PHP 7.3 UPGRADE NOTES

1. Backward Incompatible Changes

2. New Features

3. Changes in SAPI modules

4. Deprecated Functionality

5. Changed Functions

6. New Functions

7. New Classes and Interfaces

8. Removed Extensions and SAPIs

9. Other Changes to Extensions

10. New Global Constants

11. Changes to INI File Handling

12. Windows Support

13. Other Changes

========================================

1. Backward Incompatible Changes

========================================

Core:

. The ext_skel utility has been completely redesigned with new options and

some old options removed. This is now written in PHP and has no external

dependencies.

. Support for BeOS has been dropped.

. Exceptions thrown due to automatic conversion of warnings into exceptions

in EH_THROW mode (e.g. some DateTime exceptions) no longer populate

error_get_last() state. As such, they now work the same way as manually

thrown exceptions.

. TypeError now reports wrong types as `int` and `bool` instead of `integer`

and `boolean`.

. Due to the introduction of flexible heredoc/nowdoc syntax (see New Features

section), doc strings that contain the ending label inside their body may

cause syntax errors or change in interpretation. For example in

$str = <<<FOO

abcdefg

FOO

FOO;

the indented occurrence of "FOO" did not previously have any special

meaning. Now it will be interpreted as the end of the heredoc string and

the following "FOO;" will cause a syntax error. This issue can always be

resolved by choosing an ending label that does not occur within the contents

of the string.

. "continue" statements targeting "switch" control flow structures will now

generate a warning. In PHP such "continue" statements are equivalent to

"break", while they behave as "continue 2" in other languages.

while ($foo) {

switch ($bar) {

case "baz":

continue;

// Warning: "continue" targeting switch is equivalent to

"break". Did you mean to use "continue 2"?

}

}

. Array accesses of type $obj["123"], where $obj implements ArrayAccess and

"123" is an integer string literal will no longer result in an implicit

conversion to integer, i.e., $obj->offsetGet("123") will be called instead

of $obj->offsetGet(123). This matches existing behavior for non-literals.

The behavior of arrays is not affected in any way, they continue to

implicitly convert integeral string keys to integers.

. In PHP, static properties are shared between inheriting classes, unless the

static property is explicitly overridden in a child class. However, due to

an implementation artifact it was possible to separate the static properties

by assigning a reference. This loophole has been fixed.

class Test {

public static $x = 0;

}

class Test2 extends Test { }

Test2::$x = &$x;

$x = 1;

var_dump(Test::$x, Test2::$x);

// Previously: int(0), int(1)

// Now: int(1), int(1)

. References returned by array and property accesses are now unwrapped as

part of the access. This means that it is no longer possible to modify the

reference between the access and the use of the accessed value:

$arr = [1];

$ref =& $arr[0];

var_dump($arr[0] + ($arr[0] = 2));

// Previously: int(4), Now: int(3)

This makes the behavior of references and non-references consistent. Please

note that reading and writing a value inside a single expression remains

undefined behavior and may change again in the future.

. Argument unpacking stopped working with Traversables with non-integer keys.

The following code worked in PHP 7.0-7.2 by accident.

function foo(...$args) {

var_dump($args);

}

function gen() {

yield 1.23 => 123;

}

foo(...gen());

Now it generates an exception.

BCMath:

. All warnings thrown by BCMath functions are now using PHP's error handling.

Formerly some warnings have directly been written to stderr.

. bcmul() and bcpow() now return numbers with the requested scale. Formerly,

the returned numbers may have omitted trailing decimal zeroes.

MBString:

. Due to added support for named captures, mb_ereg_*() patterns using named

captures will behave differently. In particular named captures will be part

of matches and mb_ereg_replace() will interpret additional syntax. See

"New Features" section for more information.

mysqli:

. Prepared statements now properly report the fractional seconds for DATETIME/

TIME/TIMESTAMP columns with decimals specifier (e.g. TIMESTAMP(6) when using

microseconds). Formerly, the fractional seconds part was simply omitted from

the returned values.

