
   is now deprecated.
  

  

   imagescale() now supports aspect ratio preserving
   scaling to a fixed height by passing -1
   as $new_width.
  

 


 

  
HASH Message Digest Framework

  

   The hash extension cannot be disabled
   anymore and is always an integral part of any PHP build, similar to
   the date extension.
  

 


 

  
Intl

  

   The intl extension
   now requires at least ICU 50.1.
  

  

   ResourceBundle now implements
   Countable.
  

 


 

  
Lightweight Directory Access Protocol

  

   Support for nsldap and umich_ldap has been removed.
  

 


 

  
Libxml

  

   All libxml-based extensions now require libxml 2.7.6 or newer.
  

 


 

  
Multibyte String

  

   The oniguruma library is no longer bundled with PHP, instead libonig needs
   to be available on the system. Alternatively
   --disable-mbregex can be used to disable
   the mbregex component.
  

 


 

  
OPcache

  

   The --disable-opcache-file and
   --enable-opcache-file configure options
   have been removed in favor of the
   opcache.file_cache INI directive.
  

 


 

  
Password Hashing

  

   The password_hash() and
   password_needs_rehash() functions
   now accept nullable string and int for $algo argument.
  

 


 

  
PEAR

  

   Installation of PEAR (including PECL) is no longer enabled by default. It
   can be explicitly enabled using --with-pear.
   This option is deprecated and may be removed in the future.
  

 


 

  
Reflection

  

   The numeric values of the modifier constants
   (IS_ABSTRACT,
   IS_DEPRECATED,
   IS_EXPLICIT_ABSTRACT,
   IS_FINAL,
   IS_IMPLICIT_ABSTRACT,
   IS_PRIVATE,
   IS_PROTECTED,
   IS_PUBLIC, and
   IS_STATIC) on the
   ReflectionClass,
   ReflectionFunction,
   ReflectionMethod,
   ReflectionObject, and
   ReflectionProperty
   classes have changed.
  

 


 

  
SimpleXML

  

   SimpleXMLElement now implements
   Countable.
  

 


 

  
SQLite3

  

   The bundled libsqlite has been removed. To build the
   SQLite3 extension a
   system libsqlite3 ≥ 3.7.4 is now required. To build the
   PDO_SQLite extension
   a system libsqlite3 ≥ 3.5.0 is now required.
  

  

   Serialization and unserialization of SQLite3,
   SQLite3Stmt and SQLite3Result
   is now explicitly forbidden. Formerly, serialization of instances of
   these classes was possible, but unserialization yielded unusable objects.
  

  

   The @param notation can now also be used to
   denote SQL query parameters.
  

 


 

  
Zip

  

   The bundled libzip library has been removed.
   A system libzip >= 0.11 is now necessary to build the
   zip extension.
  

 



PHP 7.3

    

 
Other Changes


 

  
PHP Core


  

   
Set(raw)cookie accepts $option Argument


   

    setcookie() and setrawcookie() now also
    support the following signature:
    

     setcookie(string $name, string $value = "", array $options = []): bool


    where $options is an associative array which may have
    any of the keys "expires", "path",
    "domain", "secure",
    "httponly" and "samesite".
   
  


  

   
New Syslog ini Directives


   

    The following ini Directives have been added to customize logging, if
    error_log is set to
    syslog:
    

syslog.facility


      


       
        Specifies what type of program is logging the message.
       
      


     
     
      

syslog.filter


      


       
        Specifies the filter type to filter the logged messages, with the
        supported filter types - all,
        no-ctrl and ascii.
        Starting with PHP 7.3.8, raw is also available, 
        restoring the way syslog behaved in previous PHP versions.
        This filter will also affect calls to syslog().
       
      


     
     
      

syslog.ident


      


       
        Specifies the ident string which is prepended to every message.
       
      


     
    


  

   
Garbage Collection


   

    The cyclic GC has been
    enhanced, which may result in considerable performance improvements.
   

  


  

   
Miscellaneous


   

    var_export() now exports stdClass
    objects as an array cast to an object ((object) array( ... )), rather
    than using the nonexistent method stdClass::__setState().
   


   

    debug_zval_dump() was changed to display recursive arrays
    and objects in the same way as var_dump(). Now, it doesn't
    display them twice.
   


   

    array_push() and array_unshift() can
    now also be called with a single argument, which is particularly convenient
    wrt. the spread operator.
   

  


 


 

  
Interactive PHP Debugger


  

   The unused constants PHPDBG_FILE,
   PHPDBG_METHOD, PHPDBG_LINENO and
   PHPDBG_FUNC have been removed.
  

 


 

  
FastCGI Process Manager


  

   The getallheaders() function is now also available.
  

 


 

  
Client URL Library


  

   libcurl ≥ 7.15.5 is now required.
  

 


 

  
Data Filtering


  

   FILTER_VALIDATE_FLOAT now also supports a thousand
   option, which defines the set of allowed thousand separator chars.  The default
   ("',.") is fully backward compatible with former PHP versions.
  


  

   FILTER_SANITIZE_ADD_SLASHES has been added as an alias of the
   magic_quotes filter (FILTER_SANITIZE_MAGIC_QUOTES).
   The magic_quotes filter is subject to removal in future versions of PHP.
  

 


 

  
FTP


  

   The default transfer mode has been changed to binary.
  

 


 

  
Internationalization Functions


  

   Normalizer::NONE is deprecated, when PHP is linked with
   ICU ≥ 56.
  


  

   Introduced Normalizer::FORM_KC_CF as
   Normalizer::normalize() argument for
   NFKC_Casefold normalization; available when linked with
   ICU ≥ 56.
  

 


 

  
JavaScript Object Notation


  

   A new flag has been added, JSON_THROW_ON_ERROR, which
   can be used with json_decode() or
   json_encode() and causes these functions to throw the new
   JsonException upon an error, instead of setting the
   global error state that is retrieved with
   json_last_error() and json_last_error_msg().
   JSON_PARTIAL_OUTPUT_ON_ERROR takes precedence over
   JSON_THROW_ON_ERROR.
  

 


 

  
Multibyte String


  

   The configuration option --with-libmbfl is
   no longer available.
  

 


 

  
ODBC (Unified)


  

   Support for ODBCRouter and Birdstep
   including the birdstep.max_links ini directive has been
   removed.
  

 


 

  
OPcache


  

   The opcache.inherited_hack ini directive has been removed.
   The value has already been ignored since PHP 5.3.0.
  

 


 

  
OpenSSL


  

   The min_proto_version and max_proto_version
   ssl stream options as well as related constants for possible TLS protocol values
   have been added.
  

 


 

  
Regular Expressions (Perl-Compatible)


  

   The PCRE extension has been upgraded to
   PCRE2, which may cause minor behavioral changes (for instance, character
   ranges in classes are now more strictly interpreted), and augments the
   existing regular expression syntax.
  


  

   preg_quote() now also escapes the '#'
   character.
  

 


 

  
Microsoft SQL Server and Sybase Functions (PDO_DBLIB)


  

   The attribute PDO::DBLIB_ATTR_SKIP_EMPTY_ROWSETS to enable automatic
   skipping of empty rowsets has been added.
  


  

   The PDO::DBLIB_ATTR_TDS_VERSION attribute which exposes
   the TDS version has been added.
  


  

    DATETIME2 columns are now treated like DATETIME columns.
  

 


 

  
SQLite Functions (PDO_SQLITE)


  

   SQLite3 databases can now be opened in read-only mode by setting the
   new PDO::SQLITE_ATTR_OPEN_FLAGS attribute to
   PDO::SQLITE_OPEN_READONLY.
  

 


 

  
Session Handling


  

   session_set_cookie_params() now also supports the
   following signature:
   

    session_set_cookie_params(array $options): bool


   where $options is an associative array which may have
   any of the keys "lifetime", "path",
   "domain", "secure",
   "httponly" and "samesite". Accordingly,
   the return value of session_get_cookie_params() now also
   has an element with the key "samesite".
   Furthermore, the new session.cookie_samesite ini option to
   set the default of the SameSite directive for cookies has been added. It
   defaults to "" (empty string), so no SameSite directive is
   set. Can be set to "Lax" or "Strict",
   which sets the respective SameSite directive.
  
 


 

  
Tidy


  

   Building against » tidyp is now also
   supported transparently. Since tidyp offers no API to get the release date,
   tidy_get_release() and tidy::getRelease()
   return 'unknown' in this case.
  

 


 

  
XML Parser


  

   The return value of the xml_set_external_entity_ref_handler()
   callback is no longer ignored if the extension has been built against libxml.
   Formerly, the return value has been ignored, and parsing did never stop.
  

 


 

  
Zip


  

   Building against the bundled libzip is discouraged, but still possible by
   adding --without-libzip to the configuration.
  

 


 

  
Zlib Compression


  

   The zlib/level context option for the compress.zlib wrapper to facilitate
   setting the desired compression level has been added.
  

 



PHP 7.2

    

 
Other changes


 

  
Moving of utf8_encode() and utf8_decode()


  

   The utf8_encode() and utf8_decode()
   functions have now been moved to the standard extension as string functions, whereas before 
   the XML extension was required for them to be available.
  

 


 

  
Changes to mail() and mb_send_mail()


  

   The $additional_headers parameter of mail() and
   mb_send_mail() now also accepts an array
   instead of a string.
  

 


 

  
LMDB support


  

   The DBA extension now has support for LMDB.
  

 


 

  
Changes to the PHP build system


  
  • 
    
     Unix: Autoconf 2.64 or greater is now required to build PHP.
    
   
    • 
   
  • 
    
     Unix: --with-pdo-oci configure argument no longer needs 
     the version number of the Oracle Instant Client.
    
   
    • 
   
  • 
    
     Unix: --enable-gd-native-ttf configure argument has been 
     removed. This was not used since PHP 5.5.0.
    
   
    • 
   
  • 
    
     Windows: --with-config-profile configure argument has been 
     added. This can be used to save specific configures, much like the magical 
     config.nice.bat file.
    
   
    • 
  


 

  
Changes to GD


  
  • 
    
     imageantialias() is now also available if compiled with
     a system libgd.
    
   
    • 
   
  • 
    
     imagegd() stores truecolor images as real truecolor
     images. Formerly, they have been converted to palette.
    
   
    • 
  


 

  
Moving MCrypt to PECL


  

   The MCrypt extension has now been moved
   out of the core to PECL. Given the mcrypt library has not seen any updates
   since 2007, its usage is highly discouraged. Instead, either the
   OpenSSL or Sodium
   extension should be used.
  

 


 

  
session_module_name()


  

   Passing "user" to session_module_name()
   now raises an error of level E_RECOVERABLE_ERROR. Formerly,
   this has been silently ignored.
  

 



PHP 7.1

    

 
Other changes


 

  
Notices and warnings on arithmetic with invalid strings


  

   New E_WARNING and E_NOTICE errors
   have been introduced when invalid strings are coerced using operators
   expecting numbers (+ -
   * / **
   % << >>
   | & ^) or their
   assignment equivalents. An E_NOTICE is emitted when the
   string begins with a numeric value but contains trailing non-numeric
   characters, and an E_WARNING is emitted when the string
   does not contain a numeric value.
  


  

   


'1b' + 'something';

   


   
The above example will output:

   


Notice: A non well formed numeric value encountered in %s on line %d
Warning: A non-numeric value encountered in %s on line %d


   

  

 


 

  
Warn on octal escape sequence overflow


  

   Previously, 3-octet octal string escape sequences would overflow silently.
   Now, they will still overflow, but E_WARNING will be
   emitted.
  


  

   


var_dump("\500");

   


   
The above example will output:

   


Warning: Octal escape sequence overflow \500 is greater than \377 in %s on line %d
string(1) "@"


   

  

 


 

  
Inconsistency fixes to $this


  

   Whilst $this is considered a special variable in PHP, it
   lacked proper checks to ensure it wasn't used as a variable name or
   reassigned. This has now been rectified to ensure that
   $this cannot be a user-defined variable, reassigned to a
   different value, or be globalised.
  

 


 

  
Session ID generation without hashing


  

   Session IDs will no longer be hashed upon generation. With this change
   brings about the removal of the following four ini settings:
  


  
  • 
    
     session.entropy_file
    
   
    • 
   
  • 
    
     session.entropy_length
    
   
    • 
   
  • 
    
     session.hash_function
    
   
    • 
   
  • 
    
     session.hash_bits_per_character
    
   
    • 
  

   And the addition of the following two ini settings:
  


  
  • 
    
     session.sid_length - defines the length of the
     session ID, defaulting to 32 characters for backwards compatibility)
    
   
    • 
   
  • 
    
     session.sid_bits_per_character - defines the number
     of bits to be stored per character (i.e. increases the range of characters
     that can be used in the session ID), defaulting to 4 for backwards
     compatibility
    
   
    • 
  


 

  
Changes to INI file handling

  

precision


    


     

       If the value is set to -1, then the dtoa mode 0 is used. The default
       value is still 14.
     

    


   
   
    

serialize_precision


    


     

       If the value is set to -1, then the dtoa mode 0 is used. The value -1 is
       now used by default.
     

    


   
   
    

gd.jpeg_ignore_warning


    


     

       The default of this php.ini setting has been changed to 1, so by
       default libjpeg warnings are ignored.
     

    


   
   
    

opcache.enable_cli


    


     

       The default of this php.ini setting has been changed to 1
       (enabled) in PHP 7.1.2, and back to 0 (disabled) in PHP 7.1.7.
     

    


   
  


 

  
Session ID generation with a CSPRNG only


  

   Session IDs will now only be generated with a CSPRNG.
  

 


 

  
More informative TypeError messages when null is allowed

  

   TypeError exceptions for arg_info type checks will
   now provide more informative error messages. If the parameter type or return
   type accepts null (by either having a default value of null or being a
   nullable type), then the error message will now mention this with a message
   of "must be ... or null" or "must ... or be null."
  

 


PHP 7.0

    

 
Other Changes


 

  
Loosening Reserved Word Restrictions


  

   Globally reserved words as property, constant, and method names within classes,
   interfaces, and traits are now allowed. This reduces the surface of BC breaks
   when new keywords are introduced and avoids naming restrictions on APIs.
  


  

   This is particularly useful when creating internal DSLs with fluent interfaces:
  

  

   


// 'new', 'private', and 'for' were previously unusable
Project::new('Project Name')->private()->for('purpose here')->with('username here');
?>

   


  


  

   The only limitation is that the class keyword still
   cannot be used as a constant name, otherwise it would conflict with the
   class name resolution syntax (ClassName::class).
  

 


 

  
Removal of date.timezone Warning


  

   Previously, a warning was emitted if the
   date.timezone INI setting had not
   been set prior to using any date- or time-based functions. Now, this warning
   has been removed (with
   date.timezone still defaulting to
   UTC).
  

