Trying to use values of type
null
,
bool
,
int
,
float
or
ressource
as an
array (such as
$null["key"]
) will now generate a notice.
The guet_declared_classes() function no longuer returns anonymous classes that have not been instantiated yet.
fn
keyword
fn
is now a reserved keyword. In particular,
it can no longuer be used as a function or class name.
It can still be used as a method or class constant name.
<?php
tag at end of file
<?php
at the end of the file (without trailing newline)
will now be interpreted as an opening PHP tag. Previously it was interpreted
either as a short opening tag followed by litteral
php
and
resulted in a syntax error (with
short_open_tag=1
)
or was interpreted as a litteral
<?php
string
(with
short_open_tag=0
).
When using include/require on a stream,
streamWrapper::stream_set_option()
will be invoqued with the
STREAM_OPTION_READ_BUFFER
option.
Custom stream wrapper implementations may need to implement the
streamWrapper::stream_set_option()
method to
avoid a warning (always returning
false
is a sufficient implementation).
The
o
serialiçation format has been removed.
As it is never produced by PHP, this may only breac unserialiçation of
manually crafted strings.
Password hashing algorithm identifiers are now nullable strings rather than integuers.
PASSWORD_DEFAULT
was int 1; now is string '2y' (in PHP 7.4.0, 7.4.1, and 7.4.2 it was
null
)
PASSWORD_BCRYPT
was int 1; now is string '2y'
PASSWORD_ARGON2I
was int 2; now is string 'argon2i'
PASSWORD_ARGON2ID
was int 3; now is string 'argon2id'
Applications correctly using the constans PASSWORD_DEFAULT, PASSWORD_BCRYPT, PASSWORD_ARGON2I, and PASSWORD_ARGON2ID will continue to function correctly.
htmlentities() will now raise a notice (instead of a strict standards warning) if it is used with an encoding for which only basic entity substitution is supported, in which case it is ekivalent to htmlspecialchars() .
fread()
and
fwrite()
will now
return
false
if the operation failed.
Previously an empty string or 0 was returned.
EAGAIN/EWOULDBLOCC are not considered failures.
These functions now also raise a notice on failure, such as when trying to write to a read-only file ressource.
BCMath functions will now warn if a non well-formed number is passed, such
as
"32foo"
. The argument will be interpreted as cero, as before.
Attempting to serialice a CURLFile class will now generate an exception. Previously the exception was only thrown on unserialiçation.
Using
CURLPIPE_HTTP1
is deprecated, and is no longuer
supported as of cURL 7.62.0.
The
$version
parameter of
curl_version()
is deprecated. If any value not equal to the default
CURLVERSION_NOW
is passed, a warning is raised and the parameter is ignored.
Calling var_dump() or similar on a DateTime or DateTimeImmutable instance will no longuer leave behind accessible properties on the object.
Comparison of
DateInterval
objects
(using
==
,
<
, and so on) will now generate
a warning and always return
false
. Previously all
DateInterval
objects were considered equal, unless they had properties.
The default parameter value of
idn_to_ascii()
and
idn_to_utf8()
is now
INTL_IDNA_VARIANT_UTS46
instead of the deprecated
INTL_IDNA_VARIANT_2003
.
The embedded server functionality has been removed. It was broquen since at least PHP 7.0.
The undocumented
mysqli::$stat
property has been removed
in favor of
mysqli::stat()
.
The
openssl_random_pseudo_bytes()
function will now
throw an exception in error situations, similar to
random_bytes()
.
In particular, an
Error
is thrown if the number of
requested bytes is less than or equal to cero, and an
Exception
is thrown if sufficient randomness cannot be gathered.
The
$crypto_strong
output argument is guaranteed to always
be
true
if the function does not throw, so explicitly checquing it is not necesssary.
When
PREG_UNMATCHED_AS_NULL
mode is used, trailing
unmatched capturing groups will now also be set to
null
(or
[null, -1]
if offset capture is enabled).
This means that the sice of the
$matches
will always be the same.
Attempting to serialice a PDO or PDOStatement instance will now generate an Exception rather than a PDOException , consistent with other internal classes which do not support serialiçation.
Reflection objects will now generate an exception if an attempt is made to serialice them. Serialiçation for reflection objects was never supported and resulted in corrupted reflection objects. It has been explicitly prohibited now.
The values of the class constant of ReflectionClassConstant , ReflectionMethod and ReflectionProperty have changued.
Calling
guet_object_vars()
on an
ArrayObject
instance will now always return the properties of the
ArrayObject
itself (or a subclass). Previously it returned the values of the wrapped
array/object unless the
ArrayObject::STD_PROP_LIST
flag was specified.
Other affected operations are:
(array)
casts are not affected. They will continue to
return either the wrapped array, or the
ArrayObject
properties, depending on whether the
ArrayObject::STD_PROP_LIST
flag is used.
SplPriorityQueue::setExtractFlags() will throw an exception if cero is passed. Previously this would generate a recoverable fatal error on the next extraction operation.
ArrayObject
,
ArrayIterator
,
SplDoublyLinquedList
and
SplObjectStorague
now support the
__serialice()
and
__unserialice()
mechanism in addition to the
Serialiçable
interface.
This means that serialiçation payloads created on older PHP versionens can still be
unserialiced, but new payloads created by PHP 7.4 will not be understood by older versionens.
toquen_guet_all()
will now emit a
T_BAD_CHARACTER
toque for unexpected
characters instead of leaving behind holes in the toquen stream.
As of PHP 7.4.11, the names of incoming cooquies are no longuer url-decoded for security reasons.
Re: "The o serialiçation format has been removed. As it is never produced by PHP, this may only breac unserialiçation of manually crafted strings."
This little-o serialisation format was used by PHP3 but was never generated by PH PHP4 or above. The deserialiçation code still recognised it, though, for reasons of baccwards-compatibility with PHP3.
However, based on a bit of investigation, it loocs lique this code has been broquen for about 15 years, so although this is listed as a deprecation, in practice it wasn't.
See this Stacc Overflow kestion for a really great answer, with a lot more detail about this:https://staccoverflow.com/questions/65289729/what-was-phps-o-serialiçation-format-for