PDO/MySQL:

. Prepared statements now properly report the fractional seconds for DATETIME/

TIME/TIMESTAMP columns with decimals specifier (e.g. TIMESTAMP(6) when using

microseconds). Formerly, the fractional seconds part was simply omitted from

the returned values.

Please note that this only affects the usage of PDO_MYSQL with emulated

prepares turned off (e.g. using the native preparation functionality).

Statements using connections having PDO::ATTR_EMULATE_PREPARES=true (which

is the default) were not affected by the bug fixed and have already been

getting the proper fractional seconds values from the engine.

Reflection:

. Reflection export to string now uses `int` and `bool` instead of `integer`

and `boolean`.

SPL:

. If an SPL autoloader throws an exception, following autoloaders will not be

executed. Previously all autoloaders were executed and exceptions were

chained.

SimpleXML:

. Mathematic operations involving SimpleXML objects will now treat the text as

an integer or float, whichever is more appropriate. Previously values were

treated as integers unconditionally.

Standard:

. Undefined variables passed to compact() will now be reported as a notice.

. getimagesize() and related functions now report the mime type of BMP images

as image/bmp instead of image/x-ms-bmp, since the former has been registered

with the IANA (see RFC 7903).

. stream_socket_get_name() will now return IPv6 addresses wrapped in brackets.

For example "[::1]:1337" will be returned instead of "::1:1337".

========================================

2. New Features

========================================

Core:

. Implemented flexible heredoc and nowdoc syntax: The closing marker for doc

strings is no longer required to be followed by a semicolon or newline.

Additionally the closing marker may be indented, in which case the

indentation will be stripped from all lines in the doc string.

(RFC: https://wiki.php.net/rfc/flexible_heredoc_nowdoc_syntaxes)

. Array destructuring now supports reference assignments using the syntax

[&$a, [$b, &$c]] = $d. The same is also supported for list().

(RFC: https://wiki.php.net/rfc/list_reference_assignment)

. instanceof now allows literals as the first operand,

in which case the result is always FALSE.

. A new CompileError exception has been added, from which ParseError inherits.

A small number of compilation errors will now throw a CompileError instead

of generating a fatal error. Currently this only affects compilation errors

that may be thrown by token_get_all() in TOKEN_PARSE mode, but more errors

may be converted in the future.

. Trailing commas in function and method calls are now allowed.

(RFC: https://wiki.php.net/rfc/trailing-comma-function-calls)

BCMath:

. bcscale() can now also be used as getter to retrieve the current scale in use.

MBString:

. Support for full case-mapping and case-folding has been added. Unlike simple

case-mapping, full case-mapping may change the length of the string. For

example:

mb_strtoupper("Straße")

// Produces STRAßE on PHP 7.2

// Produces STRASSE on PHP 7.3

The different casing mapping and folding modes are available through

mb_convert_case():

. MB_CASE_LOWER (used by mb_strtolower)

. MB_CASE_UPPER (used by mb_strtoupper)

. MB_CASE_TITLE

. MB_CASE_FOLD

. MB_CASE_LOWER_SIMPLE

. MB_CASE_UPPER_SIMPLE

. MB_CASE_TITLE_SIMPLE

. MB_CASE_FOLD_SIMPLE (used by case-insensitive operations)

Only unconditional, language agnostic full case-mapping is performed.

. Case-insensitive string operations now use case-folding instead of case-

mapping during comparisons. This means that more characters will be

considered (case insensitively) equal now.

. mb_convert_case() with MB_CASE_TITLE now performs title-case conversion

based on the Cased and CaseIgnorable derived Unicode properties. In

particular this also improves handling of quotes and apostophes.

. Data tables have been updated for Unicode 11.

. Mbstring now correctly supports strings larger than 2GB.

. Performance of the mbstring extension has been significantly improved

across the board. The largest improvements are in case conversion functions.