 


PHP 5.2

    

  
New Classes

  

   The following classes were introduced in PHP 5.2.0:
  

  
  • 
    
     DateTime
    
   
    • 
   
  • 
    
     DateTimeZone
    
   
    • 

   
  • 
    
     RegexIterator - extends FilterIterator;
     implements Iterator, Traversable,
     OuterIterator
    
    
     Constants:
    
    
    • 
      
       RegexIterator::ALL_MATCHES
      
     
      • 
     
    • 
      
       RegexIterator::GET_MATCH
      
     
      • 
     
    • 
      
       RegexIterator::MATCH
      
     
      • 
     
    • 
      
       RegexIterator::REPLACE
      
     
      • 
     
    • 
      
       RegexIterator::SPLIT
      
     
      • 
     
    • 
      
       RegexIterator::USE_KEY
      
     
      • 
    
    
     Properties:
    
    
    • 
      
       public replacement
      
     
      • 
    
    
     Methods:
    
    
    • 
      
       RegexIterator::__construct(Iterator it, string regex [, int mode [, int flags [, int preg_flags]]])
       - Create an RegexIterator from another iterator and a regular expression
      
     
      • 
     
    • 
      
       bool RegexIterator::accept()
       - Match (string)current() against regular expression
      
     
      • 
     
    • 
      
       bool RegexIterator::getFlags()
       - Returns current operation flags
      
     
      • 
     
    • 
      
       bool RegexIterator::getMode()
       - Returns current operation mode
      
     
      • 
     
    • 
      
       bool RegexIterator::getPregFlags()
       - Returns current PREG flags (if in use or NULL)
      
     
      • 
     
    • 
      
       bool RegexIterator::setFlags(int new_flags)
       - Set operation flags
      
     
      • 
     
    • 
      
       bool RegexIterator::setMode(int new_mode)
       - Set new operation mode
      
     
      • 
     
    • 
      
       bool RegexIterator::setPregFlags(int new_flags)
       - Set PREG flags
      
     
      • 
    
    • 

   
  • 
    
     RecursiveRegexIterator
    
    
     Constants:
    
    
    • 
      
       RecursiveRegexIterator::ALL_MATCHES
      
     
      • 
     
    • 
      
       RecursiveRegexIterator::GET_MATCH
      
     
      • 
     
    • 
      
       RecursiveRegexIterator::MATCH
      
     
      • 
     
    • 
      
       RecursiveRegexIterator::REPLACE
      
     
      • 
     
    • 
      
       RecursiveRegexIterator::SPLIT
      
     
      • 
     
    • 
      
       RecursiveRegexIterator::USE_KEY
      
     
      • 
    
    
     Methods:
    
    
    • 
      
       RecursiveRegexIterator::__construct(RecursiveIterator it, string regex [, int mode [, int flags [, int preg_flags]]])
       - Create an RecursiveRegexIterator from another recursive iterator and
       a regular expression
      
     
      • 
     
    • 
      
       RecursiveRegexIterator RecursiveRegexIterator::getChildren()
       - Return the inner iterator's children contained in a
       RecursiveRegexIterator
      
     
      • 
     
    • 
      
       bool RecursiveRegexIterator::hasChildren()
       - Check whether the inner iterator's current element has children
      
     
      • 
    
    • 
  
PHP 5.5

    

  
What has changed in PHP 5.5.x

  

   Most improvements in PHP 5.5.x have no impact on existing code.  There are
   a few incompatibilities
   and new features that should
   be considered, and code should be tested before switching PHP
   versions in production environments.
  

  

   For systems being upgraded from an older version of PHP, the relevant
   documentation is available at:
  

  
PHP 5.2

    

  
What has changed in PHP 5.2.x

  

   Most improvements in PHP 5.2.x have no impact on existing code.  There are
   a few incompatibilities
   and new error messages
   that should be considered, and code should be tested before switching PHP
   versions in production environments.
  

  

   If the system is being upgraded from PHP 5.0.x, the manual section titled
   Upgrade Notes for PHP 5.1.x
   should also be read.
  

  

   Similarly, if the system is being upgraded from PHP 4, the manual section
   titled Migrating from PHP 4 to PHP 5
   should be read as well.
  

 
PHP 5.1

    

  
Key PHP 5.1.x features

  

   Some of the key features of PHP 5.1.x include:
  

  
  • 
    
    
     A complete rewrite of date handling code, with improved timezone support.
    
    
   
    • 
   
  • 
    
    
     Significant performance improvements compared to PHP 5.0.X.
    
    
   
    • 
   
  • 
    
    
     PDO extension is now enabled by default.
    
    
   
    • 
   
  • 
    
    
     Over 30 new functions in various extensions and built-in functionality.
    
    
   
    • 
   
  • 
    
    
     Over 400 various bug fixes.
    
    
   
    • 
  
PHP 5.0

    

   
What has changed in PHP 5.0.x

   

    PHP 5 and the integrated Zend Engine 2 have greatly improved PHP's
    performance and capabilities, but great care has been taken to break as
    little existing code as possible. So migrating your code from PHP 4 to 5
    should be very easy. Most existing PHP 4 code should be ready to run
    without changes, but you should still know about the few differences and
    take care to test your code before switching versions in production
    environments.
   

  
PHP 8.3

    

 
Windows Support


 

  
Core


  

   Minimum supported Windows version has been bumped to Windows 8 or
   Windows Server 2012.
  

 



PHP 8.2

    

 
Windows Support


 

  
Core

  

   Windows specific error messages are no longer localized, but instead
   always displayed in English to better match PHP error messages.
  

  

   Preliminary and highly experimental support for building on ARM64 has been added.
  

 


 

  
OCI8

  

   Because building against Oracle Client 10g is no longer supported anyway,
   the configuration option --with-oci8 has been dropped.
   The --with-oci8-11g, --with-oci8-12c and
   --with-oci8-19 configuration options are still supported.
  

 


 

  
Zip

  

   The Zip extension is upgraded to version 1.21.0,
   and is now built as shared library (DLL) by default.
  

 



PHP 7.4

    

 
Windows Support


 

  
configure flags

  

   configure now regards additional CFLAGS and LDFLAGS set as environment
   variables.
  

 


 

  
CTRL handling

  

   CTRL+C and CTRL+BREAK on console can be caught by setting a handler function
   with sapi_windows_set_ctrl_handler().
  

  

   proc_open() on Windows can be passed a
   "create_process_group" option. It is required if the child
   process is supposed to handle CTRL events.
  

 


 

  
OPcache

  

   OPcache now supports an arbitrary number of separate caches per user via the
   INI directive opcache.cache_id.
   All processes with the same cache ID and user share an OPcache instance.
  

 


 

  
stat

  

   The stat implementation has been refactored.
  

  
  • 
    
     An inode number is delivered and is based on the NTFS file index.
    
   
    • 
   
  • 
    
     The device number is now based on the volume serial number.
    
   
    • 
  

   Note that both values are derived from the system and provided as-is on 64-bit
   systems. On 32-bit systems, these values might overflow the 32-bit integer in
   PHP, so they're fake.
  

 


 

  
libsqlite3

  

   libsqlite3 is no longer compiled statically into php_sqlite3.dll
   and php_pdo_sqlite.dll, but rather available as libsqlite3.dll.
   Refer to the installation instructions for SQLite3 and
   PDO_SQLITE, respectively.
  

 



PHP 7.3

    

 
Windows Support


 

  
PHP Core


  

   
More POSIX Conforming File Deletion


   

    File descriptors are opened in shared read/write/delete mode by default.
    This effectively maps the POSIX semantics and allows to
    delete files with handles in use. It is not 100% same, some platform
    differences still persist. After the deletion, the filename entry is
    blocked, until all the opened handles to it are closed.
   

  


 



PHP 7.1

    

 
Windows Support


 

  
Support for long and UTF-8 path

  

    If a web application is UTF-8 conform, no further action is required. For
    applications depending on paths in non UTF-8 encodings for I/O, an explicit
    INI directive has to be set. The encoding INI settings check relies on the
    order in the core:
  

  
  • 
    
     internal_encoding
    
   
    • 
    
  • 
    
     default_charset
    
   
    • 
   
  • 
    
     zend.multibyte
    
   
    • 
  

    Several functions for codepage handling were introduced:
  

      
  • 
        
         sapi_windows_cp_set() to set the default codepage
        
       
    • 
       
  • 
        
         sapi_windows_cp_get() to retrieve the current codepage
        
       
    • 
       
  • 
        
         sapi_windows_cp_is_utf8()
        
       
    • 
       
  • 
        
         sapi_windows_cp_conv() to convert between codepages, using iconv() compatible signature
        
       
    • 
      

   These functions are thread safe.
  

  

    The console output codepage is adjusted depending on the encoding used in
    PHP. Depending on the concrete system OEM codepage, the visible output
    might or might be not correct. For example, in the default cmd.exe and on
    a system with the OEM codepage 437, outputs in codepages 1251, 1252, 1253
    and some others can be shown correctly when using UTF-8. On the same system,
    chars in codepage like 20932 probably won't be shown correctly. This refers
    to the particular system rules for codepage, font compatibility and the
    particular console program used. PHP automatically sets the console codepage
    according to the encoding rules from php.ini. Using alternative consoles
    instead of cmd.exe directly might bring better experience in some cases.
  

  

    Nevertheless be aware, runtime codepage switch after the request start
    might bring unexpected side effects on CLI. The preferable way is php.ini,
    When PHP CLI is used in a console emulator, that doesn't support Unicode,
    it might possibly be required, to avoid changing the console codepage. The
    best way to achieve it is by setting the default or internal encoding to
    correspond the ANSI codepage. Another method is to set the INI directives
    output_encoding and input_encoding to the required codepage, in which case
    however the difference between internal and I/O codepage is likely to cause
    mojibake. In rare cases, if PHP happens to crash gracefully, the original
    console codepage might be not restored. In this case, the chcp command
    can be used, to restore it manually.
  

  

    Special awareness for the DBCS systems - the codepage switch on runtime
    using ini_set() is likely to cause display issues. The difference to the
    non DBCS systems is, that the extended characters require two console cells
    to be displayed. In certain case, only the mapping of the characters into
    the glyph set of the font could happen, no actual font change. This is the
    nature of DBCS systems, the most simple way to prevent display issues is
    to avoid usage of ini_set() for the codepage change.
  

  

    As a result of UTF-8 support in the streams, PHP scripts are not limited
    to ASCII or ANSI filenames anymore. This is supported out of the box on
    CLI. For other SAPI, the documentation for the corresponding server
    is useful.
  

  

    Long paths support is transparent. Paths longer than 260 bytes get
    automatically prefixed with \\?\. The max path length is limited to
    2048 bytes. Be aware, that the path segment limit (basename length) still
    persists.
  

  

    For the best portability, it is strongely recommended to handle filenames,
    I/O and other related topics UTF-8. Additionally, for the console applications,
    the usage of a TrueType font is preferable and the usage of ini_set() for
    the codepage change is discouraged.
  

  

  

  

  

 


 

  
readline


  

   The readline extension is supported
   through the » WinEditLine
   library. Thereby, the interactive CLI shell is
   supported as well (php.exe -a).
  

 


 

  
PHP_FCGI_CHILDREN

  

  PHP_FCGI_CHILDREN is now respected. If this environment variable is 
  defined, the first php-cgi.exe process will exec the specified number 
  of children. These will share the same TCP socket.
  

 


 

  
ftok()

  

   Added support for ftok()
  

 



PHP 5.4

    
PHP 5.3

    

  
New Methods

  

   Several new methods were introduced in 5.3.0:
  


  
Date/Time:

  
Exception:

  
DOM:

  
PDO_FIREBIRD:

  
Reflection:

  
  • 
    
     ReflectionClass::getNamespaceName()
     - Returns the name of namespace where this class is defined.
    
   
    • 
   
  • 
    
     ReflectionClass::getShortName()
     - Returns the short name of this class (without namespace part).
    
   
    • 
   
  • 
    
     ReflectionClass::inNamespace()
     - Returns whether this class is defined in a namespace.
    
   
    • 
   
  • 
    
     ReflectionFunction::getNamespaceName()
     - Returns the name of namespace where this function is defined.
    
   
    • 
   
  • 
    
     ReflectionFunction::getShortName()
     - Returns the short name of the function (without namespace part).
    
   
    • 
   
  • 
    
     ReflectionFunction::inNamespace()
     - Returns whether this function is defined in a namespace.
    
   
    • 
   
  • 
    
     ReflectionProperty::setAccessible()
     - Sets whether non-public properties can be requested.
    
   
    • 
  
SPL:

  
XSL:

  
PHP 5.2

    

  
New Methods

  

   New methods were introduced in 5.2.0:
  


  
dom:

  
soap:

  
spl:

  
Tidy

  
XMLReader

  
zip:

  
PHP 7.4

    

 
Removed Extensions


 

  These extensions have been moved to PECL and are no longer part of the PHP
  distribution. The PECL package versions of these extensions will be created
  according to user demand.
 


 
PHP 5.4

    

  
Removed Extensions

  

   These extensions have been moved to PECL and are no longer part of the PHP
   distribution. The PECL package versions of these extensions will be created
   according to user demand.
  

  
  • 
    
     sqlite
     - Note that ext/sqlite3 and ext/pdo_sqlite are not affected
    
   
    • 
  
PHP 5.3

    

  
Removed Extensions

  

   These extensions have been moved to PECL and are no longer part of the PHP
   distribution. The PECL package versions of these extensions will be created
   according to user demand.
  

  
  • 
    
     dbase
     - No longer maintained
    
   
    • 
   
  • 
    
     fbsql
     - No longer maintained
    
   
    • 
   
  • 
    
     fdf 
     - Maintained
    
   
    • 
   
  • 
    
     ming 
     - Maintained
    
   
    • 
   
  • 
    
     msql
     - No longer maintained
    
   
    • 
   
  • 
    
     ncurses 
     - Maintained
    
   
    • 
   
  • 
    
     sybase
     - Discontinued; use the sybase_ct 
     extension instead
    
   
    • 
   
  • 
    
     mhash
     - Discontinued; use the hash extension
     instead. hash has full mhash
     compatibility; all existing applications using the old functions will
     continue to work.
    
   
    • 
  
PHP 5.2

    

  
Removed Extensions

  

   These extensions have been moved to PECL and are no longer
   part of the PHP distribution.  The PECL package version of
   these extensions will be created according to user demand.
  

