1$Id$ 2 3PHP 5.6 UPGRADE NOTES 4 51. Backward Incompatible Changes 62. New Features 73. Changes in SAPI modules 84. Deprecated Functionality 95. Changed Functions 106. New Functions 117. New Classes and Interfaces 128. Removed Extensions 139. Other Changes to Extensions 1410. New Global Constants 1511. Changes to INI File Handling 1612. Other Changes 17 18 19======================================== 201. Backward Incompatible Changes 21======================================== 22 23- Core: 24 By fixing bug #66015 it is no longer possible to overwrite keys in static scalar 25 arrays. Quick example to illustrate: 26 class Test { 27 const FIRST = 1; 28 public $array = array( 29 self::FIRST => 'first', 30 'second', 31 'third' 32 ); 33 } 34 Test::$array will have as expected three array keys (1, 2, 3) and no longer 35 two (0, 1). self::FIRST will no longer overwrite 'third' having key 1 then, 36 but will mark the beginning of indexing. 37 38- JSON: 39 json_decode() no longer accepts non-lowercase variants of lone JSON true, 40 false or null values. For example, True or FALSE will now cause json_decode to 41 return NULL and set an error value you can fetch with json_last_error(). 42 This affects JSON texts consisting solely of true, false or null. Text 43 containing non-lowercase values inside JSON arrays or objects has never been 44 accepted. 45 46- OpenSSL: 47 To prevent man-in-the-middle attacks against encrypted transfers client 48 streams now verify peer certificates by default. Previous versions 49 required users to manually enable peer verification. As a result of this 50 change, existing code using ssl:// or tls:// stream wrappers (e.g. 51 file_get_contents(), fsockopen(), stream_socket_client()) may no longer 52 connect successfully without manually disabling peer verification via the 53 stream context's "verify_peer" setting. Encrypted transfers delegate to 54 operating system certificate stores by default if not overridden via the 55 new openssl.cafile and openssl.cafile ini directives or via call-time SSL 56 context options, so most users should be unaffected by this transparent 57 security enhancement. (https://wiki.php.net/rfc/tls-peer-verification) 58 59- Mcrypt: 60 The mcrypt_encrypt(), mcrypt_decrypt() and mcrypt_{MODE}() functions no 61 longer accept keys or IVs with incorrect sizes. Furthermore an IV is now 62 required if the used block cipher mode requires it. 63 64- cURL: 65 Uploads using the @file syntax are now unsupported by default. 66 67- IMAP: 68 Starting with 5.6.38, rsh/ssh logins are disabled by default. Use 69 imap.enable_insecure_rsh if you want to enable them. Note that the IMAP 70 library does not filter mailbox names before passing them to rsh/ssh 71 command, thus passing untrusted data to this function with rsh/ssh enabled 72 is insecure. 73 74======================================== 752. New Features 76======================================== 77 78- Added constant scalar expressions syntax. 79 (https://wiki.php.net/rfc/const_scalar_exprs) 80 81- Added dedicated syntax for variadic functions. 82 (https://wiki.php.net/rfc/variadics) 83 84- Added support for argument unpacking to complement the variadic syntax. 85 (https://wiki.php.net/rfc/argument_unpacking) 86 87- Added an exponentiation operator (**). 88 (https://wiki.php.net/rfc/pow-operator) 89 90- Added unified default encoding. default_charset=UTF-8 and functions/extensions 91 use encoding settings honor default_charset. 92 93- The php://input stream is now re-usable and can be used concurrently with 94 enable_post_data_reading=0. 95 96- Added use function and use const. 97 (https://wiki.php.net/rfc/use_function) 98 99- Added a function for timing attack safe string comparison 100 (https://wiki.php.net/rfc/timing_attack) 101 102- Added the __debugInfo() magic method to allow userland classes to implement 103 the get_debug_info API previously available only to extensions. 104 (https://wiki.php.net/rfc/debug-info) 105 106- Added gost-crypto (CryptoPro S-box) hash algorithm. 107 108- Stream wrappers verify peer certificates and host names by default in 109 encrypted client streams. 110 111- Added openssl certificate fingerprint support (inclusive stream context 112 option). 113 114- Added support for SAN x509 extension matching when verifing host names in 115 encrypted streams. 116 117- Added a range of new SSL context options for improved encrypted stream 118 server security (https://wiki.php.net/rfc/improved-tls-defaults): 119 120 . "honor_cipher_order" allows servers to prioritize cipher suites of their 121 choosing when negotiating SSL/TLS handshakes. 