php-src/UPGRADING

PHP 7.3 UPGRADE NOTES

1. Backward Incompatible Changes
2. New Features
3. Changes in SAPI modules
4. Deprecated Functionality
5. Changed Functions
6. New Functions
7. New Classes and Interfaces
8. Removed Extensions and SAPIs
9. Other Changes to Extensions
10. New Global Constants
11. Changes to INI File Handling
12. Windows Support
13. Other Changes


========================================
1. Backward Incompatible Changes
========================================

Core:
  . The ext_skel utility has been completely redesigned with new options and
    some old options removed. This is now written in PHP and has no external
	dependencies.
  . Support for BeOS has been dropped.
  . Exceptions thrown due to automatic conversion of warnings into exceptions
    in EH_THROW mode (e.g. some DateTime exceptions) no longer populate
    error_get_last() state. As such, they now work the same way as manually
    thrown exceptions.
  . TypeError now reports wrong types as `int` and `bool` instead of `integer`
    and `boolean`.
  . Due to the introduction of flexible heredoc/nowdoc syntax (see New Features
    section), doc strings that contain the ending label inside their body may
    cause syntax errors or change in interpretation. For example in

        $str = <<<FOO
        abcdefg
            FOO
        FOO;

    the indented occurrence of "FOO" did not previously have any special
    meaning. Now it will be interpreted as the end of the heredoc string and
    the following "FOO;" will cause a syntax error. This issue can always be
    resolved by choosing an ending label that does not occur within the contents
    of the string.
  . "continue" statements targeting "switch" control flow structures will now
    generate a warning. In PHP such "continue" statements are equivalent to
    "break", while they behave as "continue 2" in other languages.

        while ($foo) {
            switch ($bar) {
                case "baz":
                    continue;
                    // Warning: "continue" targeting switch is equivalent to
                                "break". Did you mean to use "continue 2"?
            }
        }

  . Array accesses of type $obj["123"], where $obj implements ArrayAccess and
    "123" is an integer string literal will no longer result in an implicit
    conversion to integer, i.e., $obj->offsetGet("123") will be called instead
    of $obj->offsetGet(123). This matches existing behavior for non-literals.
    The behavior of arrays is not affected in any way, they continue to
    implicitly convert integeral string keys to integers.
  . In PHP, static properties are shared between inheriting classes, unless the
    static property is explicitly overridden in a child class. However, due to
    an implementation artifact it was possible to separate the static properties
    by assigning a reference. This loophole has been fixed.

        class Test {
            public static $x = 0;
        }
        class Test2 extends Test { }

        Test2::$x = &$x;
        $x = 1;

        var_dump(Test::$x, Test2::$x);
        // Previously: int(0), int(1)
        // Now:        int(1), int(1)

  . References returned by array and property accesses are now unwrapped as
    part of the access. This means that it is no longer possible to modify the
    reference between the access and the use of the accessed value:

        $arr = [1];
        $ref =& $arr[0];
        var_dump($arr[0] + ($arr[0] = 2));
        // Previously: int(4), Now: int(3)

    This makes the behavior of references and non-references consistent. Please
    note that reading and writing a value inside a single expression remains
    undefined behavior and may change again in the future.

  . Argument unpacking stopped working with Traversables with non-integer keys.
    The following code worked in PHP 7.0-7.2 by accident.

        function foo(...$args) {
            var_dump($args);
        }
        function gen() {
            yield 1.23 => 123;
        }
        foo(...gen());

    Now it generates an exception.

BCMath:
  . All warnings thrown by BCMath functions are now using PHP's error handling.
    Formerly some warnings have directly been written to stderr.
  . bcmul() and bcpow() now return numbers with the requested scale. Formerly,
    the returned numbers may have omitted trailing decimal zeroes.

MBString:
  . Due to added support for named captures, mb_ereg_*() patterns using named
    captures will behave differently. In particular named captures will be part
    of matches and mb_ereg_replace() will interpret additional syntax. See
    "New Features" section for more information.

mysqli:
  . Prepared statements now properly report the fractional seconds for DATETIME/
    TIME/TIMESTAMP columns with decimals specifier (e.g. TIMESTAMP(6) when using
    microseconds). Formerly, the fractional seconds part was simply omitted from
    the returned values.