  
PHP 5.6

    

 
Other changes to extensions


 

  
cURL


  

   A number of constants marked obsolete in the cURL library have now been
   removed:
  


  
  • 
    
     CURLOPT_CLOSEPOLICY
    
   
    • 
   
  • 
    
     CURLCLOSEPOLICY_CALLBACK
    
   
    • 
   
  • 
    
     CURLCLOSEPOLICY_LEAST_RECENTLY_USED
    
   
    • 
   
  • 
    
     CURLCLOSEPOLICY_LEAST_TRAFFIC
    
   
    • 
   
  • 
    
     CURLCLOSEPOLICY_OLDEST
    
   
    • 
   
  • 
    
     CURLCLOSEPOLICY_SLOWEST
    
   
    • 
  


 

  
OCI8


  
  • 
    
     Support for implicit result sets for Oracle Database 12c has been added
     via the new oci_get_implicit_resultset() function.
    
   
    • 
   
  • 
    
     Using oci_execute($s, OCI_NO_AUTO_COMMIT) for a
     SELECT no longer unnecessarily initiates an internal ROLLBACK during
     connection close.
    
   
    • 
   
  • 
    
     Added DTrace probes controlled by the --enable-dtrace
     configure option.
    
   
    • 
   
  • 
    
     oci_internal_debug() is now a no-op.
    
   
    • 
   
  • 
    
     The phpinfo() output format for OCI8 has changed.
    
   
    • 
  


 

  
Zip


  

   A --with-libzip configure option has been added to use
   a system libzip installation. libzip version 0.11 is required, with 0.11.2
   or later recommended.
  

 


 

  
MySQLi

  

   A new mysqli.rollback_on_cached_plink
   option was added, which controls the rollback behavior of persistent connections.
  

 


 

PHP 5.3

    

  
New Extensions

  

   The following new extensions are added (by default) as of PHP 5.3.0:
  

  
  • 
    
     Enchant
     - An abstraction layer above various spelling libraries
    
   
    • 
   
  • 
    
     Fileinfo
     - An improved and more solid replacement, featuring full BC, for the 
     Mimetype extension, which has been
     removed.
    
   
    • 
   
  • 
    
     INTL
     - Internationalization extension. INTL is a wrapper around the 
     » ICU library.
    
   
    • 
   
  • 
    
     Phar
     - Implementation of PHP-Archive files.
    
   
    • 
   
  • 
    
     SQLite3
     - Support for SQLite version 3 databases.
    
   
    • 
  

   mysqlnd is a new core library shipped with PHP. It is a PHP-specific
   replacement for libmysqlclient. mysqlnd will be used to build the 
   mysql,
   mysqli 
   and PDO_MySQL extensions if libmysqlclient
   isn't found on the system. It may also  be used instead of libmysqlclient even when
   libmysqlclient is present. mysqlnd is recommended for all PHP installations for
   performance reasons.
  

 
PHP 5.2

    

  
New Extensions

  

   The following are new extensions added (by default) as of PHP 5.2.0:
  

  
  • 
    
     Filter
     - validates and filters data, and is designed for use with insecure
     data such as user input. This extension is enabled by default; the
     default mode RAW does not impact input data in any way.
    
   
    • 
   
  • 
    
     JSON
     - implements the JavaScript Object Notation (JSON)
     data interchange format. This extension is enabled by default.
    
   
    • 
   
  • 
    
     Zip
     - enables you to transparently read or write ZIP
     compressed archives and the files inside them.
    
   
    • 
  
PHP 5.1

    

  
Extensions

  

   
Extensions that are gone from the PHP core

   

    One of the first things you're likely to notice when you download PHP 5.1.x
    is that several of the older extensions have disappeared. Those extensions
    that are still actively maintained are available in the PHP Extension
    Community Library (PECL), at
    » https://pecl.php.net/.
   

   
Removed extensions
    
     
Extension
       Alternative/Status
      
ext/cpdf
       pecl/pdflib
      
ext/dbx
       pecl/dbx
      
ext/dio
       pecl/dio
      
ext/fam
       Not actively maintained
      
ext/ingres_ii
       pecl/ingres
      
ext/ircg
       Not actively maintained
      
ext/mcve
       pecl/mcve
      
ext/mnogosearch
       Not actively maintained
      
ext/oracle
       
        ext/oci8 or
        ext/pdo_oci
       
      
ext/ovrimos
       Not actively maintained
      
ext/pfpro
       Not actively maintained
      
ext/w32api
       » pecl/ffi
      
ext/yp
       Not actively maintained
      
ext/activescript
       
        » pecl/activescript
       
      

    Modules in PECL that are not actively maintained (i.e. have not been
    supported for some time, have no active maintainer working on them
    currently, and do not have any PECL package releases), are still available
    in SVN at » https://svn.php.net/viewvc/pecl.
    However, unreleased PHP modules are by their nature unsupported, and your
    mileage may vary when attempting to install or use them.
   

  


  

   
Class constants in new PHP 5.1.x extensions

   

    The Zend Engine 2.1 API allows extension developers to declare class
    constants in object oriented extensions. New extensions written for PHP
    5.1.x, including SPL,
    PDO,
    XMLReader and
    date, have their constants in
    the format PDO::CLASS_CONSTANT rather than in the C
    format PDO_CLASS_CONSTANT in order to minimise
    pollution of the global namespace in PHP.
   

  

 
PHP 7.1

    

 
Changed functions


 

  
PHP Core

  

  
  • 
    
     getopt() has an optional third parameter that exposes
     the index of the next element in the argument vector list to be processed.
     This is done via a by-ref parameter.
    
   
    • 
   
  • 
    
     getenv() no longer requires its parameter. If the
     parameter is omitted, then the current environment variables will be
     returned as an associative array.
    
   
    • 
   
  • 
    
     get_headers() now has an additional parameter to enable
     for the passing of custom stream contexts.
    
   
    • 
   
  • 
    
     output_reset_rewrite_vars() no longer resets session
     URL rewrite variables.
    
   
    • 
   
  • 
    
     parse_url() is now more restrictive and supports
     RFC3986.
    
   
    • 
   
  • 
    
     unpack() now accepts an optional third parameter to
     specify the offset to begin unpacking from.
    
   
    • 
  


 

  
File System

  
  • 
    
     file_get_contents() now accepts a negative seek offset
     if the stream is seekable.
    
   
    • 
   
  • 
    
     tempnam() now emits a notice when falling back to the
     system's temp directory.
    
   
    • 
  


 

  
JSON

  
  • 
    
     json_encode() now accepts a new option,
     JSON_UNESCAPED_LINE_TERMINATORS, to disable the
     escaping of U+2028 and U+2029 characters when
     JSON_UNESCAPED_UNICODE is supplied.
    
   
    • 
  


 

  
Multibyte String

  


 

  
PDO

  
  • 
    
     PDO::lastInsertId() for PostgreSQL will now trigger an error
     when nextval has not been called for the current
     session (the postgres connection).
    
   
    • 
  


 

  
PostgreSQL

  
  • 
    
     pg_last_notice() now accepts an optional parameter to
     specify an operation. This can be done with one of the following new
     constants: PGSQL_NOTICE_LAST,
     PGSQL_NOTICE_ALL, or
     PGSQL_NOTICE_CLEAR.
    
   
    • 
   
  • 
    
     pg_fetch_all() now accepts an optional second parameter
     to specify the result type (similar to the third parameter of
     pg_fetch_array()).
    
   
    • 
   
  • 
    
     pg_select() now accepts an optional fourth parameter to
     specify the result type (similar to the third parameter of
     pg_fetch_array()).
    
   
    • 
  


 

  
Session

  


PHP 7.0

    

 
Changed functions


 

  
PHP Core

  

  




PHP 5.6

    

 
Changed functions


 

  
PHP Core


  
  • 
    
     crypt() will now raise an
     E_NOTICE error if the salt
     parameter is omitted.
    
   
    • 
   
  • 
    
     substr_compare() will now accept 0
     for its length parameter.
    
   
    • 
   
  • 
    
     unserialize() will now fail if passed serialised data
     that has been manipulated to attempt to instantiate an object without
     calling its constructor.
    
   
    • 
  


 

  
cURL


  
  • 
    
     Uploads using the @file syntax are now only supported
     if the CURLOPT_SAFE_UPLOAD option is set to
     false. CURLFile should be used instead.
    
   
    • 
  


 

  
Mcrypt


  
  • 
    
     The source parameter of
     mcrypt_create_iv() now defaults to
     MCRYPT_DEV_URANDOM instead of
     MCRYPT_DEV_RANDOM.
    
   
    • 
  


 

  
OpenSSL


  
  • 
    
     stream_socket_enable_crypto() now allows the
     crypto_type parameter to be optional if the
     stream's SSL context includes the new crypto_type
     option.
    
   
    • 
  


 

  
PostgreSQL


  


 

  
Reflection


  


 

  
XMLReader


  


PHP 5.5

    

  
Changed Functions


  

   
PHP Core


   


  

   
intl


   

 
PHP 5.5

    

  
New Global Constants


  

   
GD


   
  • 
     
      IMG_AFFINE_TRANSLATE
     
    
    • 
    
  • 
     
      IMG_AFFINE_SCALE
     
    
    • 
    
  • 
     
      IMG_AFFINE_ROTATE
     
    
    • 
    
  • 
     
      IMG_AFFINE_SHEAR_HORIZONTAL
     
    
    • 
    
  • 
     
      IMG_AFFINE_SHEAR_VERTICAL
     
    
    • 
    
  • 
     
      IMG_CROP_DEFAULT
     
    
    • 
    
  • 
     
      IMG_CROP_TRANSPARENT
     
    
    • 
    
  • 
     
      IMG_CROP_BLACK
     
    
    • 
    
  • 
     
      IMG_CROP_WHITE
     
    
    • 
    
  • 
     
      IMG_CROP_SIDES
     
    
    • 
    
  • 
     
      IMG_FLIP_BOTH
     
    
    • 
    
  • 
     
      IMG_FLIP_HORIZONTAL
     
    
    • 
    
  • 
     
      IMG_FLIP_VERTICAL
     
    
    • 
    
  • 
     
      IMG_BELL
     
    
    • 
    
  • 
     
      IMG_BESSEL
     
    
    • 
    
  • 
     
      IMG_BICUBIC
     
    
    • 
    
  • 
     
      IMG_BICUBIC_FIXED
     
    
    • 
    
  • 
     
      IMG_BLACKMAN
     
    
    • 
    
  • 
     
      IMG_BOX
     
    
    • 
    
  • 
     
      IMG_BSPLINE
     
    
    • 
    
  • 
     
      IMG_CATMULLROM
     
    
    • 
    
  • 
     
      IMG_GAUSSIAN
     
    
    • 
    
  • 
     
      IMG_GENERALIZED_CUBIC
     
    
    • 
    
  • 
     
      IMG_HERMITE
     
    
    • 
    
  • 
     
      IMG_HAMMING
     
    
    • 
    
  • 
     
      IMG_HANNING
     
    
    • 
    
  • 
     
      IMG_MITCHELL
     
    
    • 
    
  • 
     
      IMG_POWER
     
    
    • 
    
  • 
     
      IMG_QUADRATIC
     
    
    • 
    
  • 
     
      IMG_SINC
     
    
    • 
    
  • 
     
      IMG_NEAREST_NEIGHBOUR
     
    
    • 
    
  • 
     
      IMG_WEIGHTED4
     
    
    • 
    
  • 
     
      IMG_TRIANGLE
     
    
    • 
   


  

  

   
MySQLi


   

    The MYSQLI_SERVER_PUBLIC_KEY option has been added
    for use with mysqli_options().
   

  

 
PHP 5.4

    

  
New Global Constants


  
PHP Core:

  
  • 
    
     ENT_DISALLOWED
    
   
    • 
   
  • 
    
     ENT_HTML401
    
   
    • 
   
  • 
    
     ENT_HTML5
    
   
    • 
   
  • 
    
     ENT_SUBSTITUTE
    
   
    • 
   
  • 
    
     ENT_XML1
    
   
    • 
   
  • 
    
     ENT_XHTML
    
   
    • 
   
  • 
    
     IPPROTO_IP
    
   
    • 
   
  • 
    
     IPPROTO_IPV6
    
   
    • 
   
  • 
    
     IPV6_MULTICAST_HOPS
    
   
    • 
   
  • 
    
     IPV6_MULTICAST_IF
    
   
    • 
   
  • 
    
     IPV6_MULTICAST_LOOP
    
   
    • 
   
  • 
    
     IP_MULTICAST_IF
    
   
    • 
   
  • 
    
     IP_MULTICAST_LOOP
    
   
    • 
   
  • 
    
     IP_MULTICAST_TTL
    
   
    • 
   
  • 
    
     MCAST_JOIN_GROUP
    
   
    • 
   
  • 
    
     MCAST_LEAVE_GROUP
    
   
    • 
   
  • 
    
     MCAST_BLOCK_SOURCE
    
   
    • 
   
  • 
    
     MCAST_UNBLOCK_SOURCE
    
   
    • 
   
  • 
    
     MCAST_JOIN_SOURCE_GROUP
    
   
    • 
   
  • 
    
     MCAST_LEAVE_SOURCE_GROUP
    
   
    • 
  
Curl:

  
  • 
    
     CURLOPT_MAX_RECV_SPEED_LARGE
    
   
    • 
   
  • 
    
     CURLOPT_MAX_SEND_SPEED_LARGE
    
   
    • 
   
LibXML:

  
  • 
    
     LIBXML_HTML_NODEFDTD
    
   
    • 
   
  • 
    
     LIBXML_HTML_NOIMPLIED
    
   
    • 
   
  • 
    
     LIBXML_PEDANTIC
    
   
    • 
   
OpenSSL:

  
  • 
    
     OPENSSL_CIPHER_AES_128_CBC
    
   
    • 
   
  • 
    
     OPENSSL_CIPHER_AES_192_CBC
    
   
    • 
   
  • 
    
     OPENSSL_CIPHER_AES_256_CBC
    
   
    • 
   
  • 
    
     OPENSSL_RAW_DATA
    
   
    • 
   
  • 
    
     OPENSSL_ZERO_PADDING
    
   
    • 
   
Output buffering:

  
  • 
    
     PHP_OUTPUT_HANDLER_CLEAN
    
   
    • 
   
  • 
    
     PHP_OUTPUT_HANDLER_CLEANABLE
    
   
    • 
   
  • 
    
     PHP_OUTPUT_HANDLER_DISABLED
    
   
    • 
   
  • 
    
     PHP_OUTPUT_HANDLER_FINAL
    
   
    • 
   
  • 
    
     PHP_OUTPUT_HANDLER_FLUSH
    
   
    • 
   
  • 
    
     PHP_OUTPUT_HANDLER_FLUSHABLE
    
   
    • 
   
  • 
    
     PHP_OUTPUT_HANDLER_REMOVABLE
    
   
    • 
   
  • 
    
     PHP_OUTPUT_HANDLER_STARTED
    
   
    • 
   
  • 
    
     PHP_OUTPUT_HANDLER_STDFLAGS
    
   
    • 
   
  • 
    
     PHP_OUTPUT_HANDLER_WRITE
    
   
    • 
   
Sessions:

  
  • 
    
     PHP_SESSION_ACTIVE
    
   
    • 
   
  • 
    
     PHP_SESSION_DISABLED
    
   
    • 
   
  • 
    
     PHP_SESSION_NONE
    
   
    • 
   
Streams:

  
  • 
    
     STREAM_META_ACCESS
    
   
    • 
   
  • 
    
     STREAM_META_GROUP
    
   
    • 
   
  • 
    
     STREAM_META_GROUP_NAME
    
   
    • 
   
  • 
    
     STREAM_META_OWNER
    
   
    • 
   
  • 
    
     STREAM_META_OWNER_NAME
    
   
    • 
   
  • 
    
     STREAM_META_TOUCH
    
   
    • 
   
Zlib:

  
  • 
    
     ZLIB_ENCODING_DEFLATE
    
   
    • 
   
  • 
    
     ZLIB_ENCODING_GZIP
    
   
    • 
   
  • 
    
     ZLIB_ENCODING_RAW
    
   
    • 
  
Intl:

  
  • 
    
     U_IDNA_DOMAIN_NAME_TOO_LONG_ERROR
    
   
    • 
   
  • 
    
     IDNA_CHECK_BIDI
    
   
    • 
   
  • 
    
     IDNA_CHECK_CONTEXTJ
    
   
    • 
   
  • 
    
     IDNA_NONTRANSITIONAL_TO_ASCII
    
   
    • 
   
  • 
    
     IDNA_NONTRANSITIONAL_TO_UNICODE
    
   
    • 
   
  • 
    
     INTL_IDNA_VARIANT_2003
    
   
    • 
   
  • 
    
     INTL_IDNA_VARIANT_UTS46
    
   
    • 
   
  • 
    
     IDNA_ERROR_EMPTY_LABEL
    
   
    • 
   
  • 
    
     IDNA_ERROR_LABEL_TOO_LONG
    
   
    • 
   
  • 
    
     IDNA_ERROR_DOMAIN_NAME_TOO_LONG
    
   
    • 
   
  • 
   
     IDNA_ERROR_LEADING_HYPHEN
    
   
    • 
   
  • 
    
     IDNA_ERROR_TRAILING_HYPHEN
    
   
    • 
   
  • 
    
     IDNA_ERROR_HYPHEN_3_4
    
   
    • 
   
  • 
    
     IDNA_ERROR_LEADING_COMBINING_MARK
    
   
    • 
   
  • 
    
     IDNA_ERROR_DISALLOWED
    
   
    • 
   
  • 
    
     IDNA_ERROR_PUNYCODE
    
   
    • 
   
  • 
    
     IDNA_ERROR_LABEL_HAS_DOT
    
   
    • 
   
  • 
    
     IDNA_ERROR_INVALID_ACE_LABEL
    
   
    • 
   
  • 
    
     IDNA_ERROR_BIDI
    
   
    • 
   
  • 
    
     IDNA_ERROR_CONTEXTJ
    
   
    • 
  
Json:

  
  • 
    
     JSON_PRETTY_PRINT
    
   
    • 
   
  • 
    
     JSON_UNESCAPED_SLASHES
    
   
    • 
   
  • 
    
     JSON_NUMERIC_CHECK
    
   
    • 
   
  • 
    
     JSON_UNESCAPED_UNICODE
    
   
    • 
   
  • 
    
     JSON_BIGINT_AS_STRING
    
   
    • 
  
PHP 5.3

    

  
New Global Constants


  
PHP Core:

  
  • 
    
     __DIR__
    
   
    • 
   
  • 
    
     __NAMESPACE__
    
   
    • 
   
  • 
    
     E_DEPRECATED
    
   
    • 
   
  • 
    
     E_USER_DEPRECATED
    
   
    • 
   
  • 
    
     INI_SCANNER_NORMAL
    
   
    • 
   
  • 
    
     INI_SCANNER_RAW
    
   
    • 
   
  • 
    
     PHP_MAXPATHLEN
    
   
    • 
   
  • 
    
     PHP_WINDOWS_NT_DOMAIN_CONTROLLER
    
   
    • 
   
  • 
    
     PHP_WINDOWS_NT_SERVER
    
   
    • 
   
  • 
    
     PHP_WINDOWS_NT_WORKSTATION
    
   
    • 
   
  • 
    
     PHP_WINDOWS_VERSION_BUILD
    
   
    • 
   
  • 
    
     PHP_WINDOWS_VERSION_MAJOR
    
   
    • 
   
  • 
    
     PHP_WINDOWS_VERSION_MINOR
    
   
    • 
   
  • 
    
     PHP_WINDOWS_VERSION_PLATFORM
    
   
    • 
   
  • 
    
     PHP_WINDOWS_VERSION_PRODUCTTYPE
    
   
    • 
   
  • 
    
     PHP_WINDOWS_VERSION_SP_MAJOR
    
   
    • 
   
  • 
    
     PHP_WINDOWS_VERSION_SP_MINOR
    
   
    • 
   
  • 
    
     PHP_WINDOWS_VERSION_SUITEMASK
    
   
    • 
  
cURL:

  
  • 
    
     CURLOPT_PROGRESSFUNCTION
    
   
    • 
  
GD:

  
  • 
    
     IMG_FILTER_PIXELATE
    
   
    • 
  
JSON:

  
  • 
    
     JSON_ERROR_CTRL_CHAR
    
   
    • 
   
  • 
    
     JSON_ERROR_DEPTH
    
   
    • 
   
  • 
    
     JSON_ERROR_NONE
    
   
    • 
   
  • 
    
     JSON_ERROR_STATE_MISMATCH
    
   
    • 
   
  • 
    
     JSON_ERROR_SYNTAX
    
   
    • 
   
  • 
    
     JSON_FORCE_OBJECT
    
   
    • 
   
  • 
    
     JSON_HEX_TAG
    
   
    • 
   
  • 
    
     JSON_HEX_AMP
    
   
    • 
   
  • 
    
     JSON_HEX_APOS
    
   
    • 
   
  • 
    
     JSON_HEX_QUOT
    
   
    • 
  
LDAP:

  
  • 
    
     LDAP_OPT_NETWORK_TIMEOUT
    
   
    • 
  
libxml:

  
  • 
    
     LIBXML_LOADED_VERSION 
    
   
    • 
  
PCRE:

  
  • 
    
     PREG_BAD_UTF8_OFFSET_ERROR
    
   
    • 
  
PCNTL:

  
  • 
    
     BUS_ADRALN
    
   
    • 
   
  • 
    
     BUS_ADRERR
    
   
    • 
   
  • 
    
     BUS_OBJERR
    
   
    • 
   
  • 
    
     CLD_CONTIUNED
    
   
    • 
   
  • 
    
     CLD_DUMPED
    
   
    • 
   
  • 
    
     CLD_EXITED
    
   
    • 
   
  • 
    
     CLD_KILLED
    
   
    • 
   
  • 
    
     CLD_STOPPED
    
   
    • 
   
  • 
    
     CLD_TRAPPED
    
   
    • 
   
  • 
    
     FPE_FLTDIV
    
   
    • 
   
  • 
    
     FPE_FLTINV
    
   
    • 
   
  • 
    
     FPE_FLTOVF
    
   
    • 
   
  • 
    
     FPE_FLTRES
    
   
    • 
   
  • 
    
     FPE_FLTSUB
    
   
    • 
   
  • 
    
     FPE_FLTUND
    
   
    • 
   
  • 
    
     FPE_INTDIV
    
   
    • 
   
  • 
    
     FPE_INTOVF
    
   
    • 
   
  • 
    
     ILL_BADSTK
    
   
    • 
   
  • 
    
     ILL_COPROC
    
   
    • 
   
  • 
    
     ILL_ILLADR
    
   
    • 
   
  • 
    
     ILL_ILLOPC
    
   
    • 
   
  • 
    
     ILL_ILLOPN
    
   
    • 
   
  • 
    
     ILL_ILLTRP
    
   
    • 
   
  • 
    
     ILL_PRVOPC
    
   
    • 
   
  • 
    
     ILL_PRVREG
    
   
    • 
   
  • 
    
     POLL_ERR
    
   
    • 
   
  • 
    
     POLL_HUP
    
   
    • 
   
  • 
    
     POLL_IN
    
   
    • 
   
  • 
    
     POLL_MSG
    
   
    • 
   
  • 
    
     POLL_OUT
    
   
    • 
   
  • 
    
     POLL_PRI
    
   
    • 
   
  • 
    
     SEGV_ACCERR
    
   
    • 
   
  • 
    
     SEGV_MAPERR
    
   
    • 
   
  • 
    
     SI_ASYNCIO
    
   
    • 
   
  • 
    
     SI_KERNEL
    
   
    • 
   
  • 
    
     SI_MESGQ
    
   
    • 
   
  • 
    
     SI_NOINFO
    
   
    • 
   
  • 
    
     SI_QUEUE
    
   
    • 
   
  • 
    
     SI_SIGIO
    
   
    • 
   
  • 
    
     SI_TIMER
    
   
    • 
   
  • 
    
     SI_TKILL
    
   
    • 
   
  • 
    
     SI_USER
    
   
    • 
   
  • 
    
     SIG_BLOCK
    
   
    • 
   
  • 
    
     SIG_SETMASK
    
   
    • 
   
  • 
    
     SIG_UNBLOCK
    
   
    • 
   
  • 
    
     TRAP_BRKPT
    
   
    • 
   
  • 
    
     TRAP_TRACE
    
   
    • 
  
PHP 5.2

    

  
New Global Constants


  
PHP Core:

  
  • 
    
     M_EULER
    
   
    • 
   
  • 
    
     M_LNPI
    
   
    • 
   
  • 
    
     M_SQRT3
    
   
    • 
   
  • 
    
     M_SQRTPI
    
   
    • 
   
  • 
    
     PATHINFO_FILENAME
    
   
    • 
   
  • 
    
     PREG_BACKTRACK_LIMIT_ERROR
    
   
    • 
   
  • 
    
     PREG_BAD_UTF8_ERROR
    
   
    • 
   
  • 
    
     PREG_INTERNAL_ERROR
    
   
    • 
   
  • 
    
     PREG_NO_ERROR
    
   
    • 
   
  • 
    
     PREG_RECURSION_LIMIT_ERROR
    
   
    • 
   
  • 
    
     UPLOAD_ERR_EXTENSION
    
   
    • 
   
  • 
    
     STREAM_SHUT_RD
    
   
    • 
   
  • 
    
     STREAM_SHUT_WR
    
   
    • 
   
  • 
    
     STREAM_SHUT_RDWR
    
   
    • 
  
curl:

  
  • 
    
     CURLE_FILESIZE_EXCEEDED
    
   
    • 
   
  • 
    
     CURLE_FTP_SSL_FAILED
    
   
    • 
   
  • 
    
     CURLE_LDAP_INVALID_URL
    
   
    • 
   
  • 
    
     CURLFTPAUTH_DEFAULT
    
   
    • 
   
  • 
    
     CURLFTPAUTH_SSL
    
   
    • 
   
  • 
    
     CURLFTPAUTH_TLS
    
   
    • 
   
  • 
    
     CURLFTPSSL_ALL
    
   
    • 
   
  • 
    
     CURLFTPSSL_CONTROL
    
   
    • 
   
  • 
    
     CURLFTPSSL_NONE
    
   
    • 
   
  • 
    
     CURLFTPSSL_TRY
    
   
    • 
   
  • 
    
     CURLOPT_FTP_SSL
    
   
    • 
   
  • 
    
     CURLOPT_FTPSSLAUTH
    
   
    • 
   
  • 
    
     CURLOPT_TCP_NODELAY
    
    
     Added in PHP 5.2.1.
    
   
    • 
   
  • 
    
     CURLOPT_TIMEOUT_MS
    
    
     Added in PHP 5.2.3
    
   
    • 
   
  • 
    
     CURLOPT_CONNECTTIMEOUT_MS
    
    
     Added in PHP 5.2.3
    
   
    • 
  
GMP:

  
  • 
    
     GMP_VERSION
    
    
     Added in PHP 5.2.2.
    
   
    • 
  
ming:

  
  • 
    
     SWFTEXTFIELD_USEFONT
    
   
    • 
   
  • 
    
     SWFTEXTFIELD_AUTOSIZE
    
   
    • 
   
  • 
    
     SWF_SOUND_NOT_COMPRESSED
    
   
    • 
   
  • 
    
     SWF_SOUND_ADPCM_COMPRESSED
    
   
    • 
   
  • 
    
     SWF_SOUND_MP3_COMPRESSED
    
   
    • 
   
  • 
    
     SWF_SOUND_NOT_COMPRESSED_LE
    
   
    • 
   
  • 
    
     SWF_SOUND_NELLY_COMPRESSED
    
   
    • 
   
  • 
    
     SWF_SOUND_5KHZ
    
   
    • 
   
  • 
    
     SWF_SOUND_11KHZ
    
   
    • 
   
  • 
    
     SWF_SOUND_22KHZ
    
   
    • 
   
  • 
    
     SWF_SOUND_44KHZ
    
   
    • 
   
  • 
    
     SWF_SOUND_8BITS
    
   
    • 
   
  • 
    
     SWF_SOUND_16BITS
    
   
    • 
   
  • 
    
     SWF_SOUND_MONO
    
   
    • 
   
  • 
    
     SWF_SOUND_STEREO
    
   
    • 
  
openssl:

  
  • 
    
     OPENSSL_VERSION_NUMBER
    
   
    • 
   
  • 
    
     OPENSSL_VERSION_TEXT
    
   
    • 
  
snmp:

  
  • 
    
     SNMP_OID_OUTPUT_FULL
    
   
    • 
   
  • 
    
     SNMP_OID_OUTPUT_NUMERIC
    
   
    • 
  
Semaphore:

  
  • 
    
     MSG_EAGAIN
    
   
    • 
   
  • 
    
     MSG_ENOMSG
    
   
    • 
  
PHP 5.5

    

  
Other changes to extensions


  

   
Intl


   

    The intl extension now requires ICU 4.0
    or later.
   

  

 
PHP 5.4

    

  
Other changes to extensions

  

   Changes in extension behavior, and new features:
  

  
  • 
    
     pdo_mysql
     - Removed support for linking with MySQL client libraries older than 4.1
    
   
    • 
  
  • 
  
   The MySQL extensions mysql,
   mysqli and PDO_mysql
   use mysqlnd as the default library now. It is still possible to use
   libmysqlclient by specifying a path to the configure options.
    