122 . "single_ecdh_use" and "single_dh_use" allow for improved forward 123 secrecy in encrypted stream servers. 124 . "dh_param" allows specification of pre-generated key generation 125 parameters when negotiating ephemeral DHE ciphers in stream servers. 126 . "ecdh_curve" allows stream servers to specify which curve to use when 127 negotiating ephemeral ECDHE ciphers (defaults to NIST P-256). 128 . "rsa_key_size" SSL context option gives stream servers control 129 over the key size (in bits) used when negotiating RSA ciphers. 130 . "capture_session_meta" if specified stores an array of data describing 131 the TLS session's protocol/cipher in the "session_meta" SSL context key. 132 133- Added automatic mitigation against client-initated TLS renegotiation DoS 134 attacks in encrypted server streams. Renegotiation limiting may be 135 customized via three new SSL context options: 136 137 . "reneg_limit" (number of allowed renegotiations per time window) 138 . "reneg_window" (renegotiation time window in seconds) 139 . "reneg_limit_callback" (optional notification callback on limiting) 140 141- Encrypted TLS servers now support the server name indication (SNI) TLS 142 extension via the new "SNI_server_certs" SSL context option. 143 144- Added "crypto_method" SSL context option for use in encrypted streams. 145 146- Added "peer_name" SSL context option to better reflect peer certificate 147 name matching using SAN extension (replaces deprecated "CN_match"). 148 149- Added stream wrapper support when specifying "cafile" SSL context paths. 150 151- Independent peer cert and peer name validation is now available via a new 152 boolean "verify_peer_name" SSL context option. This option is enabled by 153 default in encrypted client streams. 154 155- Added protocol-specific tlsv1.0://, tlsv1.1:// and tlsv1.2:// encryption 156 stream wrappers. tls:// wrapper now supports TLSv1.1 and TLSv1.2 (previously 157 only supported TLSv1). 158 159- Stream crypto method specification now accepts flags instead of values 160 allowing support for multiple discrete protocols in a given stream. 161 162- PostgreSQL database connections may now be established asynchronously using 163 new constants and polling functions in ext/pgsql. 164 165- Non-blocking read/write query behavior now optionally available in database 166 operations using the ext/pgsql extension. 167 168======================================== 1693. Changes in SAPI modules 170======================================== 171 172- Added phpdbg SAPI. 173 (https://wiki.php.net/rfc/phpdbg) 174 175- Support for FPM workers changing the apparmor profile through the pool configuration. 176 (https://wiki.php.net/rfc/fpm_change_hat) 177 178- Support for several XML MIME types in the built-in CLI server. For static 179 files with extensions .xml, .xsl, .xsd the Content-Type header 180 application/xml is now sent automatically. 181 182======================================== 1834. Deprecated Functionality 184======================================== 185 186- Incompatible context calls: 187 Instance calls from an incompatible context are now deprecated and issue 188 E_DEPRECATED instead of E_STRICT. See https://wiki.php.net/rfc/incompat_ctx 189 190- The "CN_match" and "SNI_server_name" SSL context options are deprecated in 191 favor of the new "peer_name" option. Name verification now checks certificate 192 SAN names as well as the CN field and the specific name fields are deprecated 193 to avoid confusion. Their use triggers E_DEPRECATED but continues to work as 194 before. If specified, the specific values take precedence over the general 195 "peer_name" value. 196 197- Deprecated PDO::PGSQL_ATTR_DISABLE_NATIVE_PREPARED_STATEMENT, an 198 undocument constant effectively equivalent to PDO::ATTR_EMULATE_PREPARES. 199 200- Deprecated INIs: Following INIs are deprecated in favour of new 201 internal_encoding/input_encoding/output_encoding. Refer to "Changes to 202 encodings in PHP 5.6" in "11. Other Changes" section for more details. 203 204 iconv.input_encoding 205 iconv.output_encoding 206 iconv.internal_encoding 207 mbstring.http_input 208 mbstring.http_output 209 mbstring.internal_encoding 210 211======================================== 2125. Changed Functions 213======================================== 214 215- cURL: 216 CURLOPT_SAFE_UPLOAD is now turned on by default and uploads with @file 217 do not work unless it is explicitly set to false. 