PDO/MySQL:
  . Prepared statements now properly report the fractional seconds for DATETIME/
    TIME/TIMESTAMP columns with decimals specifier (e.g. TIMESTAMP(6) when using
    microseconds). Formerly, the fractional seconds part was simply omitted from
    the returned values.
    Please note that this only affects the usage of PDO_MYSQL with emulated
    prepares turned off (e.g. using the native preparation functionality).
    Statements using connections having PDO::ATTR_EMULATE_PREPARES=true (which
    is the default) were not affected by the bug fixed and have already been
    getting the proper fractional seconds values from the engine.

Reflection:
  . Reflection export to string now uses `int` and `bool` instead of `integer`
    and `boolean`.

SPL:
  . If an SPL autoloader throws an exception, following autoloaders will not be
    executed. Previously all autoloaders were executed and exceptions were
    chained.

SimpleXML:
  . Mathematic operations involving SimpleXML objects will now treat the text as
    an integer or float, whichever is more appropriate. Previously values were
    treated as integers unconditionally.

Standard:
  . Undefined variables passed to compact() will now be reported as a notice.
  . getimagesize() and related functions now report the mime type of BMP images
    as image/bmp instead of image/x-ms-bmp, since the former has been registered
    with the IANA (see RFC 7903).
  . stream_socket_get_name() will now return IPv6 addresses wrapped in brackets.
    For example "[::1]:1337" will be returned instead of "::1:1337".

========================================
2. New Features
========================================

Core:
  . Implemented flexible heredoc and nowdoc syntax: The closing marker for doc
    strings is no longer required to be followed by a semicolon or newline.
    Additionally the closing marker may be indented, in which case the
    indentation will be stripped from all lines in the doc string.
    (RFC: https://wiki.php.net/rfc/flexible_heredoc_nowdoc_syntaxes)
  . Array destructuring now supports reference assignments using the syntax
    [&$a, [$b, &$c]] = $d. The same is also supported for list().
    (RFC: https://wiki.php.net/rfc/list_reference_assignment)
  . instanceof now allows literals as the first operand,
    in which case the result is always FALSE.
  . A new CompileError exception has been added, from which ParseError inherits.
    A small number of compilation errors will now throw a CompileError instead
    of generating a fatal error. Currently this only affects compilation errors
    that may be thrown by token_get_all() in TOKEN_PARSE mode, but more errors
    may be converted in the future.
  . Trailing commas in function and method calls are now allowed.
    (RFC: https://wiki.php.net/rfc/trailing-comma-function-calls)

BCMath:
  . bcscale() can now also be used as getter to retrieve the current scale in use.

MBString:
  . Support for full case-mapping and case-folding has been added. Unlike simple
    case-mapping, full case-mapping may change the length of the string. For
    example:

      mb_strtoupper("Straße")
      // Produces STRAßE on PHP 7.2
      // Produces STRASSE on PHP 7.3

    The different casing mapping and folding modes are available through
    mb_convert_case():

      . MB_CASE_LOWER (used by mb_strtolower)
      . MB_CASE_UPPER (used by mb_strtoupper)
      . MB_CASE_TITLE
      . MB_CASE_FOLD
      . MB_CASE_LOWER_SIMPLE
      . MB_CASE_UPPER_SIMPLE
      . MB_CASE_TITLE_SIMPLE
      . MB_CASE_FOLD_SIMPLE (used by case-insensitive operations)

    Only unconditional, language agnostic full case-mapping is performed.
  . Case-insensitive string operations now use case-folding instead of case-
    mapping during comparisons. This means that more characters will be
    considered (case insensitively) equal now.
  . mb_convert_case() with MB_CASE_TITLE now performs title-case conversion
    based on the Cased and CaseIgnorable derived Unicode properties. In
    particular this also improves handling of quotes and apostophes.
  . Data tables have been updated for Unicode 11.
  . Mbstring now correctly supports strings larger than 2GB.
  . Performance of the mbstring extension has been significantly improved
    across the board. The largest improvements are in case conversion functions.
  . mb_ereg_*() functions now support named captures. Matching functions like
    mb_ereg() will now return named captures both using their group number and
    their name, similar to PCRE:

        mb_ereg('(?<word>\w+)', '国', $matches);
        // => [0 => "国", 1 => "国", "word" => "国"];