  
    • 
  
  • 
    
     mysqlnd
     - Added named pipes support
    
   
    • 
  
PHP 5.3

    

  
Other changes to extensions

  

   The following extensions can no longer be disabled during build
   configuration:
  

  

   Changes in extension behaviour, and new features:
  

  
  • 
    
     Date and Time
     - The TZ environment variable is no longer used to guess the timezone
    
   
    • 
   
  • 
    
     cURL
     - cURL now supports SSH
    
   
    • 
   
  • 
    
     Network
     - dns_check_record() now returns an extra "entries"
     index, containing the TXT elements.
    
   
    • 
   
  • 
    
     Hash
     - The SHA-224 and salsa hash algorithms are now supported.
    
   
    • 
   
  • 
    
     mbstring
     - Now supports CP850 encoding.
    
   
    • 
   
  • 
    
     OCI8
     - A call to oci_close() on a persistent connection, or a
     variable referencing a persistent connection going out of scope, will now
     roll back any uncommitted transaction. To avoid unexpected behavior,
     explicitly issue a commit or roll back as needed. The old behavior can be
     enabled with the INI directive
     oci8.old_oci_close_semantics.
    
    
     Database Resident Connection Pooling (DRCP) and Fast Application 
     Notification (FAN) are now supported.
    
    
     Oracle External Authentication is now supported (except on Windows).
    
    
     The oci_bind_by_name() function now supports SQLT_AFC
     (aka the CHAR datatype).
    
   
    • 
   
  • 
    
     OpenSSL
     - OpenSSL digest and cipher functions are now supported. It is also 
     now possible to access the internal values of DSA, RSA and DH keys.
    
   
    • 
   
  • 
    
     Session
     - Sessions will no longer store session-files in "/tmp"
     when open_basedir restrictions
     apply, unless "/tmp" is explicitly added to the list of
     allowed paths.
    
   
    • 
   
  • 
    
     SOAP
     Now supports sending user supplied HTTP headers.
    
   
    • 
   
  • 
    
     MySQLi
     Now supports persistent connections, by prepending the hostname with 
     "p:".
    
   
    • 
   
  • 
    
     Image Processing and GD
     The "JPG Support" index returned from gd_info() has
     been renamed to "JPEG Support".
    
   
    • 


  
PHP 5.4

    

  
Other changes

  
  • 
    
     E_ALL now includes E_STRICT level
     errors in the error_reporting configuration directive.
    
   
    • 
   
  • 
    
     SNMP now has an OOP API.
    
    
      Functions now return FALSE on every error condition including SNMP-related
      (no such instance, end of MIB, etc). Thus, in particular, breaks previous behavior
      of get/walk functions returning an empty string on SNMP-related errors.
    
    
      Multi OID get/getnext/set queries are now supported.
    
    
     Dropped UCD-SNMP compatibility code, consider upgrading to net-snmp v5.3+, Net-SNMP v5.4+ is
     required for Windows version.
    
    
     In sake of adding support for IPv6 DNS name resolution of
     remote SNMP agent (peer) is done by extension now, not by Net-SNMP library anymore.
    
   
    • 
   
  • 
    
     OpenSSL now supports AES.
    
   
    • 
   
  • 
    
     CLI SAPI doesn't terminate any
     more on fatal errors when using interactive mode with readline support.
    
   
    • 
   
  • 
    
     $_SERVER['REQUEST_TIME_FLOAT']
     has been added to include microsecond precision.
    
   
    • 
   
  • 
    
     Added new hash algorithms: fnv132, fnv164, joaat
    
   
    • 
   
  • 
    
     Chained string offsets - e.g. $a[0][0] where $a is a string - now work.
    
   
    • 
   
  • 
    
     Arrays cast from SimpleXMLElement now always contain all nodes instead of
     just the first matching node. All SimpleXMLElement children are now always
     printed when using var_dump(), var_export() and
     print_r().
    
   
    • 
   
  • 
    
     It's now possible to enforce the class' __construct arguments in an abstract
     constructor in the base class.
    
   
    • 
  
PHP 5.3

    

  
Other changes

  
  • 
    
     SplFileInfo::getpathinfo() now returns information about 
     the path name.
    
   
    • 
   
  • 
    
     SplObjectStorage now has
     ArrayAccess support. It is now also possible to
     store associative information with objects in
     SplObjectStorage.
    
   
    • 
   
  • 
    
     In the GD extension, there is now pixelation support available through
     the imagefilter() function.
    
   
    • 
   
  • 
    
     var_dump() output now includes private object properties.
    
   
    • 
   
  • 
    
     session_start() now returns FALSE when session startup
     fails.
    
   
    • 
   
  • 
    
     property_exists() now checks the existence of a property
     independent of accessibility (like method_exists()).
    
   
    • 
   
  • 
    
     Stream wrappers can now be used by 
     include_path.
    
   
    • 
   
  • 
    
     The initial parameter for
     array_reduce() can now be of any type.
    
   
    • 
   
  • 
    
     The directory functions
     opendir(), scandir(), and
     dir() now use the default stream context if no explicit
     context is passed.
    
   
    • 
   
  • 
    
     crypt() now has Blowfish and extended DES support, and 
     crypt() features are now 100% portable. PHP has its own 
     internal crypt implementation which drops into place when support for 
     crypt or crypt_r is not found.
    
   
    • 
   
  • 
    
     getopt() now accepts "long options" on all platforms.
     Optional values and = as a separator for short options
     are now supported.
    
   
    • 
   
  • 
    
     fopen() has a new mode option (n),
     which passes O_NONBLOCK to the underlying
     open() system call. Note that this mode is not currently 
     supported on Windows.
    
   
    • 
   
  • 
    
     getimagesize() now supports icon files (.ico).
    
   
    • 
   
  • 
    
     The mhash extension have moved to PECL, but the 
     Hash extension have been modified to support 
     mhash if PHP is compiled with --with-mhash. Note that the 
     Hash extension does not require the mhash library to be available whether or 
     not the mhash emulation is enabled.
    
   
    • 
  
PHP 5.2

    

  
Other Enhancements

  
  • 
    
     Improved memory manager and increased default memory limit.
    
    
     The new memory manager allocates less memory and works faster than the
     previous incarnation. It allocates memory from the system in large blocks,
     and then manages the heap by itself. The memory_limit value in php.ini is
     checked, not for each emalloc() call (as before), but for actual blocks
     requested from the system. This means that memory_limit is far more
     accurate than it used to be, since the old memory manager didn't calculate
     all the memory overhead used by the malloc library.
    
    
     Thanks to this new-found accuracy memory usage may appear to have increased,
     although actually it has not. To accommodate this apparent increase, the
     default memory_limit setting was also increased - from 8 to 16 megabytes.
    
   
    • 
   
  • 
    
     Added support for constructors in interfaces to force constructor signature
     checks in implementations.
    
    
     Starting with PHP 5.2.0, interfaces can have constructors. However, if you choose
     to declare a constructor in an interface, each class implementing that interface
     MUST include a constructor with a signature matching that of the base interface
     constructor. By 'signature' we mean the parameter and return type definitions,
     including any type hints and including whether the data is passed by reference
     or by value.
    
   
    • 
  
PHP 5.4

    

  
Changed Functions

  

   Several functions were given new, optional parameters in PHP 5.4:
  

  
PHP Core:

  
  • 
    
     Added the optional limit parameter to debug_backtrace()
     and debug_print_backtrace(), to limit the amount of stack frames returned.
    
   
    • 
   
  • 
    
     is_link() now works properly for symbolic links on Windows Vista
     or later. Earlier systems do not support symbolic links.
    
   
    • 
   
  • 
    
     parse_url() now recognizes the host when a scheme is omitted, 
     and a leading component separator is present. As of PHP 5.4.7.
    
   
    • 
  
OpenSSL:

  
Intl:

  
  • 
    
     idn_to_ascii() and idn_to_utf8() now take two extra
     parameters, one indicating the variant (IDNA 2003 or UTS #46) and another, passed by reference,
     to return details about the operation in case UTS #46 is chosen.
    
   
    • 
  
PHP 5.3

    

  
New Parameters

  

   Several functions were given new, optional parameters in PHP 5.3:
  

  
PHP Core:

  
json:

  
Streams:

  
sybase_ct:

  

   New method parameters in PHP 5.3.0:
  

  
PHP Core:

  
PHP 5.2

    

  
New Parameters

  

   Some functions were given new, optional, parameters in PHP 5.2.x:
  


  
PHP Core:

  
curl:

  
datetime

  
  • 
    
     date()
     - added "u" (milliseconds) format character in PHP 5.2.2
    
   
    • 
  
imap:

  
mbstring:

  
  • 
    
     mb_strrpos()
     - added offset
    
    
    Warning
     
    
      The offset parameter was put in the position
      the encoding parameter used to be.
      Backward compatibility has been
      provided by allowing encoding to be specified
      as the third parameter.  Using this backward compatibility mode is
      not recommended because it will be removed in a future release of PHP.
     
    
    
    
   
    • 
  
ming:

  
openssl:

  
pgsql:

  
simplexml:

  
spl:

  
  • 
    
     array iterator_to_array(Traversable it [, bool use_keys = true])
     - added use_keys in PHP 5.2.1
    
   
    • 
  
xmlreader:

  
XMLWriter:

  
PHP 5.5

    

  
Changes to INI file handling


  

   
Intl


   

    The intl.use_exceptions configuration directive has
    been added, which controls the behaviour of intl when global errors occur
    in conjunction with the already extant intl.error_level
    configuration directive.
   

  


  

   
MySQLnd


   

    The mysqlnd.sha256_server_public_key
    configuration directive has been added to allow
    mysqli to use the new MySQL
    authentication protocol.
   

  

 
PHP 5.4

    

  
Changes to INI file handling

  

   The following php.ini directives have been removed:
  

  

   The following php.ini directives have been added:
  

  

   The following php.ini directives have been changed:
  

  
PHP 5.3

    

  
Changes to INI file handling

  

   PHP 5.3.0 has significantly improved performance and parsing of INI files,
   and adds several new syntax features.
  

  
  • 
    
     The standard php.ini files have been re-organized and renamed. 
     php.ini-development contains settings recommended
     for use in development environments. php.ini-production
     contains settings recommended for use in production environments.
    
   
    • 
   
  • 
    
     There is now support for two special sections:
     [PATH=/opt/httpd/www.example.com/] and 
     [HOST=www.example.com]. Directives set in these 
     sections cannot be overridden by user-defined INI files or at 
     runtime. More information about these sections can be found 
     here.
    
   
    • 
   
  • 
    
     zend_extension_debug,
     zend_extension_debug_ts
     and zend_extension_ts have
     been removed. Use the
     zend_extension directive to
     load all Zend Extensions.
    
   
    • 
   
  • 
    
     zend.ze1_compatibility_mode
     has been removed. If this INI directive is set to On, an
     E_ERROR error is emitted at startup.
    
   
    • 
   
  • 
    
     It is now possible to use the full path to load modules using the 
     extension directive.
    
   
    • 
   
  • 
    
     "ini-variables" can now be used almost anywhere in a
     php.ini file.
    
   
    • 
   
  • 
    
     open_basedir restrictions may now
     be tighted at runtime, and the directive is now PHP_INI_ALL.
    
   
    • 
   
  • 
    
     It is now possible to use alphanumeric or variable indices in INI option
     arrays.
    
   
    • 
   
  • 
    
     get_cfg_var() is now able to return "array" INI options.
    
   
    • 
   
  • 
    
     Two new mail directives:
     mail.add_x_header and
     mail.log, have been added.
    
   
    • 
  

   The following new ini directives have been added:
  

  
  • 
    
     user_ini.filename and
     user_ini.cache_ttl have been added to control the use
     of user INI files.
    
   
    • 
   
  • 
    
     exit_on_timeout has been added
     to force Apache 1.x children to exit if a PHP execution timeout occurs.
    
   
    • 
   
  • 
    
     Added mbstring.http_output_conv_mimetype. 
     This directive specifies the regex pattern of content types for which 
     mb_output_handler() is activated.
    
   
    • 
   
  • 
    
     Added request_order.
     Allows controlling which external variables will be available in
     $_REQUEST.
    
   
    • 
  

   The following ini directives have new default values:
  

  
PHP 5.3

    

  
New Class Constants

  

   Several new class constants were introduced in 5.3.0:
  


  
PDO_FIREBIRD:

  
  • 
    
     PDO::FB_ATTR_DATE_FORMAT
     - Sets the format for dates.
    
   
    • 
   
  • 
    
     PDO::FB_ATTR_TIME_FORMAT
     - Sets the format for time.
    
   
    • 
   
  • 
    
     PDO::FB_ATTR_TIMESTAMP_FORMAT
     - Sets the format for timestamps.
    
   
    • 
  
PHP 5.2

    

  
New Class Constants


  
pdo:

  
  • 
    
     PDO::ATTR_DEFAULT_FETCH_MODE
    
   
    • 
   
  • 
    
     PDO::FETCH_PROPS_LATE
    
   
    • 
   
  • 
    
     PDO::FETCH_KEY_PAIR
    
    
     Fetches a 2 column result set into an associated array. (Added in PHP 5.2.3)
    
   
    • 
  
spl:

  
  • 
    
     CachingIterator::FULL_CACHE
    
   
    • 
   
  • 
    
     CachingIterator::TOSTRING_USE_INNER
    
   
    • 
   
  • 
    
     SplFileObject::READ_AHEAD
    
   
    • 
   
  • 
    
     SplFileObject::READ_CSV
    
   
    • 
   
  • 
    
     SplFileObject::SKIP_EMPTY
    
   
    • 
  
PHP 5.2

    

  
Changes in PHP datetime
   support


  

   Since PHP 5.1.0, there has been an extension named date
   in the PHP core. This is the new implementation of PHP's datetime support.
   Although it will attempt to guess your system's timezone setting, you
   should set the timezone manually. You can do this in any of three ways:
  

  

   All supported timezones are listed
   in the PHP Manual.
  

  

   With the advent of PHP 5.2.x, there are object representations of the
   date and timezone, named DateTime and DateTimeZone respectively.
   The methods map to existing procedural date functions.
  

 
PHP 5.1

    

  
Date/time support

  

   Date/time support has been fully rewritten in PHP 5.1.x, and no longer uses
   the system settings to 'know' the timezone in operation. It will instead
   utilize, in the following order:
  

  
  • 
    
    
     The timezone set using the date_default_timezone_set()
     function (if any)
    
    
   
    • 
   
  • 
    
    
     The TZ environment variable (if non empty)
    
    
   
    • 
   
  • 
    
    
     "magical" guess (if the operating system supports it)
    
    
   
    • 
   
  • 
    
    
     If none of the above options succeeds, UTC
    
    
   
    • 
  

   

    To ensure accuracy (and avoid an E_STRICT warning),
    you will need to define your timezone in your php.ini
    using the following format:
   

   

    date.timezone = Europe/London
   

  

  

   The supported timezones are listed, in this format, in the
   timezones appendix.
  

