PHP Wiki

rfc

nikic — 2016-11-07T22:15:05+01:00

1478453537		current
Line 20:		Line 20:
	This section is for RFCs that have been announced on the PHP "internals" mail list.		This section is for RFCs that have been announced on the PHP "internals" mail list.

		+	* [[rfc:deprecations_php_7_2\|Deprecations for PHP 7.2]] \\ Functions and features to be deprecated in PHP 7.2 (Created 2015-12-28)
	* [[rfc:namespace_scoped_declares\|Namespace-scoped declares]] \\ Add ability to specify declare directives at the namespace level. (Created: 2016-09-20)		* [[rfc:namespace_scoped_declares\|Namespace-scoped declares]] \\ Add ability to specify declare directives at the namespace level. (Created: 2016-09-20)
	* [[rfc:uniqid\|Improve uniqid() uniqueness.]] \\ Improve uniqid() uniqueness (Created: 2016-09-12)		* [[rfc:uniqid\|Improve uniqid() uniqueness.]] \\ Improve uniqid() uniqueness (Created: 2016-09-12)
Line 31:		Line 32:
	* [[rfc:lexical-anon\|Anonymous Class Lexical Scope]] \\ Anonymous Class Lexical Scope (Created 2016-04-19)		* [[rfc:lexical-anon\|Anonymous Class Lexical Scope]] \\ Anonymous Class Lexical Scope (Created 2016-04-19)
	* [[rfc:callableconstructors\|Callable constructors]] \\ Allow constructors to be called as a callable (Created 2015-02-25)		* [[rfc:callableconstructors\|Callable constructors]] \\ Allow constructors to be called as a callable (Created 2015-02-25)
-	* [[rfc:deprecations_php_7_1\|Deprecations for PHP 7.1]] \\ Functions and features to be deprecated in PHP 7.1 (Created 2015-12-28)
	* [[rfc: traits-with-interfaces\|Traits with interfaces]] \\ Allow traits to explicitly implement interfaces (Created 2016-02-17)		* [[rfc: traits-with-interfaces\|Traits with interfaces]] \\ Allow traits to explicitly implement interfaces (Created 2016-02-17)
	* [[rfc: adopt-code-of-conduct\|Adopt Code of Conduct]] \\ This RFC proposes that the PHP project should adopt a formal code of conduct for its members. (Re-created 2016-01-21)		* [[rfc: adopt-code-of-conduct\|Adopt Code of Conduct]] \\ This RFC proposes that the PHP project should adopt a formal code of conduct for its members. (Re-created 2016-01-21)

rfc:deprecations_php_7_1

nikic — 2016-11-07T22:14:36+01:00

1477758117		current
Line 1:		Line 1:
-	====== PHP RFC: Deprecations for PHP 7.2 ======	+	====== PHP RFC: Deprecations for PHP 7.1 ======
-	* Date: 2015-12-28	+
-	* Author: Nikita Popov <nikic@php.net>	+
-	* Status: Under Discussion	+
-	* Discussion: http://markmail.org/message/axruwwohcjwxsjem	+

