PHP Knowledge Patch

PHP Knowledge Patch

Use this skill when writing, reviewing, debugging, or migrating PHP code whose behavior may depend on recent language, runtime, extension, or security changes.

How to use this patch

1. Determine the application's PHP version from composer.json, platform configuration, the runtime, or the deployment image.
2. Read the reference file for the subsystem being changed.
3. Apply only guidance relevant to the application's version and enabled extensions.
4. Prefer explicit validation and exception handling where formerly permissive APIs now reject inputs.
5. Run the project's tests under every PHP version it supports, with production extensions and INI settings represented.

Reference index

Migration priorities

Replace deprecated syntax and core idioms

• Replace (boolean), (integer), (double), and (binary) with canonical casts.
• End case labels with : and replace backtick execution with an explicit process API.
• Replace non-numeric string ++ with str_increment().
• Do not use null as an array offset or array_key_exists() key; use the empty string explicitly only when that is the intended key.
• Replace trigger_error(..., E_USER_ERROR) with an exception or exit().
• Avoid deriving non-CLI argc and argv from a query string.

Modernize object lifecycle hooks

• Implement __serialize() and __unserialize() instead of __sleep() and __wakeup() in new or migrated code.
• Make __debugInfo() return an array.
• Let object handles clean themselves up instead of calling deprecated close or destroy functions for cURL, fileinfo, GD, or XML parser objects.
• Do not take an indirect reference to a readonly property during cloning.

Remove deprecated configuration assumptions

• Remove disable_classes; it no longer has an effect.
• Remove obsolete separate OPcache module loading directives.
• Select an explicit JIT mode; a nonzero buffer alone does not enable JIT.
• Stop changing deprecated session ID, cookie, and trans-SID directives.
• Give directory functions explicit handles and CSV functions explicit escape arguments.

Update extension entry points

• Prefer named factory or operation methods over legacy overloaded signatures in DatePeriod, Intl calendars, LDAP, Reflection, and stream contexts.
• Move PDO driver constants and methods to their driver-specific classes.
• Replace legacy SPL aliases with the corresponding offset*() methods.
• Pass real callables to XML, DOM XPath, and XSL APIs.
• Replace resource checks for migrated handles with object-aware failure checks.

Behavior changes to audit

Exceptions and validation

Many extension APIs now throw TypeError or ValueError for malformed ranges, encodings, locales, ports, signal data, configuration keys, and option values. Validate untrusted input before the call and catch exceptions only where the application can recover.

Particularly review:

• GD quality, scale, filter, and speed arguments;
• Intl locales, time zones, resource offsets, and calendars;
• mbstring encodings and conversion maps;
• PCNTL signal masks, waits, executable arguments, and environments;
• SNMP hosts, ports, timeouts, and retries;
• socket ports, address hints, and multicast contexts;
• Tidy configuration keys and read-only settings;
• XML, XSL, CSV, hash, and serialization option validation.

Comparisons, casts, and fetch state

• Recursive value comparisons throw Error and can be caught.
• Loose object/boolean comparisons consistently use the object's boolean cast.
• Unrepresentable float-to-integer conversions warn, including NAN.
• PDO fetch-mode mutation during a fetch throws; use only valid flag combinations and supported fetch methods.
• SimpleXML XPath expressions that do not return node sets warn and return false.

Build and runtime assumptions

• OPcache is part of the runtime rather than a separately loaded module.
• Intl and ODBC have newer native dependency assumptions.
• SOAP/session and runtime-linker combinations can affect extension startup.
• Internal extension constants may now expose declared types.
• Upload and temporary filenames are longer than older assumptions allowed.

High-value additions

Constant expressions and attributes

Closures, first-class callables, and casts can be used in constant expressions, including attributes and property or parameter defaults. Attributes can also decorate compile-time non-class constants, and #[\Deprecated] can mark them.

const LENGTH = strlen(...);

#[\Deprecated]
const LEGACY_MODE = 1;

Properties and cloning

Properties can use #[\Override]; static properties can use asymmetric visibility; promoted properties can be final. Function-style clone can replace properties, including readonly properties, while copying an object.

$copy = clone($original, ['id' => $newId]);

Safer failure handling

FILTER_THROW_ON_FAILURE turns validation failure into an exception. It is mutually exclusive with FILTER_NULL_ON_FAILURE.

$id = filter_var($input, FILTER_VALIDATE_INT, FILTER_THROW_ON_FAILURE);

Fatal errors now carry backtraces, and sendmail transport failures are visible through warnings and a false return from mail().

HTTP and transport controls

• Use cURL's feature list for direct capability detection.
• Install prerequisite and debug callbacks where request instrumentation needs them, respecting incompatible cURL options.
• Choose a redirect mode instead of treating follow-location as only boolean.
• Use persistent cURL share handles for safe cross-request connection reuse.
• Use the large infile-size option where the legacy option is 32-bit limited.

Database-specific connections

Use PDO::connect() or a driver-specific PDO subclass when concrete driver functionality matters. Driver-aware SQL parsing reduces placeholder mistakes in quoted identifiers and comments. SQLite can select the transaction mode used by subsequent beginTransaction() calls.

Internationalization and media

• IntlListFormatter formats localized conjunction, disjunction, and unit lists when the required ICU support is present.
• Image inspection recognizes HEIF/HEIC and, with libxml, SVG, while reporting dimension units that are not always pixels.
• PCRE adds variable-length lookbehind, longer named captures, and restricted caseless matching, but also changes parsing of some older patterns.

Cookies, SOAP, and XSL

• Cookie APIs accept the partitioned option.
• SOAP supports namespaced class maps, date/time serialization, schema enum cases, reason-text languages, and selectable URI parser backends.
• XSL accepts native callbacks, quote-safe parameters, namespaced parameters, and configurable evaluation limits.

Review checklist

• Search deprecation logs rather than suppressing them.
• Exercise both successful and invalid-input paths.
• Check return types where resources became objects or integers became booleans.
• Review extension-specific constants, methods, constructor overloads, and default arguments.
• Audit regexes under the bundled PCRE behavior.
• Verify INI files and native-library prerequisites in deployment images.
• Confirm database behavior with the actual driver and server versions.
• Pin a currently secured patch release on every supported PHP branch.