  

   Also note that strtotime() now returns FALSE on
   failure, instead of -1. 
  

 
PHP 5.2

    

  
New INI Configuration Directives

  

   New php.ini directives introduced in PHP 5.2.0:
  

  
  • 
    
     allow_url_include
    
    
     This useful option makes it possible to differentiate between
     standard file operations on remote files, and the inclusion of
     remote files.  While the former is usually desirable, the latter can
     be a security risk if used naively.  Starting with PHP 5.2.0, you can
     allow remote file operations while disallowing the inclusion of
     remote files in local scripts.  In fact, this is the default
     configuration.
    
   
    • 
   
  • 
    
     pcre.backtrack_limit
    
    
     PCRE's backtracking limit.
    
   
    • 
   
  • 
    
     pcre.recursion_limit
    
    
     PCRE's recursion limit. Please note that if you set this value to a high
     number you may consume all the available process stack and eventually
     crash PHP (due to reaching the stack size limit imposed by the Operating
     System).
    
   
    • 
   
  • 
    
     session.cookie_httponly
    
    
     Marks the cookie as accessible only through the HTTP protocol. This means
     that the cookie won't be accessible by scripting languages, such as
     JavaScript. This setting can effectively help to reduce identity theft
     through XSS attacks (although it is not supported by all browsers).
    
   
    • 
  

   New directives in PHP 5.2.2:
  

  
PHP 5.0

    

   
New Directives

   

    There were some new php.ini directives introduced in PHP 5. Here is a
    list of them:
   

   
PHP 5.1

    

  
Changes in database support

  

   
PDO overview

   

    PHP Data Objects (PDO) were introduced as a
    PECL extension under PHP 5.0, and became part of the core PHP distribution
    in PHP 5.1.x. The PDO extension provides a consistent interface for database
    access, and is used alongside database-specific PDO drivers. Each driver
    may also have database-specific functions of its own, but basic data
    access functionality such as issuing queries and fetching data is covered
    by PDO functions, using the driver named in
    PDO::__construct().
   

   

    Note that the PDO extension, and its drivers, are intended to be built as
    shared extensions. This will enable straightforward driver upgrades from
    PECL, without forcing you to rebuild all of PHP.
   

   

    At the point of the PHP 5.1.x release, PDO is more than ready for widespread
    testing and could be adopted in most situations. However, it is important
    to understand that PDO and its drivers are comparatively young and may be
    missing certain database-specific features; evaluate PDO carefully before
    you use it in new projects.
   

   

    Legacy code will generally rely on the pre-existing database extensions,
    which are still maintained.
   

  


  

   
Changes in MySQL support

   

    In PHP 4, MySQL 3 support was built-in. With the release of PHP 5.0 there
    were two MySQL extensions, named 'mysql' and 'mysqli', which were designed
    to support MySQL < 4.1 and MySQL 4.1 and up, respectively. With the
    introduction of PDO, which provides a very fast interface to all the
    database APIs supported by PHP, the PDO_MYSQL driver can support any of
    the current versions (MySQL 3, 4 or 5) in PHP code written for PDO,
    depending on the MySQL library version used during compilation. The older
    MySQL extensions remain in place for reasons of back compatibility, but
    are not enabled by default.
   

  


  

   
Changes in SQLite support

   

    In PHP 5.0.x, SQLite 2 support was provided by the built-in sqlite
    extension, which was also available as a PECL extension in PHP 4.3 and PHP
    4.4. With the introduction of PDO, the sqlite extension doubles up to act
    as a 'sqlite2' driver for PDO; it is due to this that the sqlite extension
    in PHP 5.1.x has a dependency upon the PDO extension.
   

   

    PHP 5.1.x ships with a number of alternative interfaces to sqlite:
   

   

    The sqlite extension provides the "classic" sqlite procedural/OO API that
    you may have used in prior versions of PHP. It also provides the PDO
    'sqlite2' driver, which allows you to access legacy SQLite 2 databases
    using the PDO API.
   

   

    PDO_SQLITE provides the 'sqlite' version 3 driver. SQLite version 3 is
    vastly superior to SQLite version 2, but the file formats of the two
    versions are not compatible.
   

   

    If your SQLite-based project is already written and working against
    earlier PHP versions, then you can continue to use ext/sqlite without
    problems, but will need to explicitly enable both PDO and sqlite. New
    projects should use PDO and the 'sqlite' (version 3) driver, as this is
    faster than SQLite 2, has improved locking concurrency, and supports both
    prepared statements and binary columns natively.
   

   

    You must enable PDO to use the SQLite extension. If you want to build the
    PDO extension as a shared extension, then the SQLite extension must also
    be built shared. The same holds true for any extension that provides a PDO
    driver 
   

  

 
PHP 5.0

    

   
Databases

   

    There were some changes in PHP 5 regarding databases (MySQL and SQLite).
   

   

    In PHP 5 the MySQL client libraries are not bundled, because of license
    and maintenance problems. MySQL is supported with the only
    change being that MySQL support is no longer enabled by 
    default in PHP 5.  This essentially means that
    PHP doesn't include the --with-mysql
    option in the configure line so 
    that you must now manually do this when compiling PHP. Windows users will 
    need to edit php.ini and enable the php_mysql.dll
    DLL as in PHP 4 no such DLL existed, it was simply built into your Windows
    PHP binaries.
   

   

    There is also a new extension, MySQLi (Improved
     MySQL), which is designed to work with MySQL 4.1 and above.
   

   

    Since PHP 5, the SQLite extension is
    built-in PHP. SQLite is an embeddable SQL database engine and is not a
    client library used to connect to a big database server (like MySQL or
    PostgreSQL). The SQLite library reads and writes directly to and from the
    database files on disk.
   

  
PHP 5.4

    

  
Changes in SAPI modules

  
  • 
    
     A new SAPI module named cli-server is now available.
    
   
    • 
   
  • 
    
     Added CLI option --rz which shows information of the named Zend extension.
    
   
    • 
   
  • 
    
     Added shortcut #inisetting=value to change php.ini settings at run-time in interactive readline CLI
    
   
    • 
   
  • 
    
     Added apache compatible functions: apache_child_terminate(),
     getallheaders(), apache_request_headers()
     and apache_response_headers() for FastCGI SAPI.
    
   
    • 
   
  • 
    
     PHP-FPM: Added the process.max setting, to control the number
     of processes that FPM can fork.
    
   
    • 
  
PHP 5.3

    

  
Changes in SAPI modules

  
  • 
    
     A new SAPI module named litespeed is now available.
    
   
    • 
   
  • 
    
     FastCGI support in the CGI SAPI is now always enabled and can not be
     disabled. See sapi/cgi/CHANGES for more details.
    
   
    • 
   
  • 
    
     A new CGI SAPI option, -T, can be used to measure
     repeated execution time of a script.
    
   
    • 
   
  • 
    
     CGI/FastCGI now has support for .htaccess-style user-defined php.ini
     files.
    
   
    • 
   
  • 
    
     The dl() function is now disabled by default, and is now
     available only under the CLI, CGI, and embed SAPIs.
    
   
    • 
  
PHP 5.1

    

  
Class and object changes

  

   
instanceof, is_a(),
    is_subclass_of() and catch

   

    In PHP 5.0, is_a() was deprecated and replaced by the
    instanceof operator. There were some issues with the
    initial implementation of instanceof, which relied on
    __autoload() to search for missing classes.
    If the class was not present, instanceof would throw
    a fatal E_ERROR due to the failure of
    __autoload() to discover that class. The same behaviour
    occurred in the catch operator and the
    is_subclass_of() function, for the same reason.
   

   

    None of these functions or operators call __autoload()
    in PHP 5.1.x, and the class_exists() workarounds used
    in code written for PHP 5.0.x, while not problematic in any way, are no
    longer necessary.
   

  


  

   
Abstract private methods

   

    Abstract private methods were supported between PHP 5.0.0 and PHP 5.0.4,
    but were then disallowed on the grounds that the behaviours of
    private and abstract are mutually
    exclusive.
   

  


  

   
Access modifiers in interfaces

   

    Under PHP 5.0, function declarations in interfaces were treated in exactly
    the same way as function declarations in classes. This has not been the
    case since October 2004, at which point only the public
    access modifier was allowed in interface function declarations. Since
    April 2005 - which pre-dates the PHP 5.0b1 release - the
    static modifier has also been allowed. However, the
    protected and private modifiers will
    now throw an E_ERROR, as will
    abstract. Note that this change should not affect your
    existing code, as none of these modifiers makes sense in the context of
    interfaces anyway.
   

  


  

   
Changes in inheritance rules

   

    Under PHP 5.0, it was possible to have a function declaration in a derived
    class that did not match the declaration of the same function in the base
    class, e.g.
   

   

    

     This code will cause an E_STRICT error to be emitted
     under PHP 5.1.x.
    

    



class Base {
    function &return_by_ref() {
        $r = 1;
        return $r;
    }
}

class Derived extends Base {
    function return_by_ref() {
        return 1;
    }
}
?>



    


   

  


  

   
Class constants

   

    Under PHP 5.0.x, the following code was valid:
   

   

    

     Under PHP 5.1.x, redefinition of a class constant will throw a fatal
     E_ERROR.
    

    



class test {
    const foobar = 'foo';
    const foobar = 'bar';
}

?>



    


   

  

 
PHP 5.0

    

   
New Object Model

   

    In PHP 5 there is a new Object Model. PHP's handling of objects has been
    completely rewritten, allowing for better performance and more features.
    In previous versions of PHP, objects were handled like primitive types
    (for instance integers and strings). The drawback of this method was that
    semantically the whole object was copied when a variable was assigned, or
    passed as a parameter to a method. In the new approach, objects are
    referenced by handle, and not by value (one can think of a handle as an
    object's identifier).
   

   

    Many PHP programmers aren't even aware of the copying quirks of the old
    object model and, therefore, the majority of PHP applications will work
    out of the box, or with very few modifications.
   

   

    The new Object Model is documented at the Language Reference.
   

   

    In PHP 5, function with the name of a class is called as a constructor
    only if defined in the same class. In PHP 4, it is called also if defined
    in the parent class.
   

   

    See also the 
    zend.ze1_compatibility_mode directive for compatibility with 
    PHP 4. 
   

  
PHP 5.5

    

  
Changes to PHP Internals


  
  • 
    
     Extensions cannot override zend_execute() any more and
     should override zend_execute_ex() instead.
     EG(current_execute_data) is already initialized in
     zend_execute_ex(), so for compatibility extensions may
     need to use
     EG(current_execute_data)->prev_execute_data instead.
    
   
    • 
   
  • 
    
     Removed EG(arg_types_stack),
     EX(fbc), EX(called_scope) and
     EX(current_object).
    
   
    • 
   
  • 
    
     Added op_array->nested_calls, which is calculated
     at compile time.
    
   
    • 
   
  • 
    
     Added EX(call_slots), which is an array to store
     information about syntaticaly nested calls (e.g.
     foo(bar())) and is preallocated together with
     execute_data.
    
   
    • 
   
  • 
    
     Added EX(call), which is a pointer to a current
     calling function, and is an element of EX(call_slots).
    
   
    • 
   
  • 
    
     Opcodes
     INIT_METHOD_CALL,
     ZEND_INIT_STATIC_METHOD_CALL,
     ZEND_INIT_FCALL_BY_NAME
     and
     ZEND_INIT_NS_FCALL_BY_NAME
     use result.num as an index in
     EX(call_slots).
    
   
    • 
   
  • 
    
     Opcode ZEND_NEW uses
     extended_value as an index in
     EX(call_slots).
    
   
    • 
   
  • 
    
     Opcodes ZEND_DO_FCALL
     and
     ZEND_DO_FCALL_BY_NAME
     use op2.num as an index in
     EX(call_slots).
    
   
    • 
   
  • 
    
     Added op_array->used_stack, which is calculated at
     compile time; the corresponding stack space is preallocated together with
     execute_data. As a result, the ZEND_SEND* and
     ZEND_DO_FCALL* opcodes no longer need to check for stack overflow.
    
   
    • 
   
  • 
    
     Removed execute_data->Ts field. The VM temporary
     variables are always allocated immediately before the
     execute_data structure, and are now accessed by their
     offset from the execute_data base pointer instead of
     via execute_data->Ts.  The compiler stores new
     offsets in op_array->opcodes[*].op?.num.  The
     EX_TMP_VAR() and EX_TMP_VAR_NUM()
     macros can be used to access temporary variables by offset or number. You
     can convert the number to an offset using EX_TMP_VAR_NUM(0,
     num) or offset to number using
     (EX_TMP_VAR_NUM(0,0)-EX_TMP_VAR(0,offset)).
    
   
    • 
   
  • 
    
     Removed the execute_data->CVs field. The VM
     compiled variables are always allocated immediately after the
     execute_data structure, and are now accessed by the
     offset from the execute_data base pointer instead of
     via execute_data->CVs. You can use the
     EX_CV_NUM() macro to access compiled variables by
     number.
    
   
    • 
  
PHP 5.1

    

  
Integer values in function parameters

  

   With the advent of PHP 5.0.x, a new parameter parsing API was introduced
   which is used by a large number of PHP functions. In all versions of PHP
   between 5.0.x and 5.1.x, the handling of integer values was very strict and
   would reject non-well formed numeric values when a PHP function expected an
   integer. These checks have now been relaxed to support non-well formed
   numeric strings such as " 123" and "123 ", and will no longer fail as they
   did under PHP 5.0.x. However, to promote code safety and input validation,
   PHP functions will now emit an E_NOTICE when such
   strings are passed as integers.
  

 
PHP 5.3

    

  
Changes made to Windows support

  

   Changes to the Windows releases:
  

  
  • 
    
     The minimum Windows version is now Windows XP SP3; Windows 98, ME, 2000 and NT4
     are no longer supported.
    
   
    • 
   
  • 
    
     Windows binaries now target i586 and later. i386 and i486 are not
     supported.
    
   
    • 
   
  • 
    
     There is now experimental support for x64 versions of PHP on Windows.
    
   
    • 
   
  • 
    
     There is now compiler support for Visual C++ 9 (VC9), using Visual Studio
     2008. Snapshots and releases will now also be available for VC9. Old
     binaries using VC6 are still supported and released in the line with VC9.
    
   
    • 
   
  • 
    
     The PDO_OCI
     php_pdo_oci8.dll library (for use with Oracle version 8
     client libraries) is no longer being built. Instead, use
     php_pdo_oci.dll (note no '8') with Oracle 10 or 11
     client libraries. Connection to other database versions is still supported.
    