    Additionally, mb_ereg_replace() now supports the \k<> and \k'' notations
    to reference named captures in the replacement string:

        mb_ereg_replace('\s*(?<word>\w+)\s*', "_\k<word>_\k'word'_", ' foo ');
        // => "_foo_foo_"

    \k<> and \k'' can also be used for numbered references, which also works
    with group numbers greater than 9.

readline:
  . Support for the completion_append_character and completion_suppress_append
    options has been added to readline_info(). These options are only available
    if PHP is linked against libreadline (rather than libedit).

Standard:
  . The --with-password-argon2[=dir] configure argument now provides support for
    both Argon2i and Argon2id hashes in the password_hash(), password_verify(),
    password_get_info(), and password_needs_rehash() functions. Passwords may be
    hashed and verified using the PASSWORD_ARGON2ID constant.
    Support for both Argon2i and Argon2id in the password_* functions now requires
    PHP be linked against libargon2 reference library >= 20161029.
    (RFC: https://wiki.php.net/rfc/argon2_password_hash_enhancements).

========================================
3. Changes in SAPI modules
========================================

phpdbg:
  . The unused constants PHPDBG_FILE, PHPDBG_METHOD, PHPDBG_LINENO and
    PHPDBG_FUNC have been removed.

FPM:
  . The getallheaders() function is now also available.

========================================
4. Deprecated Functionality
========================================

Core:
  . The declaration of case-insensitive constants has been deprecated. Passing
    true as the third argument to define() will now generate a deprecation
    warning. The use of case-insensitive constants with a case that differs from
    the declaration is also deprecated.
    (RFC: https://wiki.php.net/rfc/case_insensitive_constant_deprecation)
  . Declaring a function called assert() inside a namespace is deprecated.
    The assert() function is subject to special handling by the engine, which
    may lead to inconsistent behavior when defining a namespaced function with
    the same name.

Filter:
  . The explicit usage of the constants FILTER_FLAG_SCHEME_REQUIRED and
    FILTER_FLAG_HOST_REQUIRED is now deprecated; both are implied for
    FILTER_VALIDATE_URL anyway.

GD:
  . image2wbmp() has been deprecated.

Intl:
  . Usage of the Normalizer::NONE form throws a deprecation warning, if PHP is
    linked with ICU >= 56.

Mbstring:
  . The following undocumented mbereg_*() aliases have been deprecated. Use the
    corresponding mb_ereg_*() variants instead.
     . mbregex_encoding()
     . mbereg()
     . mberegi()
     . mbereg_replace()
     . mberegi_replace()
     . mbsplit()
     . mbereg_match()
     . mbereg_search()
     . mbereg_search_pos()
     . mbereg_search_regs()
     . mbereg_search_init()
     . mbereg_search_getregs()
     . mbereg_search_getpos()
     . mbereg_search_setpos()

PDO ODBC:
  . The pdo_odbc.db2_instance_name ini setting has been formally deprecated. It
    has already been deprecated in the documentation since PHP 5.1.1.

Standard:
  . Passing a non-string needle to string search functions is deprecated. In the
    future the needle will be interpreted as a string instead of an ASCII codepoint.
    Depending on the intended behavior, you should either explicitly cast the
    needle to string or perform an explicit call to ord(). The following functions
    are affected:
      . strpos()
      . strrpos()
      . stripos()
      . strripos()
      . strstr()
      . strchr()
      . strrchr()
      . stristr()
  . The fgetss() function and the string.strip_tags stream filter have been deprecated.
    This also affects the SplFileObject::fgetss() method and gzgetss() function.

========================================
5. Changed Functions
========================================

JSON:
  . A new flag has been added, JSON_THROW_ON_ERROR, which can be used with
    json_decode() or json_encode() and causes these functions to throw a
    JsonException upon an error, instead of setting the global error state that
    is retrieved with json_last_error(). JSON_PARTIAL_OUTPUT_ON_ERROR takes
    precedence over JSON_THROW_ON_ERROR.
    (RFC: https://wiki.php.net/rfc/json_throw_on_error)

Session:
  . session_set_cookie_params() now also supports the following signature:
    session_set_cookie_params(array $options)
    where $options is an associative array which may have any of the keys
    "lifetime", "path", "domain", "secure", "httponly" and "samesite".
    Accordingly, the return value of session_get_cookie_params() now also has an
    element with the key "samesite".