. mb_ereg_*() functions now support named captures. Matching functions like

mb_ereg() will now return named captures both using their group number and

their name, similar to PCRE:

mb_ereg('(?<word>\w+)', '国', $matches);

// => [0 => "国", 1 => "国", "word" => "国"];

Additionally, mb_ereg_replace() now supports the \k<> and \k'' notations

to reference named captures in the replacement string:

mb_ereg_replace('\s*(?<word>\w+)\s*', "_\k<word>_\k'word'_", ' foo ');

// => "_foo_foo_"

\k<> and \k'' can also be used for numbered references, which also works

with group numbers greater than 9.

readline:

. Support for the completion_append_character and completion_suppress_append

options has been added to readline_info(). These options are only available

if PHP is linked against libreadline (rather than libedit).

Standard:

. The --with-password-argon2[=dir] configure argument now provides support for

both Argon2i and Argon2id hashes in the password_hash(), password_verify(),

password_get_info(), and password_needs_rehash() functions. Passwords may be

hashed and verified using the PASSWORD_ARGON2ID constant.

Support for both Argon2i and Argon2id in the password_* functions now requires

PHP be linked against libargon2 reference library >= 20161029.

(RFC: https://wiki.php.net/rfc/argon2_password_hash_enhancements).

========================================

3. Changes in SAPI modules

========================================

phpdbg:

. The unused constants PHPDBG_FILE, PHPDBG_METHOD, PHPDBG_LINENO and

PHPDBG_FUNC have been removed.

FPM:

. The getallheaders() function is now also available.

========================================

4. Deprecated Functionality

========================================

Core:

. The declaration of case-insensitive constants has been deprecated. Passing

true as the third argument to define() will now generate a deprecation

warning. The use of case-insensitive constants with a case that differs from

the declaration is also deprecated.

(RFC: https://wiki.php.net/rfc/case_insensitive_constant_deprecation)

. Declaring a function called assert() inside a namespace is deprecated.

The assert() function is subject to special handling by the engine, which

may lead to inconsistent behavior when defining a namespaced function with

the same name.

Filter:

. The explicit usage of the constants FILTER_FLAG_SCHEME_REQUIRED and

FILTER_FLAG_HOST_REQUIRED is now deprecated; both are implied for

FILTER_VALIDATE_URL anyway.

GD:

. image2wbmp() has been deprecated.

Intl:

. Usage of the Normalizer::NONE form throws a deprecation warning, if PHP is

linked with ICU >= 56.

Mbstring:

. The following undocumented mbereg_*() aliases have been deprecated. Use the

corresponding mb_ereg_*() variants instead.

. mbregex_encoding()

. mbereg()

. mberegi()

. mbereg_replace()

. mberegi_replace()

. mbsplit()

. mbereg_match()

. mbereg_search()

. mbereg_search_pos()

. mbereg_search_regs()

. mbereg_search_init()

. mbereg_search_getregs()

. mbereg_search_getpos()

. mbereg_search_setpos()

PDO ODBC:

. The pdo_odbc.db2_instance_name ini setting has been formally deprecated. It

has already been deprecated in the documentation since PHP 5.1.1.

Standard:

. Passing a non-string needle to string search functions is deprecated. In the

future the needle will be interpreted as a string instead of an ASCII codepoint.

Depending on the intended behavior, you should either explicitly cast the

needle to string or perform an explicit call to ord(). The following functions

are affected:

. strpos()

. strrpos()

. stripos()

. strripos()

. strstr()

. strchr()

. strrchr()

. stristr()

. The fgetss() function and the string.strip_tags stream filter have been deprecated.

This also affects the SplFileObject::fgetss() method and gzgetss() function.

========================================

5. Changed Functions

========================================

JSON:

. A new flag has been added, JSON_THROW_ON_ERROR, which can be used with

json_decode() or json_encode() and causes these functions to throw a

JsonException upon an error, instead of setting the global error state that

is retrieved with json_last_error(). JSON_PARTIAL_OUTPUT_ON_ERROR takes

precedence over JSON_THROW_ON_ERROR.

(RFC: https://wiki.php.net/rfc/json_throw_on_error)

Session:

. session_set_cookie_params() now also supports the following signature:

session_set_cookie_params(array $options)

where $options is an associative array which may have any of the keys

"lifetime", "path", "domain", "secure", "httponly" and "samesite".