   
    • 
   
  • 
    
     For the OCI8 extension, a new library 
     php_oci8_11g.dll is available in addition to
     php_oci8.dll. Only one can be enabled at any time. Use
     php_oci8.dll with Oracle 10.2 client libraries. Use
     php_oci8_11g.dll with Oracle 11 or later client libraries.
     Connection to other database versions is still supported.
    
   
    • 
  

   Windows support has been added for the following functions:
  

  

   Other changes:
  

  
  • 
    
     Improved portability of the stat(),
     touch(), filemtime(),
     filesize() functions, and other related functions (100%
     portable for the available data).
    
   
    • 
   
  • 
    
     It is now possible to create hard links on Windows using the
     link() function, and symbolic links using the
     symlink() function. Hard links are available as of
     Windows 2000, and symbolic links as of Windows Vista.
    
   
    • 
   
  • 
    
     The Windows version of PHP now exposes a set of constants prefixed 
     PHP_WINDOWS_*. A list of these constants and their usage
     can be found at Predefined Constants.
    
   
    • 
  
Warning
   

    Support for the ISAPI module has been dropped. Use the improved FastCGI SAPI
    module instead.
   

  

  
Note: 
   
    A new dedicated site for PHP on Windows is now available, including
    downloads, release candidates, and snapshots in various flavors
    (thread-safe/not-thread-safe, VC6/VC9, x86/x64). The URL of this site is
    » https://windows.php.net/.
   
  

 
PHP 5.3

    

  
Undeprecated features in PHP 5.3.x

  

   The is_a() function has been undeprecated by popular
   request; it will no longer issue an E_STRICT error.
  

 
PHP 5.2

    

  
Error Reporting

  

   Some of the existing E_ERROR conditions have been
   converted to something that can be caught with a user-defined error
   handler.  If an E_RECOVERABLE_ERROR
   is not handled, it will behave in the same way as
   E_ERROR behaves in all versions of PHP.  Errors of
   this type are logged as Catchable fatal error.
  

  

   This change means that the value of the E_ALL
   error_reporting constant is 
   now 6143, where the previous value was 2047. Because PHP constants have 
   no meaning outside of PHP, in some cases the integer value is used 
   instead so these will need to be adjusted. So for example by
   setting the error_reporting mode from either the
   httpd.conf or the
   .htaccess files, the value has to be changed
   accordingly.  The same applies when the numeric values are used
   rather than the constants in PHP scripts.
  

  

   As a side-effect of a change made to prevent duplicate error messages when
   track_errors is
   On, it is now necessary to return FALSE from
   user defined error handlers in order to populate
   $php_errormsg.  This
   provides a fine-grain control over the levels of messages stored.
  

 
PHP 7.0

    

 
Changes in SAPI Modules


 

  
FPM


  

   

    Unqualified listen ports now listen on both
    IPv4 and IPv6
   


   

    In PHP 5, a listen directive with only a
    port number would listen on all interfaces, but only on IPv4. PHP 7 will
    now accept requests made via both IPv4 and IPv6.
   


   

    This does not affect directives which include specific IP addresses; these
    will continue to only listen on that address and protocol.
   

  

 


PHP 5.0

    

   
Migrating Configuration Files

   

    Since the ISAPI modules changed their names, from php4xxx to php5xxx, you
    need to make some changes in the configuration files. There were also
    changes in the CLI and CGI filenames. Please refer to the corresponding section for more
    information.
   

   

    Migrating the Apache configuration is extremely easy. See the example below
    to check the change you need to do:
    

     
Example #1 Migrating Apache configuration files for PHP 5

     


# change this line:    
LoadModule php4_module /php/sapi/php4apache2.dll

# with this one:
LoadModule php5_module /php/php5apache2.dll



     


    

   
   

    If your web server is running PHP in CGI mode, you should note that the
    CGI version has changed its name from php.exe to
    php-cgi.exe.
    In Apache, you should do something like this:
    

     
Example #2 Migrating Apache configuration files for PHP 5, CGI mode

     


# change this line:    
Action application/x-httpd-php "/php/php.exe" 

# with this one:
Action application/x-httpd-php "/php/php-cgi.exe"



     


    

   
   

    In other web servers you need to change either the CGI or the ISAPI module
    filenames.
   

  
PHP 5.1

    

  
Reading []

  

   



class XmlTest {

    function test_ref(&$test) {
        $test = "ok";
    }

    function test($test) { }

    function run() {
        $ar = array();
        $this->test_ref($ar[]);
        var_dump($ar);
        $this->test($ar[]);
    }
}

$o = new XmlTest();
$o->run();
?>



   


  

  

   This should always have thrown a fatal E_ERROR,
   because [] cannot be used for reading in PHP. It is invalid code in
   PHP 4.4.2 and PHP 5.0.5 upward.
  

 
PHP 5.1

    

  
Changes in reference handling

  

   
Overview

   

    From the PHP script writer's point of view, the change most likely to
    impact legacy code is in the way that references are handled in all PHP
    versions post-dating the PHP 4.4.0 release.
   

   

    Until and including PHP 4.3, it was possible to send, assign or return
    variables by reference that should really be returned by value, such as
    a constant, a temporary value (e.g. the result of an expression), or the
    result of a function that had itself been returned by value, as here:
   

   

    



$foo = "123";

function return_value() {
    global $foo;
    return $foo;
}

$bar = &return_value();
?>



    


   

   

    Although this code would usually work as expected under PHP 4.3, in the
    general case the result is undefined. The Zend Engine could not act
    correctly on these values as references. This bug could and did lead to
    various hard-to-reproduce memory corruption problems, particularly
    where the code base was large.
   

   

    In PHP 4.4.0, PHP 5.0.4 and all subsequent PHP releases, the Engine was
    fixed to 'know' when the reference operation is being used on a value
    that should not be referenced. The actual value is now used in such
    cases, and a warning is emitted. The warning takes the form of an
    E_NOTICE in PHP 4.4.0 and up, and
    E_STRICT in PHP 5.0.4 and up.
   

   

    Code that could potentially produce memory corruption can no longer do
    so. However, some legacy code might work differently as a result.
   

  


  

   
Code that worked under PHP 4.3, but now fails

   

    



function func(&$arraykey) {
    return $arraykey; // function returns by value!
}

$array = array('a', 'b', 'c');
foreach (array_keys($array) as $key) {
    $y = &func($array[$key]);
    $z[] =& $y;
}

var_dump($z);
?>
<


    


    

     Running the above script under any version of PHP that pre-dates the
     reference fix would produce this output:
    

    


array(3) {
  [0]=>
  &string(1) "a"
  [1]=>
  &string(1) "b"
  [2]=>
  &string(1) "c"
}


    

    

     Following the reference fix, the same code would result in:
    

    


array(3) {
  [0]=>
  &string(1) "c"
  [1]=>
  &string(1) "c"
  [2]=>
  &string(1) "c"
}


    

   

   

    This is because, following the changes, func()
    assigns by value. The value of $y is re-assigned,
    and reference-binding is preserved from $z. Prior to
    the fix, the value was assigned by reference, leading $y
    to be re-bound on each assignment. The attempt to bind to a temporary
    value by reference was the cause of the memory corruption.
   

   

    Such code can be made to work identically in both the pre-fix and the
    post-fix PHP versions. The signature of func() can
    be altered to return by reference, or the reference assignment can be
    removed from the result of func().
   

   

    



function func() {
    return 'function return';
}

$x = 'original value';
$y =& $x;
$y = &func();
echo $x;
?>



    


   

   

    In PHP 4.3 $x would be 'original value', whereas after
    the changes it would be 'function return' - remember that where the
    function does not return by reference, the reference assignment is
    converted to a regular assignment. Again, this can be brought to a common
    base, either by forcing func() to return by reference
    or by eliminating the by-reference assignment.
   

  


  

   
Code that worked under PHP 4.3.x, but now throws an error

   

    



class Foo {

    function getThis() {
        return $this;
    }

    function destroyThis() {
        $baz =& $this->getThis();
    }
}

$bar = new Foo();
$bar->destroyThis();
var_dump($bar);
?>



    


   

   

    In PHP 5.0.3, $bar evaluated to NULL
    instead of returning an object. That happened because
    getThis() returns by value, but the value here is
    assigned by reference. Although it now works in the expected way, this is
    actually invalid code which will throw an E_NOTICE
    under PHP 4.4 or an E_STRICT under PHP 5.0.4 and up.
   

  


  

   
Code that failed under PHP 4.3.x, but now works

   

    



function &f() {
    $x = "foo";
    var_dump($x);
    print "$x\n";
    return($a);
}

for ($i = 0; $i < 3; $i++) {
    $h = &f();
}
?>



    


    

     In PHP 4.3 the third call to var_dump() produces
     NULL, due to the memory corruption caused by
     returning an uninitialized value by reference. This is valid code
     in PHP 5.0.4 and up, but threw errors in earlier releases of PHP.
    

   

   

    



$arr = array('a1' => array('alfa' => 'ok'));
$arr =& $arr['a1'];
echo '-'.$arr['alfa']."-\n";
?>



    


    

     Until PHP 5.0.5, it wasn't possible to assign an array element by
     reference in this way. It now is.
    

   

  


  

   
Code that should have worked under PHP 5.0.x

   

    There are a couple of instances of bugs reported under PHP 5.0 prior to
    the reference fixes which now 'work'. However, in both cases errors are
    thrown by PHP 5.1.x, because the code was invalid in the first place.
    Returning values by reference using self:: now works
    in the general case but throws an E_STRICT warning,
    and although your mileage may vary when assigning by reference to an
    overloaded object, you will still see an E_ERROR
    when you try it, even where the assignment itself appears to work.
   

  


  

   
Warnings that came and went

   

    Nested calls to functions returning by reference are valid code under both
    PHP 4.3.x and PHP 5.1.x, but threw an unwarranted
    E_NOTICE or E_STRICT under the
    intervening PHP releases.
   

   

    



function & foo() {
    $var = 'ok';
    return $var;
}

function & bar() {
    return foo();
}

$a =& bar();
echo "$a\n";
?>



    


   

  

 
PHP 5.0

    

   
CLI and CGI

   

    In PHP 5 there were some changes in CLI and CGI filenames. In PHP 5, the
    CGI version was renamed to php-cgi.exe (previously
    php.exe) and the CLI version now sits in the main
    directory (previously cli/php.exe).
   

   

    In PHP 5 it was also introduced a new mode:
    php-win.exe. This is equal to the CLI version, except
    that php-win doesn't output anything and thus provides no console (no "dos
    box" appears on the screen). This behavior is similar to php-gtk.
   

   

    In PHP 5, the CLI version will always populate the global 
    $argv and $argc variables regardless
    of any php.ini directive setting.  Even having  
    register_argc_argv set to
    off will have no affect in CLI.
   

   

    See also the command line 
    reference.
   

  
PHP 5.6

    

 
OpenSSL changes in PHP 5.6.x


 

  
Stream wrappers now verify peer certificates and host names by default when using SSL/TLS


  
   

    All encrypted client streams now enable peer verification by default. By
    default, this will use OpenSSL's default CA bundle to verify the peer
    certificate. In most cases, no changes will need to be made to communicate
    with servers with valid SSL certificates, as distributors generally
    configure OpenSSL to use known good CA bundles.
   


   

    The default CA bundle may be overridden on a global basis by setting
    either the openssl.cafile or openssl.capath configuration setting, or on a
    per request basis by using the
    cafile or
    capath
    context options.
   


   

    While not recommended in general, it is possible to disable peer
    certificate verification for a request by setting the
    verify_peer
    context option to false, and to disable peer name validation by setting
    the verify_peer_name
    context option to false.
   


 


 

  
Certificate fingerprints


  

   Support has been added for extracting and verifying certificate
   fingerprints. openssl_x509_fingerprint() has been added
   to extract a fingerprint from an X.509 certificate, and two
   SSL stream context options have been
   added: capture_peer_cert to capture the peer's X.509
   certificate, and peer_fingerprint to assert that the
   peer's certificate should match the given fingerprint.
  

 


 

  
Default ciphers updated


  

   The default ciphers used by PHP have been updated to a more secure list
   based on the
   » Mozilla cipher recommendations,
   with two additional exclusions: anonymous Diffie-Hellman ciphers, and RC4.
  


  

   This list can be accessed via the new
   OPENSSL_DEFAULT_STREAM_CIPHERS constant, and can be
   overridden (as in previous PHP versions) by setting the
   ciphers
   context option.
  

 


 

  
Compression disabled by default


  

   SSL/TLS compression has been disabled by default to mitigate the CRIME
   attack. PHP 5.4.13 added a
   disable_compression
   context option to allow compression to be disabled: this is now set to
   true (that is, compression is disabled) by default.
  

 


 

  
Allow servers to prefer their cipher order


  

   The honor_cipher_order SSL context option has been
   added to allow encrypted stream servers to mitigate BEAST vulnerabilities
   by preferring the server's ciphers to the client's.
  

 


 

  
Access the negotiated protocol and cipher


  

   The protocol and cipher that were negotiated for an encrypted stream can
   now be accessed via stream_get_meta_data() or
   stream_context_get_options() when the
   capture_session_meta SSL context option is set to
   true.
  


  

   


$ctx = stream_context_create(['ssl' => [
'capture_session_meta' => TRUE
]]);

$html = file_get_contents('https://google.com/', FALSE, $ctx);
$meta = stream_context_get_options($ctx)['ssl']['session_meta'];
var_dump($meta);
?>

   


   
The above example will output:

   


array(4) {
  ["protocol"]=>
  string(5) "TLSv1"
  ["cipher_name"]=>
  string(20) "ECDHE-RSA-AES128-SHA"
  ["cipher_bits"]=>
  int(128)
  ["cipher_version"]=>
  string(11) "TLSv1/SSLv3"
}


   

  

 


 

  
New options for perfect forward secrecy in encrypted stream servers


  

   Encrypted client streams already support perfect forward secrecy, as it is
   generally controlled by the server. PHP encrypted server streams using
   certificates capable of perfect forward secrecy do not need to take any
   additional action to enable PFS; however a number of new SSL context options
   have been added to allow more control over PFS and deal with any
   compatibility issues that may arise. 
  


  

ecdh_curve


    


     

      This option allows the selection of a specific curve for use with ECDH
      ciphers. If not specified, prime256v1 will be used.
     

    


   
   
    

dh_param


    


     

      A path to a file containing parametrs for Diffie-Hellman key exchange,
      such as that created by the following command:
     

     


openssl dhparam -out /path/to/my/certs/dh-2048.pem 2048



     


    


   
   
    

single_dh_use


    


     

      If set to true, a new key pair will be created when using
      Diffie-Hellman parameters, thereby improving forward secrecy.
     

    


   
   
    

single_ecdh_use


    


     

      If set to true, a new key pair will always be generated when ECDH
      cipher suites are negotiated. This improves forward secrecy.
     