Standard:
  . debug_zval_dump() was changed to display recursive arrays and objects
    in the same way as var_dump(). Now, it doesn't display them twice.
  . array_push() and array_unshift() can now also be called with a single
    argument, which is particularly convenient wrt. the spread operator.
  . setcookie() and setrawcookie() now also support the following signature:
    set(raw)cookie(string $name, [string $value, [array $options]])
    where $options is an associative array which may have any of the keys
    "expires", "path", "domain", "secure", "httponly" and "samesite".

PCRE:
  . preg_quote() now also escapes the '#' character.

========================================
6. New Functions
========================================

Core:
  . Added monotonic timer function hrtime([bool get_as_num]). It returns an
    array of the form [seconds, nanoseconds] with the timestamp starting at
    an unspecified point in the past. If the optional argument is passed as
    true, the return value is an integer on 64-bit systems or float on
    32-bit systems, representing the nanoseconds. The timestamp is not
    adjustable and is not related to wall clock or time of day. The timers
    are available under Linux, FreeBSD, Windows, Mac, SunOS, AIX and their
    derivatives. If no required timers are provided by a corresponding
    platform, the function returns false.

Date:
  . Added the DateTime::createFromImmutable() method, which mirrors
    DateTimeImmutable::createFromMutable().

FPM:
  . Added fpm_get_status() function which returns FPM status info array.

GMP:
  . Added gmp_binomial(n, k) for calculating binomial coefficients.
  . Added gmp_lcm(a, b) for calculating the least common multiple.
  . Added gmp_perfect_power(a) to check if number is a perfect power.
  . Added gmp_kronecker(a, b) to compute the Kronecker symbol.

Intl:
  . Added void Spoofchecker::setRestrictionLevel(int $level) method, available
    when linked with ICU >= 58.1. Levels are represented as class constants
    - Spoofchecker::ASCII
    - Spoofchecker::HIGHLY_RESTRICTIVE
    - Spoofchecker::MODERATELY_RESTRICTIVE
    - Spoofchecker::MINIMALLY_RESTRICTIVE
    - Spoofchecker::UNRESTRICTIVE
    - Spoofchecker::SINGLE_SCRIPT_RESTRICTIVE
    For the detailed documentation on the restriction levels, see
    URestrictionLevel under
    http://icu-project.org/apiref/icu4c/uspoof_8h.html
  . Added Normalizer::getRawDecomposition() and normalizer_get_raw_decomposition(),
    to retrieve the Decomposition_Mapping property of a character.

OpenSSL:
  . Added openssl_pkey_derive that derives a shared secret for DH, ECDH and
    possibly other future algorithms supported by EVP_PKEY_derive.

Sockets:
  . Added functions to import/export the WSAPROTOCOL_INFO info struct. This
    implementation complements the already supported SCM_RIGHTS as in
    man 3 cmsg and is Windows specific. For the import/export, the default
    system securities apply for the SHM reading/writing. The socket becomes
    invalid, when the last reference to it is closed.
    - socket_wsaprotocol_info_export(resource $sock, int $pid) - exports the
      WSAPROTOCOL_INFO structure into shared memory and returns an identifier
      to be used for the import, or false on failure. The exported ID is
      only valid for the dedicated PID.
    - socket_wsaprotocol_info_import(string $id) - returns a duplicated
      socket as per the passed identifier, or false on failure.
    - socket_wsaprotocol_info_release(string $id) - releases the shared memory
      corresponding to the passed identifier.

Standard:
  . Added is_countable() function, to check whether a value may be passed to
    count().
    (RFC: https://wiki.php.net/rfc/is-countable)
  . Added array_key_first() and array_key_last() which retrieve the first and
    last key of an array, respectively.
    (RFC: <https://wiki.php.net/rfc/array_key_first_last>)

========================================
7. New Classes and Interfaces
========================================

JSON:
  . JsonException

========================================
8. Removed Extensions and SAPIs
========================================

========================================
9. Other Changes to Extensions
========================================

 Curl:
  . libcurl >= 7.15.5 is now required.