-	===== Introduction =====	+	Superseded by [[https://wiki.php.net/rfc/deprecations_php_7_2]].
-		+
-	This is a draft RFC for multiple deprecations targeting PHP 7.2. The RFC proposes to deprecate the listed functionality in PHP 7.2 and remove it no later than in PHP 8.0.	+
-		+
-	The following list provides a short overview of the functionality targeted for deprecation, while more detailed explanation is provided in the Proposal section:	+
-		+
-	* ''%%__autoload%%''	+
-	* ''$php_errormsg''	+
-	* ''create_function()''	+
-	* ''mbstring.func_overload''	+
-	* ''(unset)'' cast	+
-	* ''parse_str()'' without second argument	+
-	* ''gmp_random()''	+
-	* ''(binary)'' cast and ''%%b""%%'' literals	+
-	* ''each()''	+
-	* ''assert()'' with string argument	+
-	* ''$errcontext'' argument of error handler	+
-		+
-	===== Proposal =====	+
-		+
-	==== __autoload ====	+
-		+
-	The magic [[http://php.net/__autoload\|__autoload]] function has been superseded by [[http://php.net/spl_autoload_register\|spl_autoload_register]] in PHP 5.1 and its use discouraged in the documentation. One primary advantage of ''spl_autoload_register()'' is the ability to provide multiple chained autoloaders, thus easing library interoperability. Both mechanism are mutually exclusive, i.e. code using ''%%__autoload()%%'' cannot interoperate with code using ''spl_autoload_register()''. As the latter is much more commonly used and also employed by Composer, the ''%%__autoload()%%'' mechanism has only very limited applicability nowadays.	+
-		+
-	Proposed action: A deprecation notice is thrown when a global function with name ''%%__autoload()%%'' is encountered during compilation.	+
-		+
-	==== $php_errormsg ====	+
-		+
-	The [[http://php.net/manual/en/reserved.variables.phperrormsg.php\|$php_errormsg]] variable is created in the local scope whenever a non-fatal error is thrown, if the ''track_errors'' ini setting is enabled (disabled by default) and the error has not been consumed by an error handler.	+
-		+
-	Apart from being ini-dependent language behavior, this behavior is highly magic and the [[http://php.net/error_get_last\|error_get_last]] function provides a cleaner way of retrieving the last error. Since PHP 7 additionally the [[http://php.net/manual/en/function.error-clear-last.php\|error_clear_last]] function is available, thus covering the last possible use-cases for ''$php_errormsg'' without magic scope manipulation.	+
-		+
-	Proposed action: A deprecation notice is thrown if the ''track_errors'' ini setting is enabled.	+
-		+
-	==== create_function() ====	+
-		+
-	[[http://php.net/create_function\|create_function()]] is a thin wrapper around the ''eval()'' language construct, allowing the creation of a function with a generated function name and the argument list and body code provided as string arguments. Before the introduction of closures in PHP 5.3 it provided a way to create something akin to lambda functions.	+
-		+
-	Due to the nature of its operation ''create_function()'', apart from being a potential source of security issues, has very bad performance and memory usage characteristics and the use of real closures is in every way preferable.	+
-		+
-	Proposed action: Mark the function as deprecated, thus issuing a deprecation notice on every call.	+
-		+
-	==== mbstring.func_overload ====	+
-		+
-	The [[http://php.net/manual/en/mbstring.overload.php\|mbstring.func_overload]] ini setting allows replacing a certain subset of string functions with analogs from the mbstring extension. For example ''strlen()'' will no longer return the length of a string in bytes, instead it will return the length in code points according to the currently selected internal encoding.	+
-		+
-	This implies that code using mbstring.func_overload is incompatible with practically all other code, which is written under the assumption that basic string operations work normally. Some libraries outright forbid func_overload (e.g. Symfony), others will break in more subtle ways. Code that wants to support func_overload needs to conditionally switch between ordinary string functions and mbstring functions with 8bit encoding (however only cryptography libraries normally bother to do this).	+
-		+
-	In a previous [[http://markmail.org/message/vckycqqppwxhp2gk\|discussion on this topic]] the consensus was to deprecate this functionality. The original author of the extension also recommended this action.	+