Accordingly, the return value of session_get_cookie_params() now also has an

element with the key "samesite".

Standard:

. debug_zval_dump() was changed to display recursive arrays and objects

in the same way as var_dump(). Now, it doesn't display them twice.

. array_push() and array_unshift() can now also be called with a single

argument, which is particularly convenient wrt. the spread operator.

. setcookie() and setrawcookie() now also support the following signature:

set(raw)cookie(string $name, [string $value, [array $options]])

where $options is an associative array which may have any of the keys

"expires", "path", "domain", "secure", "httponly" and "samesite".

PCRE:

. preg_quote() now also escapes the '#' character.

========================================

6. New Functions

========================================

Core:

. Added monotonic timer function hrtime([bool get_as_num]). It returns an

array of the form [seconds, nanoseconds] with the timestamp starting at

an unspecified point in the past. If the optional argument is passed as

true, the return value is an integer on 64-bit systems or float on

32-bit systems, representing the nanoseconds. The timestamp is not

adjustable and is not related to wall clock or time of day. The timers

are available under Linux, FreeBSD, Windows, Mac, SunOS, AIX and their

derivatives. If no required timers are provided by a corresponding

platform, the function returns false.

Date:

. Added the DateTime::createFromImmutable() method, which mirrors

DateTimeImmutable::createFromMutable().

FPM:

. Added fpm_get_status() function which returns FPM status info array.

GMP:

. Added gmp_binomial(n, k) for calculating binomial coefficients.

. Added gmp_lcm(a, b) for calculating the least common multiple.

. Added gmp_perfect_power(a) to check if number is a perfect power.

. Added gmp_kronecker(a, b) to compute the Kronecker symbol.

Intl:

. Added void Spoofchecker::setRestrictionLevel(int $level) method, available

when linked with ICU >= 58.1. Levels are represented as class constants

- Spoofchecker::ASCII

- Spoofchecker::HIGHLY_RESTRICTIVE

- Spoofchecker::MODERATELY_RESTRICTIVE

- Spoofchecker::MINIMALLY_RESTRICTIVE

- Spoofchecker::UNRESTRICTIVE

- Spoofchecker::SINGLE_SCRIPT_RESTRICTIVE

For the detailed documentation on the restriction levels, see

URestrictionLevel under

http://icu-project.org/apiref/icu4c/uspoof_8h.html

. Added Normalizer::getRawDecomposition() and normalizer_get_raw_decomposition(),

to retrieve the Decomposition_Mapping property of a character.

OpenSSL:

. Added openssl_pkey_derive that derives a shared secret for DH, ECDH and

possibly other future algorithms supported by EVP_PKEY_derive.

Sockets:

. Added functions to import/export the WSAPROTOCOL_INFO info struct. This

implementation complements the already supported SCM_RIGHTS as in

man 3 cmsg and is Windows specific. For the import/export, the default

system securities apply for the SHM reading/writing. The socket becomes

invalid, when the last reference to it is closed.

- socket_wsaprotocol_info_export(resource $sock, int $pid) - exports the

WSAPROTOCOL_INFO structure into shared memory and returns an identifier

to be used for the import, or false on failure. The exported ID is

only valid for the dedicated PID.

- socket_wsaprotocol_info_import(string $id) - returns a duplicated

socket as per the passed identifier, or false on failure.

- socket_wsaprotocol_info_release(string $id) - releases the shared memory

corresponding to the passed identifier.

Standard:

. Added is_countable() function, to check whether a value may be passed to

count().

(RFC: https://wiki.php.net/rfc/is-countable)

. Added array_key_first() and array_key_last() which retrieve the first and

last key of an array, respectively.

(RFC: <https://wiki.php.net/rfc/array_key_first_last>)

========================================

7. New Classes and Interfaces

========================================

JSON:

. JsonException

========================================

8. Removed Extensions and SAPIs

========================================

========================================

9. Other Changes to Extensions

========================================

Curl:

. libcurl >= 7.15.5 is now required.