 Filter:
  . FILTER_VALIDATE_FLOAT now also supports a `thousand` option, which
    defines the set of allowed thousand separator chars.  The default (`"',."`)
    is fully backward compatible with former PHP versions.
  . FILTER_SANITIZE_ADD_SLASHES has been added as an alias of the 'magic_quotes'
    filter (FILTER_SANITIZE_MAGIC_QUOTES). The 'magic_quotes' filter is subject
	to removal in future versions of PHP.

 FTP:
  . Set default transfer mode to binary

 Intl:
  . Normalizer::NONE is deprecated, when PHP is linked with ICU >= 56
  . Introduced Normalizer::FORM_KC_CF as Normalizer::normalize() argument
    for NFKC_Casefold normalization, available when linked with ICU >= 56

 MBString:
  . The configuration option --with-libmbfl is no longer available.

 ODBC:
  . Support for ODBCRouter has been removed.
  . Support for Birdstep has been removed.

PCRE:
  . The PCRE extension has been upgraded to PCRE2, which may cause minor
    behavioral changes (for instance, character ranges in classes are now more
    strictly interpreted), and augments the existing regular expression syntax.
    See <https://wiki.php.net/rfc/pcre2-migration> for details.

 Standard:
  . var_export() now exports stdClass objects as an array casted to an object
    (`(object) array( ... )`), rather than using the nonexistent method
    stdClass::__setState().

 Zip:
  . Building against the bundled libzip is discouraged, but still possible by
    adding `--without-libzip` to the configuration.

========================================
10. New Global Constants
========================================

Curl:
  . CURLAUTH_BEARER
  . CURLAUTH_GSSAPI
  . CURLE_WEIRD_SERVER_REPLY
  . CURLINFO_APPCONNECT_TIME_T
  . CURLINFO_CONNECT_TIME_T
  . CURLINFO_CONTENT_LENGTH_DOWNLOAD_T
  . CURLINFO_CONTENT_LENGTH_UPLOAD_T
  . CURLINFO_FILETIME_T
  . CURLINFO_HTTP_VERSION
  . CURLINFO_NAMELOOKUP_TIME_T
  . CURLINFO_PRETRANSFER_TIME_T
  . CURLINFO_PROTOCOL
  . CURLINFO_PROXY_SSL_VERIFYRESULT
  . CURLINFO_REDIRECT_TIME_T
  . CURLINFO_SCHEME
  . CURLINFO_SIZE_DOWNLOAD_T
  . CURLINFO_SIZE_UPLOAD_T
  . CURLINFO_SPEED_DOWNLOAD_T
  . CURLINFO_SPEED_UPLOAD_T
  . CURLINFO_STARTTRANSFER_TIME_T
  . CURLINFO_TOTAL_TIME_T
  . CURL_LOCK_DATA_CONNECT
  . CURL_LOCK_DATA_PSL
  . CURL_MAX_READ_SIZE
  . CURLOPT_ABSTRACT_UNIX_SOCKET
  . CURLOPT_DISALLOW_USERNAME_IN_URL
  . CURLOPT_DNS_SHUFFLE_ADDRESSES
  . CURLOPT_HAPPY_EYEBALLS_TIMEOUT_MS
  . CURLOPT_HAPROXYPROTOCOL
  . CURLOPT_KEEP_SENDING_ON_ERROR
  . CURLOPT_PRE_PROXY
  . CURLOPT_PROXY_CAINFO
  . CURLOPT_PROXY_CAPATH
  . CURLOPT_PROXY_CRLFILE
  . CURLOPT_PROXY_KEYPASSWD
  . CURLOPT_PROXY_PINNEDPUBLICKEY
  . CURLOPT_PROXY_SSLCERT
  . CURLOPT_PROXY_SSLCERTTYPE
  . CURLOPT_PROXY_SSL_CIPHER_LIST
  . CURLOPT_PROXY_SSLKEY
  . CURLOPT_PROXY_SSLKEYTYPE
  . CURLOPT_PROXY_SSL_OPTIONS
  . CURLOPT_PROXY_SSL_VERIFYHOST
  . CURLOPT_PROXY_SSL_VERIFYPEER
  . CURLOPT_PROXY_SSLVERSION
  . CURLOPT_PROXY_TLS13_CIPHERS
  . CURLOPT_PROXY_TLSAUTH_PASSWORD
  . CURLOPT_PROXY_TLSAUTH_TYPE
  . CURLOPT_PROXY_TLSAUTH_USERNAME
  . CURLOPT_REQUEST_TARGET
  . CURLOPT_SOCKS5_AUTH
  . CURLOPT_SSH_COMPRESSION
  . CURLOPT_SUPPRESS_CONNECT_HEADERS
  . CURLOPT_TIMEVALUE_LARGE
  . CURLOPT_TLS13_CIPHERS
  . CURLPROXY_HTTPS
  . CURLSSH_AUTH_GSSAPI
  . CURL_SSLVERSION_MAX_DEFAULT
  . CURL_SSLVERSION_MAX_NONE
  . CURL_SSLVERSION_MAX_TLSv1_0
  . CURL_SSLVERSION_MAX_TLSv1_1
  . CURL_SSLVERSION_MAX_TLSv1_2
  . CURL_SSLVERSION_MAX_TLSv1_3
  . CURL_SSLVERSION_TLSv1_3
  . CURL_VERSION_ASYNCHDNS
  . CURL_VERSION_BROTLI
  . CURL_VERSION_CONV
  . CURL_VERSION_DEBUG
  . CURL_VERSION_GSSAPI
  . CURL_VERSION_GSSNEGOTIATE
  . CURL_VERSION_HTTPS_PROXY
  . CURL_VERSION_IDN
  . CURL_VERSION_KERBEROS5
  . CURL_VERSION_LARGEFILE
  . CURL_VERSION_MULTI_SSL
  . CURL_VERSION_NTLM
  . CURL_VERSION_NTLM_WB
  . CURL_VERSION_SPNEGO
  . CURL_VERSION_SSPI
  . CURL_VERSION_TLSAUTH_SRP
  . CURL_VERSION_UNIX_SOCKETS