-		+
-	Proposed action: Throw a deprecation notice if ''mbstring.func_overload'' is set to a non-zero value.	+
-		+
-	Tracking bug: [[https://bugs.php.net/bug.php?id=65785\|#65785]]	+
-		+
-	==== (unset) cast ====	+
-		+
-	The [[http://php.net/manual/en/language.types.null.php#language.types.null.casting\|(unset) cast]] casts a value to null. This means that ''(unset) expr'' is simply an expression that always returns null and has no other side effects. Apart from being useless, this behavior is also confusing, as many people reasonably assume that ''(unset) $a'' will behave similarly to ''unset($a)'', while in truth it does no such thing.	+
-		+
-	Proposed action: Throw a deprecation notice if an ''(unset)'' cast is encountered by the compiler. No deprecation notice is thrown from the lexer or parser themselves (so that ''token_get_all'' continues working as is).	+
-		+
-	==== parse_str() without second argument ====	+
-		+
-	The [[http://php.net/parse_str\|parse_str()]] function is used to parse a query string either into an array if the second argument is used, or into the local symbol table if it is not used.	+
-		+
-	The second behavior is a remnant from the dark age of register_globals. It suffers from many of the same problems and presents a major security hazard if used on user-provided data.	+
-		+
-	Proposed action: Throw a deprecation notice if the second argument of ''parse_str()'' is not used.	+
-		+
-	==== gmp_random() ====	+
-		+
-	The [[http://php.net/gmp_random\|gmp_random()]] function returns a random GMP number between ''0'' and ''%%2*($nBITS_PER_LIMB)-1%%'', where ''$n'' is the function argument and ''BITS_PER_LIMB'' is a platform-specific parameter of the GMP/MPIR implementation that is not exposed to userland. As such, use of this function requires guessing the limb size and will likely have a platform dependence.	+
-		+
-	To remedy this PHP 5.6 introduced the [[http://php.net/manual/en/function.gmp-random-bits.php\|gmp_random_bits()]] and [[http://php.net/manual/en/function.gmp-random-range.php\|gmp_random_range()]] functions, which allow precise control of the used random number range. These functions should always be preferred over ''gmp_random()''.	+
-		+
-	Proposed action: Mark the function as deprecated, thus issuing a deprecation notice on every call.	+
-		+
-	==== (binary) cast and b"" literals ====	+
-		+
-	The binary cast and binary string literals were originally introduced as forward-compatibility features for PHP 6. Currently they behave identically to ordinary (string) casts and ordinary string literals. Given that PHP 6 has been dead for years and it is unlikely that it will be resurrected in the same form, it is time to remove these forward-compatibility tokens.	+
-		+
-	Proposed action: Throw a compile-time deprecation whenever binary casts or binary string literals are used.	+
-		+
-	==== each() ====	+
-		+
-	The ''each()'' function can be used to iterate over an array, similarly to using ''foreach''. On each call, it returns an array with the current key and value and advances the internal array pointer to the next position. The typical usage, as presented in the manual, is as follows:	+
-		+
-	<code php>	+
-	reset($array);	+
-	while (list($key, $val) = each($array)) {	+
-	echo "$key => $val\n";	+
-	}	+
-	</code>	+
-		+
-	The ''each()'' function is inferior to ''foreach'' in pretty much every imaginable way, including being more than 10 times slower. The continued existence of this function poses a problem for certain language changes. For example the [[https://wiki.php.net/rfc/notice-for-non-valid-array-container]] RFC had to exclude ''list()'', because the typical usage of ''each'' relies on the fact that you can access array offsets on ''false'' without a warning.	+
-		+
-	Proposed action: As ''each'' is typically called within loops, throwing a deprecation warning for every call is likely not advisable. Instead, throw a deprecation warning on the first call for any given request.	+
-		+
-	==== assert() with string argument ====	+
-		+
-	The ''assert()'' function has two modes of operation: If it is passed something other than a string, it will assert that the value is truthy. If a string is passed, it will be run through ''eval()'' and assert will check that the result of the ''eval()'' is truthy.	+
-		+