    


   
  


 

  
SSL/TLS version selection


  

   It is now possible to select specific versions of SSL and TLS via the
   crypto_method SSL context option or by specifying a
   specific transport when creating a stream wrapper (for example, by calling
   stream_socket_client() or
   stream_socket_server()).
  


  

   The crypto_method SSL context option accepts a
   bitmask enumerating the protocols that are permitted, as does the
   crypto_type of
   stream_socket_enable_crypto().
   
  


  
Selected protocol versions and corresponding options
   
Protocol(s)
   Client flag
   Server flag
   Transport
   
Any TLS or SSL version
    STREAM_CRYPTO_METHOD_ANY_CLIENT
    STREAM_CRYPTO_METHOD_ANY_SERVER
    ssl://
   
Any TLS version
    STREAM_CRYPTO_METHOD_TLS_CLIENT
    STREAM_CRYPTO_METHOD_TLS_SERVER
    tls://
   
TLS 1.0
    STREAM_CRYPTO_METHOD_TLSv1_0_CLIENT
    STREAM_CRYPTO_METHOD_TLSv1_0_SERVER
    tlsv1.0://
   
TLS 1.1
    STREAM_CRYPTO_METHOD_TLSv1_1_CLIENT
    STREAM_CRYPTO_METHOD_TLSv1_1_SERVER
    tlsv1.1://
   
TLS 1.2
    STREAM_CRYPTO_METHOD_TLSv1_2_CLIENT
    STREAM_CRYPTO_METHOD_TLSv1_2_SERVER
    tlsv1.2://
   
SSL 3
    STREAM_CRYPTO_METHOD_SSLv3_CLIENT
    STREAM_CRYPTO_METHOD_SSLv3_SERVER
    sslv3://
   

   



// Requiring TLS 1.0 or better when using file_get_contents():
$ctx = stream_context_create([
'ssl' => [
'crypto_method' => STREAM_CRYPTO_METHOD_TLS_CLIENT,
    ],
]);
$html = file_get_contents('https://google.com/', false, $ctx);

// Requiring TLS 1.1 or 1.2:
$ctx = stream_context_create([
'ssl' => [
'crypto_method' => STREAM_CRYPTO_METHOD_TLSv1_1_CLIENT |
STREAM_CRYPTO_METHOD_TLSv1_2_CLIENT,
    ],
]);
$html = file_get_contents('https://google.com/', false, $ctx);

// Connecting using the tlsv1.2:// stream socket transport.
$sock = stream_socket_client('tlsv1.2://google.com:443/');

?>

   


  

 


 

  
openssl_get_cert_locations() added


  

   The openssl_get_cert_locations() function has been
   added: it returns the default locations PHP will search when looking for
   CA bundles.
  


  

   


var_dump(openssl_get_cert_locations());
?>

   


   
The above example will output:

   


array(8) {
  ["default_cert_file"]=>
  string(21) "/etc/pki/tls/cert.pem"
  ["default_cert_file_env"]=>
  string(13) "SSL_CERT_FILE"
  ["default_cert_dir"]=>
  string(18) "/etc/pki/tls/certs"
  ["default_cert_dir_env"]=>
  string(12) "SSL_CERT_DIR"
  ["default_private_dir"]=>
  string(20) "/etc/pki/tls/private"
  ["default_default_cert_area"]=>
  string(12) "/etc/pki/tls"
  ["ini_cafile"]=>
  string(0) ""
  ["ini_capath"]=>
  string(0) ""
}


   

  

 


 

  
SPKI support


  

   Support has been added for generating, extracting and verifying signed
   public key and challenges (SPKAC). openssl_spki_new(),
   openssl_spki_verify(),
   openssl_spki_export_challenge(), and
   openssl_spki_export() have been added to create, verify
   export PEM public key and associated challenge from
   SPKAC's generated from a KeyGen HTML5 element.
  


  

openssl_spki_new


    


     

      Generates a new SPKAC using private key, challenge string and hashing
      algorithm.
     


     

      


$pkey = openssl_pkey_new();
openssl_pkey_export($pkey, 'secret passphrase');

$spkac = openssl_spki_new($pkey, 'challenge string');
?>

      


      
The above example will output:

      


SPKAC=MIIBXjCByDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA3L0IfUijj7+A8CPC8EmhcdNoe5fUAog7OrBdhn7EkxFButUp40P7+LiYiygYG1TmoI/a5EgsLU3s9twEz3hmgY9mYIqb/rb+SF8qlD/K6KVyUORC7Wlz1Df4L8O3DuRGzx6/+3jIW6cPBpfgH1sVuYS1vDBsP/gMMIxwTsKJ4P0CAwEAARYkYjViMzYxMTktNjY5YS00ZDljLWEyYzctMGZjNGFhMjVlMmE2MA0GCSqGSIb3DQEBAwUAA4GBAF7hu0ifzmjonhAak2FhhBRsKFDzXdKIkrWxVNe8e0bZzMrWOxFM/rqBgeH3/gtOUDRS5Fnzyq425UsTYbjfiKzxGeCYCQJb1KJ2V5Ij/mIJHZr53WYEXHQTNMGR8RPm7IxwVXVSHIgAfXsXZ9IXNbFbcaLRiSTr9/N4U+MXUWL7


      

     

    


   

   
    

openssl_spki_verify


    


     

      Verifies provided SPKAC.
     


     

      


$pkey = openssl_pkey_new();
openssl_pkey_export($pkey, 'secret passphrase');

$spkac = openssl_spki_new($pkey, 'challenge string');
var_dump(openssl_spki_verify($spkac));
?>

      


     

    


   

   
    

openssl_spki_export_challenge


    


     

      Exports associated challenge from provided SPKAC.
     


     

      


$pkey = openssl_pkey_new();
openssl_pkey_export($pkey, 'secret passphrase');

$spkac = openssl_spki_new($pkey, 'challenge string');
$challenge = openssl_spki_export_challenge($spkac);
echo $challenge;
?>

      


      
The above example will output:

      


challenge string


      

     

    


   

   
    

openssl_spki_export


    


     

      Exports the PEM formatted RSA public key from SPKAC.
     


     

      


$pkey = openssl_pkey_new();
openssl_pkey_export($pkey, 'secret passphrase');

$spkac = openssl_spki_new($pkey, 'challenge string');
echo openssl_spki_export($spkac);
?>

      


      
The above example will output:

      


-----BEGIN PUBLIC KEY-----
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDcvQh9SKOPv4DwI8LwSaFx02h7
l9QCiDs6sF2GfsSTEUG61SnjQ/v4uJiLKBgbVOagj9rkSCwtTez23ATPeGaBj2Zg
ipv+tv5IXyqUP8ropXJQ5ELtbXPUN/gvw7cO5EbPHr/7eMhbpw8Gl+AfWxW5hLW8
MGw/+AwwjHBOwong/QIDAQAB
-----END PUBLIC KEY-----


      

     

    


   
  


PHP 5.3

    

  
New stream filters

  

   The following stream filters were introduced in 5.3.0:
  

  
  • 
    
     dechunk (reverses HTTP chunked encoding)
    
   
    • 
   
  • 
    
     The bz2.decompress filter now supports concatenation.
    
   
    • 
  
PHP 7.0

    

 
Removed Extensions and SAPIs


 

  
Removed Extensions


  
  • 
    
     ereg
    
   
    • 
   
  • 
    
     mssql
    
   
    • 
   
  • 
    
     mysql
    
   
    • 
   
  • 
    
     sybase_ct
    
   
    • 
  


 

  
Removed SAPIs


  
  • 
    
     aolserver
    
   
    • 
   
  • 
    
     apache
    
   
    • 
   
  • 
    
     apache_hooks
    
   
    • 
   
  • 
    
     apache2filter
    
   
    • 
   
  • 
    
     caudium
    
   
    • 
   
  • 
    
     continuity
    
   
    • 
   
  • 
    
     isapi
    
   
    • 
   
  • 
    
     milter
    
   
    • 
   
  • 
    
     nsapi
    
   
    • 
   
  • 
    
     phttpd
    
   
    • 
   
  • 
    
     pi3web
    
   
    • 
   
  • 
    
     roxen
    
   
    • 
   
  • 
    
     thttpd
    
   
    • 
   
  • 
    
     tux
    
   
    • 
   
  • 
    
     webjames
    
   
    • 
  


PHP 5.1

    

  
Checking for E_STRICT

  

   

    If you only have a single script to check, you can pick up
    E_STRICT errors using PHP's commandline lint
    facility:
   

   
php -d error_reporting=4095 -l script_to_check.php




   

    For larger projects, the shell script below will achieve the same task:
   

   


#!/bin/sh

directory=$1

shift

# These extensions are checked
extensions="php inc"

check_file ()
{
  echo -ne "Doing PHP syntax check on $1 ..."

  # Options:
  ERRORS=`/www/php/bin/php -d display_errors=1 -d html_errors=0 -d error_prepend_string=" " -d error_append_string=" " -d error_reporting=4095 -l $1 | grep -v "No syntax errors detected"`

  if test -z "$ERRORS"; then
    echo -ne "OK."
  else
    echo -e "Errors found!\n$ERRORS"
  fi

  echo
}

# loop over remaining file args
for FILE in "$@" ; do
  for ext in $extensions; do
     if echo $FILE | grep "\.$ext$" > /dev/null; then
       if test -f $FILE; then
         check_file "$FILE"
       fi
     fi
  done
done



   


  

 
PHP 5.2

    

  
New Error Messages

  

   Below are the new error messages that have not been discussed 
   elsewhere in this document.
  

  

   

    
Example #1 In PHP Core

    



echo " ";
session_regenerate_id();
/*  Warning:  session_regenerate_id(): Cannot regenerate
    session id - headers already sent in filename on line n */

str_word_count("string", 4);
/* Warning:  str_word_count(): Invalid format value 4
   in filename on line n */

strripos("foo", "f", 4);
/* Notice:  strripos(): Offset is greater than the
   length of haystack string in filename on line n */

strrpos("foo", "f", 4);
/* Notice:  strrpos(): Offset is greater than the
   length of haystack string in filename on line n */

/* As of PHP 5.2.1, when allow_url_include is OFF (default) */
include "php://input";
/* Warning:  include(): URL file-access is disabled
   in the server configuration in filename on line n */
?>



    


   

  
  

   

    
Example #2 Object Oriented Code in PHP Core

    



interface foo {
}
class bar implements foo, foo {
}
/* Fatal error: Class bar cannot implement previously
   implemented interface foo in filename on line n */


class foo {
    public $bar;
    function __get($var)
    {
        return $this->bar;
    }
}

$foo = new foo;
$bar =& $foo->prop;
/* Notice: Indirect modification of overloaded property
   foo::$prop has no effect in filename on line n */


class foo implements iterator {
    public function current() {
    }
    public function next() {
    }
    public function key() {
    }
    public function valid() {
    }
    public function rewind() {
    }
}

$foo = new foo();
foreach($foo as &$ref) {}
/* Fatal error: An iterator cannot be used with foreach
   by reference in filename on line n */


class foo {
    private function __construct() {
    }
}
class bar extends foo {
    public function __construct() {
        parent::__construct();
        /* Fatal error:  Cannot call private
           foo::__construct() in filename on line n */
    }
}
new bar;


stream_filter_register("", "class");
/* Warning:  stream_filter_register(): Filter name
   cannot be empty in filename on line n */


stream_filter_register("filter", "");
/* Warning:  stream_filter_register(): Class name
   cannot be empty in filename on line n */
?>



    


   

  
  

   

    
Example #3 In the bzip2 Extension

    



bzopen("", "w");
/* Warning:  bzopen(): filename cannot be empty
   in filename on line n */

bzopen("foo", "a");
/* Warning:  bzopen(): 'a' is not a valid mode for
   bzopen(). Only 'w' and 'r' are supported in
   filename on line n */

$fp = fopen("foo", "w");
bzopen($fp, "r");
/* Warning:  bzopen(): cannot read from a stream
   opened in write only mode in filename on line n */
?>



    


   

  
  

   

    
Example #4 In the datetime Extension

    



strtotime("today", "now");
/* Warning:  strtotime() expects parameter 2 to be
   long, string given in filename on line n */

/* As of PHP 5.2.1 */
new DateTime(new stdclass);
/* Fatal error: Uncaught exception 'Exception' with
   message 'DateTime::__construct() expects parameter
   1 to be string, object given' in filename:n */
?>



    


   

  
  

   

    
Example #5 In the dBase Extension

    



dbase_open("foo", -1);
/* Warning: Invalid access mode -1 in filename on line n */

/* As of PHP 5.2.1 */
dbase_open("foo", null);
/* Warning: The filename cannot be empty in filename on line n */
?>



    


   

  
  

   

    
Example #6 In the mcrypt Extension

    



$key = "this is a secret key";
$td = mcrypt_module_open('tripledes', '', 'ecb', '');
$iv = mcrypt_create_iv (mcrypt_enc_get_iv_size($td),
                        MCRYPT_RAND);
mcrypt_generic_init($td, $key, $iv);
$encrypted_data = mcrypt_generic($td, "");
/* Warning: mcrypt_generic(): An empty string was
   passed in filename on line n */
?>



    


   

  
  

   

    
Example #7 In the oci8 Extension

    



oci_connect("user", "pass", "db", "bogus_charset");
/* Warning: Invalid character set name:
   bogus_charset in filename on line n */

$oci = oci_connect("user", "pass", "db");
oci_password_change($oci, "", "old", "new");
/* Warning: username cannot be empty in filename
   on line n */

oci_password_change($oci, "user", "", "new");
/* Warning: old password cannot be empty in filename
   on line n */

oci_password_change($oci, "user", "old", "");
/* Warning: new password cannot be empty in filename
   on line n */
?>



    


   

  
  

   

    
Example #8 In the SPL Extension

    



$obj = new SplFileObject(__FILE__);
$obj->fgetcsv("foo");
/* Warning:  SplFileObject::fgetcsv(): delimiter must
   be a character in filename on line n */

$obj->fgetcsv(",", "foo");
/* Warning:  SplFileObject::fgetcsv(): enclosure must
   be a character in filename on line n */
?>



    


   

  
  

   

    
Example #9 In the Semaphore (sysvmsg) extension

    



/* Warning:  maximum size of the message has to be
   greater then zero in filename on line n */
?>



    


   

  
  

   

    
Example #10 A 5.2.1+ Zip Example

    



$obj = new ZipArchive();
$obj->open('archive.zip');
$obj->setCommentName('', 'comment');
/* Notice:  ZipArchive::setCommentName(): Empty string
   as entry name in filename on line n */

/* As of PHP 5.2.1 */
$obj->getCommentName('');
/* Notice:  ZipArchive::getCommentName(): Empty string
   as entry name in filename on line n */
?>