JSON:
  . JSON_THROW_ON_ERROR

MBString:
  . MB_CASE_FOLD
  . MB_CASE_LOWER_SIMPLE
  . MB_CASE_UPPER_SIMPLE
  . MB_CASE_TITLE_SIMPLE
  . MB_CASE_FOLD_SIMPLE

PGSQL:
  . Requires Postgres 9.3
    - PGSQL_DIAG_SCHEMA_NAME
	- PGSQL_DIAG_TABLE_NAME
	- PGSQL_DIAG_COLUMN_NAME
	- PGSQL_DIAG_DATATYPE_NAME
	- PGSQL_DIAG_CONSTRAINT_NAME
  . Requires Postgres 9.6
    - PGSQL_DIAG_SEVERITY_NONLOCALIZED

Standard:
  . PASSWORD_ARGON2ID

========================================
11. Changes to INI File Handling
========================================

- birdstep.max_links
  . This INI directive has been removed.

- opcache.inherited_hack
  . This INI directive has been removed. The value has already been ignored
    since PHP 5.3.0.

- session.cookie_samesite
  . New INI option to allow to set the SameSite directive for cookies. Defaults
    to "" (empty string), so no SameSite directive is set. Can be set to "Lax"
    or "Strict", which sets the respective SameSite directive.

- syslog.facility
  - New INI to set syslog facility which specifies what type of program is
    logging the message. It is used only when error_log is set to syslog.

- syslog.filter
  . New INI to set syslog filter type to filter the logged messages. There are
    3 supported filter types - all, no-ctrl and ascii. It is used only when
    error_log is set to syslog.

- syslog.ident
  . New INI to set syslog ident string which is prepended to every message. It
    is used only when error_log is set syslog.

========================================
12. Windows Support
========================================

- Core
  . File descriptors are opened in shared read/write/delete mode by default.
    This effectively maps the UNIX semantics and allows to delete files with
    handles in use. It is not 100% same, some platform differences still
    persist. After the deletion, the filename entry is blocked, until all
    the opened handles to it are closed.

========================================
13. Other Changes
========================================