-	The reason for this behavior is that prior to PHP 7 this was the only way to prevent the assertion expression from evaluating. As of PHP 7, the ''zend.assertions'' ini option can be used to avoid evaluation of assertion expressions. As such, there is no longer a need for supporting implicitly evaluated string arguments.	+
-		+
-	This behavior of ''assert()'' makes it easy to introduce subtle remote code execution vulnerabilities. Using ''assert($value)'' to check if a value is truthy opens an RCE vulnerability if there is any chance for ''$value'' to be a string.	+
-		+
-	Proposed action: Throw a deprecation notice if ''assert()'' is used with a string argument.	+
-		+
-	==== $errcontext argument of error handler ====	+
-		+
-	Error handlers set with ''set_error_handler()'' are passed an ''$errcontext'' as the last argument. This argument is an array containing all local variables at the point the error was generated.	+
-		+
-	This functionality is problematic for optimization, because the ''$errcontext'' can be used to modify all references and objects in the current scope. As far as I am aware, this functionality is barely used and the trade-off here is not worthwhile. If people wish to inspect the variable-state at the point of an error, they should use a proper debugger.	+
-		+
-	Proposed action: Throw deprecation notice if error handler has five or more arguments. Otherwise, do not pass the ''$errcontext''. This prevents circumvention with ''func_get_args()''.	+
-		+
-	===== Backward Incompatible Changes =====	+
-		+
-	For PHP 7.1 additional deprecation notices will appear. For PHP 8.0 the previously deprecated functionality will no longer be available.	+
-		+
-	===== Proposed Voting Choices =====	+
-		+
-	Each of the bullet points above will get a separate vote. All votes will require a 2/3 supermajority, independently of whether they are language changes or not.	+
-		+
-	===== Patches and Tests =====	+
-		+
-	The patches for these deprecations are for the most part trivial, as such they will be provided once the RFC is accepted (or portions of it).	+
-		+
-	===== Suggested deprecations =====	+
-		+
-	The following list contains various suggested deprecations that may or may not be included in this RFC (TODO section).	+
-		+
-	* The ''%%"${varName}"%%'', ''%%"${varName['offset']}"%%'' and ''%%"${expr}"%%'' alternative string interpolation syntaxes. These can be replaced by the more obvious and consistent ''%%"{$varName}"%%'', ''%%"{$varName['offset']}"%%'' and ''%%"{${expr}}"%%''. (Maybe leave the latter? That one is a bit awkward.)	+
-	* The alternative parameter order for ''implode()''. Standard order is string, array, but array, string is also allowed for historic reasons.	+
-	* ''fputcsv'' etc. have been suggested, because they don't conform to the CSV standard. I think it's better to improve the implementation instead.	+
-	* ''convert_cyr_string'', as the same can be done with ''mb_convert_encoding'' or ''iconv''.	+
-	* ''get_magic_quotes_gpc'', as it's pretty useless by now.	+
-	* ''allow_url_include'' ini option.	+
-	* ''hebrevc'' as it's just ''hebrev'' + ''nl2br''.	+
-	* ''sizeof'', which is an alias of ''count''.	+
-	* Second argument to ''spl_autoload''.	+
-	* The ticks mechanism, which is obsoleted by async signal handling.	+
-		+
-	===== Rejected deprecations =====	+
-		+
-	The following section lists features that have been suggested for deprecation, but have not been included in this RFC for the outlined reasons.	+
-		+
-	==== $http_response_header ====	+
-		+
-	The [[http://php.net/manual/en/reserved.variables.httpresponseheader.php\|$http_response_header]] variable is created in the local scope if an HTTP request is performed, for example through ''file_get_contents()''. It contains an array of HTTP response headers.	+
-		+
-	The motivations for removing this functionality are similar to those of ''$php_errormsg'', so it would seem reasonable to deprecate them at the same time. However, unlike ''$php_errormsg'' there exist no //simple// alternatives to ''$http_response_header''. The [[http://php.net/get_headers\|get_headers]] function returns only the headers, but not the response body. Getting both requires, to my knowledge, a combination of ''fopen()'', ''stream_get_contents()'' and reading the ''wrapper_data'' from ''stream_get_meta_data()''.	+
-		+
-	===== Changelog =====	+
-		+
-	* 2016-02-19: Added (unset) cast	+
-	* 2016-02-19: Added mbstring.func_overload	+
-	* 2016-02-18: Added getrandmax()	+