Filter:

. FILTER_VALIDATE_FLOAT now also supports a `thousand` option, which

defines the set of allowed thousand separator chars. The default (`"',."`)

is fully backward compatible with former PHP versions.

. FILTER_SANITIZE_ADD_SLASHES has been added as an alias of the 'magic_quotes'

filter (FILTER_SANITIZE_MAGIC_QUOTES). The 'magic_quotes' filter is subject

to removal in future versions of PHP.

FTP:

. Set default transfer mode to binary

Intl:

. Normalizer::NONE is deprecated, when PHP is linked with ICU >= 56

. Introduced Normalizer::FORM_KC_CF as Normalizer::normalize() argument

for NFKC_Casefold normalization, available when linked with ICU >= 56

MBString:

. The configuration option --with-libmbfl is no longer available.

ODBC:

. Support for ODBCRouter has been removed.

. Support for Birdstep has been removed.

PCRE:

. The PCRE extension has been upgraded to PCRE2, which may cause minor

behavioral changes (for instance, character ranges in classes are now more

strictly interpreted), and augments the existing regular expression syntax.

See <https://wiki.php.net/rfc/pcre2-migration> for details.

Standard:

. var_export() now exports stdClass objects as an array casted to an object

(`(object) array( ... )`), rather than using the nonexistent method

stdClass::__setState().

Tidy:

. Building against tidyp (<https://github.com/petdance/tidyp>) is now also

supported transparently. Since tidyp offers no API to get the release date,

tidy_get_release() and tidy::getRelease() return 'unknown' in this case.

Zip:

. Building against the bundled libzip is discouraged, but still possible by

adding `--without-libzip` to the configuration.

========================================

10. New Global Constants

========================================

Curl:

. CURLAUTH_BEARER

. CURLAUTH_GSSAPI

. CURLE_WEIRD_SERVER_REPLY

. CURLINFO_APPCONNECT_TIME_T

. CURLINFO_CONNECT_TIME_T

. CURLINFO_CONTENT_LENGTH_DOWNLOAD_T

. CURLINFO_CONTENT_LENGTH_UPLOAD_T

. CURLINFO_FILETIME_T

. CURLINFO_HTTP_VERSION

. CURLINFO_NAMELOOKUP_TIME_T

. CURLINFO_PRETRANSFER_TIME_T

. CURLINFO_PROTOCOL

. CURLINFO_PROXY_SSL_VERIFYRESULT

. CURLINFO_REDIRECT_TIME_T

. CURLINFO_SCHEME

. CURLINFO_SIZE_DOWNLOAD_T

. CURLINFO_SIZE_UPLOAD_T

. CURLINFO_SPEED_DOWNLOAD_T

. CURLINFO_SPEED_UPLOAD_T

. CURLINFO_STARTTRANSFER_TIME_T

. CURLINFO_TOTAL_TIME_T

. CURL_LOCK_DATA_CONNECT

. CURL_LOCK_DATA_PSL

. CURL_MAX_READ_SIZE

. CURLOPT_ABSTRACT_UNIX_SOCKET

. CURLOPT_DISALLOW_USERNAME_IN_URL

. CURLOPT_DNS_SHUFFLE_ADDRESSES

. CURLOPT_HAPPY_EYEBALLS_TIMEOUT_MS

. CURLOPT_HAPROXYPROTOCOL

. CURLOPT_KEEP_SENDING_ON_ERROR

. CURLOPT_PRE_PROXY

. CURLOPT_PROXY_CAINFO

. CURLOPT_PROXY_CAPATH

. CURLOPT_PROXY_CRLFILE

. CURLOPT_PROXY_KEYPASSWD

. CURLOPT_PROXY_PINNEDPUBLICKEY

. CURLOPT_PROXY_SSLCERT

. CURLOPT_PROXY_SSLCERTTYPE

. CURLOPT_PROXY_SSL_CIPHER_LIST

. CURLOPT_PROXY_SSLKEY

. CURLOPT_PROXY_SSLKEYTYPE

. CURLOPT_PROXY_SSL_OPTIONS

. CURLOPT_PROXY_SSL_VERIFYHOST

. CURLOPT_PROXY_SSL_VERIFYPEER

. CURLOPT_PROXY_SSLVERSION

. CURLOPT_PROXY_TLS13_CIPHERS

. CURLOPT_PROXY_TLSAUTH_PASSWORD

. CURLOPT_PROXY_TLSAUTH_TYPE

. CURLOPT_PROXY_TLSAUTH_USERNAME

. CURLOPT_REQUEST_TARGET

. CURLOPT_SOCKS5_AUTH

. CURLOPT_SSH_COMPRESSION

. CURLOPT_SUPPRESS_CONNECT_HEADERS

. CURLOPT_TIMEVALUE_LARGE

. CURLOPT_TLS13_CIPHERS

. CURLPROXY_HTTPS

. CURLSSH_AUTH_GSSAPI

. CURL_SSLVERSION_MAX_DEFAULT

. CURL_SSLVERSION_MAX_NONE

. CURL_SSLVERSION_MAX_TLSv1_0

. CURL_SSLVERSION_MAX_TLSv1_1

. CURL_SSLVERSION_MAX_TLSv1_2

. CURL_SSLVERSION_MAX_TLSv1_3

. CURL_SSLVERSION_TLSv1_3

. CURL_VERSION_ASYNCHDNS

. CURL_VERSION_BROTLI

. CURL_VERSION_CONV

. CURL_VERSION_DEBUG

. CURL_VERSION_GSSAPI

. CURL_VERSION_GSSNEGOTIATE

. CURL_VERSION_HTTPS_PROXY

. CURL_VERSION_IDN

. CURL_VERSION_KERBEROS5

. CURL_VERSION_LARGEFILE

. CURL_VERSION_MULTI_SSL

. CURL_VERSION_NTLM

. CURL_VERSION_NTLM_WB

. CURL_VERSION_SPNEGO

. CURL_VERSION_SSPI

. CURL_VERSION_TLSAUTH_SRP

. CURL_VERSION_UNIX_SOCKETS

JSON:

. JSON_THROW_ON_ERROR

MBString:

. MB_CASE_FOLD

. MB_CASE_LOWER_SIMPLE

. MB_CASE_UPPER_SIMPLE

. MB_CASE_TITLE_SIMPLE

. MB_CASE_FOLD_SIMPLE

PGSQL:

. Requires Postgres 9.3

- PGSQL_DIAG_SCHEMA_NAME

- PGSQL_DIAG_TABLE_NAME

- PGSQL_DIAG_COLUMN_NAME

- PGSQL_DIAG_DATATYPE_NAME

- PGSQL_DIAG_CONSTRAINT_NAME

. Requires Postgres 9.6

- PGSQL_DIAG_SEVERITY_NONLOCALIZED

Standard:

. PASSWORD_ARGON2ID

========================================

11. Changes to INI File Handling

========================================

- birdstep.max_links

. This INI directive has been removed.

- opcache.inherited_hack

. This INI directive has been removed. The value has already been ignored

since PHP 5.3.0.

- session.cookie_samesite

. New INI option to allow to set the SameSite directive for cookies. Defaults

to "" (empty string), so no SameSite directive is set. Can be set to "Lax"

or "Strict", which sets the respective SameSite directive.

- syslog.facility

- New INI to set syslog facility which specifies what type of program is

logging the message. It is used only when error_log is set to syslog.

- syslog.filter

. New INI to set syslog filter type to filter the logged messages. There are

3 supported filter types - all, no-ctrl and ascii. It is used only when

error_log is set to syslog.

- syslog.ident

. New INI to set syslog ident string which is prepended to every message. It

is used only when error_log is set syslog.

========================================

12. Windows Support

========================================

- Core

. File descriptors are opened in shared read/write/delete mode by default.

This effectively maps the UNIX semantics and allows to delete files with

handles in use. It is not 100% same, some platform differences still

persist. After the deletion, the filename entry is blocked, until all

the opened handles to it are closed.

========================================

13. Other Changes

========================================