rfc:deprecations_php_7_2

nikic — 2016-11-07T22:13:51+01:00

1478553204		current
Line 123:		Line 123:
	===== Backward Incompatible Changes =====		===== Backward Incompatible Changes =====

-	For PHP 7.1 additional deprecation notices will appear. For PHP 8.0 the previously deprecated functionality will no longer be available.	+	For PHP 7.2 additional deprecation notices will appear. For PHP 8.0 the previously deprecated functionality will no longer be available.

	===== Proposed Voting Choices =====		===== Proposed Voting Choices =====

rfc:object-typehint - updated status to In Voting

brzuchal — 2016-11-06T18:32:53+01:00

1478453290		current
Line 3:		Line 3:
	* Date: 2016-08-12		* Date: 2016-08-12
	* Author: Michał Brzuchalski <michal.brzuchalski@gmail.com>, Dan Ackroyd <danack@php.net>		* Author: Michał Brzuchalski <michal.brzuchalski@gmail.com>, Dan Ackroyd <danack@php.net>
-	* Status: Under Discussion	+	* Status: In Voting
	* First Published at: https://wiki.php.net/rfc/object-typehint		* First Published at: https://wiki.php.net/rfc/object-typehint

security - I think we should decide on severity and disclosure, to avoid misunderstanding

stas — 2016-11-05T20:10:52+01:00

1478038375		current
Line 53:		Line 53:
	Security issues, that are present only in unstable branches, belong to this category, too. Any branch that has no stable release, is per se not intended for the production use.		Security issues, that are present only in unstable branches, belong to this category, too. Any branch that has no stable release, is per se not intended for the production use.

-	Low severity issues usually do not need to have CVE and may, at the discretion of the discoverer, be disclosed publicly before the fix is released or available.	+	Low severity issues usually do not need to have CVE and may, at the discretion of the PHP developers, be disclosed publicly before the fix is released or available.

	===== Not a security issue =====		===== Not a security issue =====

rfc:counting_non_countables - Add the implementation section and update the references

duncan3dc — 2016-11-05T18:30:05+01:00

1478301336		current
Line 52:		Line 52:
	</doodle>		</doodle>

-	===== Patches and Tests =====	+	===== Implementation =====

-	Patch to handle the change:	+	Pull request to handle the change:
-	https://github.com/duncan3dc/php-src/commit/ea03689a800dfeb0b94b0b7a2a0ed837c280f27f	+	https://github.com/php/php-src/pull/2185
-		+
-	Example tests:	+
-	https://github.com/duncan3dc/php-src/commit/3e4fa60b63c94a7015d09f7310e6653ece86db05	+

	=====References =====		=====References =====
Line 64:		Line 61:
	Initial discussion that led to this RFC's creation:		Initial discussion that led to this RFC's creation:
	https://github.com/php/php-src/pull/1672		https://github.com/php/php-src/pull/1672
		+
		+	Discussion thread:
		+	http://externals.io/thread/350
		+
		+	Voting thread:
		+	http://externals.io/thread/409

internals:extensions

pollita — 2016-11-05T18:25:46+01:00

1478253229		current
Line 172:		Line 172:

	''php_init_config()'' is called, it parses the different ini files (mainly php.ini) and looks for the tokens "extension=" and "zend_extension=".		''php_init_config()'' is called, it parses the different ini files (mainly php.ini) and looks for the tokens "extension=" and "zend_extension=".
-	It then adds the names of the extensions to two different lists, one for PHP exts : extension_lists.functions, and one for Zend exts : extension_lists.engine. Both are zend_llist type.	+	It then adds the names of the extensions to two different lists, one for PHP exts : extension_lists.functions, and one for Zend exts : extension_lists.engine. Both are zend_llist (Linked List) type.
	You can find the code by looking for the function ''php_ini_parser_cb()''		You can find the code by looking for the function ''php_ini_parser_cb()''

rfc:convert_numeric_keys_in_object_array_casts

ajf — 2016-11-05T17:30:02+01:00

1478363372		current
Line 87:		Line 87:
	This could be construed as a language change, so this RFC requires a 2/3 majority in voting to be accepted.		This could be construed as a language change, so this RFC requires a 2/3 majority in voting to be accepted.

-	It is a single Yes/No vote on whether to accept the RFC and implement it in PHP 7.2.	+	It is a single Yes/No vote on whether to accept the RFC and implement it in PHP 7.2. Voting started on 2016-11-05 and will end on 2016-11-14.

	<doodle title="Accept the Convert numeric keys in object/array casts RFC for PHP 7.2?" auth="ajf" voteType="single" closed="false">		<doodle title="Accept the Convert numeric keys in object/array casts RFC for PHP 7.2?" auth="ajf" voteType="single" closed="false">

rfc:davey_shafik_on_twitter_thinking_about_an_rfc_to_remove_pear_from_php_8_0_thoughts_.png - created

davey — 2016-09-01T18:45:51+01:00

	current

rfc:screenshot_from_2016-08-05_14-24-16.png - created

yohgaki — 2016-08-05T07:24:56+01:00

	current

rfc:screenshot_from_2016-08-05_11-25-01.png - created

yohgaki — 2016-08-05T04:30:36+01:00

	current

rfc:array_change_keys_bench1.png - created

colinodell — 2016-05-31T03:13:02+01:00

	current

rfc:array_change_keys_bench2.png - created

colinodell — 2016-05-31T03:13:02+01:00

	current

rfc:array_change_keys_benchmark.png - created

colinodell — 2016-05-29T14:49:48+01:00

	current

vcs:php-merge-4.png - created

ab — 2015-09-15T14:10:48+01:00

	current

vcs:php-merge-3.png - created

ab — 2015-09-15T10:26:49+01:00

	current

doc:phdoe_login.png

yannick — 2014-08-01T14:31:26+01:00

1406059415	current

doc:phdoe_file_error.png

yannick — 2014-07-23T14:14:15+01:00

1302087566	current

doc:phdoe_need_update.png

yannick — 2014-07-23T14:04:48+01:00

1302087566	current

doc:phdoe_need_translate.png

yannick — 2014-07-23T13:54:07+01:00

1302087566	current

1478453537		current
Line 20:		Line 20:
	This section is for RFCs that have been announced on the PHP "internals" mail list.		This section is for RFCs that have been announced on the PHP "internals" mail list.

		+	* [[rfc:deprecations_php_7_2\|Deprecations for PHP 7.2]] \\ Functions and features to be deprecated in PHP 7.2 (Created 2015-12-28)
	* [[rfc:namespace_scoped_declares\|Namespace-scoped declares]] \\ Add ability to specify declare directives at the namespace level. (Created: 2016-09-20)		* [[rfc:namespace_scoped_declares\|Namespace-scoped declares]] \\ Add ability to specify declare directives at the namespace level. (Created: 2016-09-20)
	* [[rfc:uniqid\|Improve uniqid() uniqueness.]] \\ Improve uniqid() uniqueness (Created: 2016-09-12)		* [[rfc:uniqid\|Improve uniqid() uniqueness.]] \\ Improve uniqid() uniqueness (Created: 2016-09-12)
Line 31:		Line 32:
	* [[rfc:lexical-anon\|Anonymous Class Lexical Scope]] \\ Anonymous Class Lexical Scope (Created 2016-04-19)		* [[rfc:lexical-anon\|Anonymous Class Lexical Scope]] \\ Anonymous Class Lexical Scope (Created 2016-04-19)
	* [[rfc:callableconstructors\|Callable constructors]] \\ Allow constructors to be called as a callable (Created 2015-02-25)		* [[rfc:callableconstructors\|Callable constructors]] \\ Allow constructors to be called as a callable (Created 2015-02-25)
-	* [[rfc:deprecations_php_7_1\|Deprecations for PHP 7.1]] \\ Functions and features to be deprecated in PHP 7.1 (Created 2015-12-28)
	* [[rfc: traits-with-interfaces\|Traits with interfaces]] \\ Allow traits to explicitly implement interfaces (Created 2016-02-17)		* [[rfc: traits-with-interfaces\|Traits with interfaces]] \\ Allow traits to explicitly implement interfaces (Created 2016-02-17)
	* [[rfc: adopt-code-of-conduct\|Adopt Code of Conduct]] \\ This RFC proposes that the PHP project should adopt a formal code of conduct for its members. (Re-created 2016-01-21)		* [[rfc: adopt-code-of-conduct\|Adopt Code of Conduct]] \\ This RFC proposes that the PHP project should adopt a formal code of conduct for its members. (Re-created 2016-01-21)