218 219 curl_setopt() now supports the following nullable settings (>= 5.5.11): 220 . CURLOPT_CUSTOMREQUEST 221 . CURLOPT_FTPPORT 222 . CURLOPT_RANGE 223 . CURLOPT_FTP_ACCOUNT 224 . CURLOPT_RTSP_SESSION_ID 225 . CURLOPT_KRBLEVEL 226 . CURLOPT_KRB4LEVEL 227 228 curl_getinfo($ch, CURLINFO_CERTINFO) returns certificate Subject and Issuer 229 as a string (PHP >= 5.6.25) 230 231- Strings: 232 substr_compare() now allows $length to be zero. 233 pack() and unpack() now support 64-bit format specifiers: q, Q, J and P. 234 235- Crypt: 236 crypt() will now raise an E_NOTICE error if the salt parameter is omitted. 237 See: https://wiki.php.net/rfc/crypt_function_salt 238 239- Mcrypt: 240 The $source parameter of mcrypt_create_iv() now defaults to 241 MCRYPT_DEV_URANDOM instead of MCRYPT_DEV_RANDOM. 242 243- OpenSSL: 244 The $crypto_type parameter is now optional in stream_socket_enable_crypto() 245 if the stream's SSL context specifies the new "crypto_type" option. The 246 crypto method from the context is used as a fallback if no crypto method is 247 specified at call-time. 248 249- Reflection: 250 ReflectionClass::newInstanceWithoutConstructor previously didn't allow the 251 instantiation of any internal class which used custom object storage 252 (overriding the default create_object handler), this was changed to only 253 reject the instantiation of such classes if the class is also marked as 254 final. 255 256- XMLReader: 257 XMLReader::getAttributeNs and XMLReader::getAttributeNo now return NULL if 258 the attribute could not be found, just like XMLReader::getAttribute. 259 260- Pgsql: 261 pg_insert()/pg_select()/pg_update()/pg_delete() are no longer EXPERIMENTAL. 262 The following functions no longer block until query write completion if the 263 socket stream underlying a database connection is set to non-blocking mode: 264 . pg_send_execute() 265 . pg_send_prepare() 266 . pg_send_query() 267 . pg_send_query_params() 268 269- unserialize: 270 Manipulated serialization strings for objects implementing Serializable by 271 replacing "C:" with "O:" at the start will now produce an error. 272 273- parse_ini_file(): 274- parse_ini_string(): 275 Added scanner mode INI_SCANNER_TYPED to yield typed .ini values. 276 For PHP >= 5.6.1 277 278- JSON: 279 Added JSON_PRESERVE_ZERO_FRACTION option (PHP >= 5.6.5) 280 281======================================== 2826. New Functions 283======================================== 284 285- Datetime: 286 Added DatePeriod::getStartDate(), DatePeriod::getEndDate(), DatePeriod::getDateInterval() in 5.6.5. 287 288- GMP: 289 Added gmp_root($a, $nth) and gmp_rootrem($a, $nth) for calculating nth roots. 290 Added gmp_import($data, $word_size = 1, $options = GMP_MSW_FIRST | GMP_NATIVE_ENDIAN) in PHP 5.6.1. 291 Added gmp_export($gmpnumber, $word_size = 1, $options = GMP_MSW_FIRST | GMP_NATIVE_ENDIAN) in PHP 5.6.1. 292 Added gmp_random_range() and gmp_random_bits() in PHP 5.6.3. 293 294- Hash 295 Added hash_equals($known_string, $user_string) 296 297- OpenSSL: 298 Added string openssl_x509_fingerprint($x509, $type, $binary). 299 Added string openssl_spki_new($private_key, $challenge, $algorithm) 300 Added bool openssl_spki_verify($spkac) 301 Added string openssl_spki_export($spkac) 302 Added string openssl_spki_export_challenge($spkac) 303 Added array openssl_get_cert_locations() 304 305- LDAP: 306 Added ldap_escape($value, $ignore = "", $flags = 0). 307 Added ldap_modify_batch($link_identifier, $dn, $modifications) described in 308 https://wiki.php.net/rfc/ldap_modify_batch. 309 310- Pgsql: 311 Added pg_socket($connection) to allow async connections and non-blocking IO 312 Added pg_connect_poll($connection) for establishing async connections 313 Added pg_consume_input($connection) for non-blocking query result consumption 314 Added pg_flush($connection) for non-blocking query write completion 315 316- PDO_pgsql 317 Added PDO::pgsqlGetNotify($result_type = PDO::FETCH_USE_DEFAULT, $ms_timeout = 0) 318 Added PDO::pgsqlGetPid() 319 320- Reflection 321 Added ReflectionFunction::isVariadic() and ReflectionParameter::isVariadic(). 322 323- SPL 324 Added SplFileObject::fread($length) to complement fwrite() method (>= 5.5.11) 325 326- Zip: 327 Added ZipArchive::setPassword($password) 328 329======================================== 3307. New Classes and Interfaces 331======================================== 332 333 334======================================== 3358. Removed Extensions 336======================================== 337 338 339======================================== 3409. Other Changes to Extensions 341======================================== 342 343- cURL: 344 - The following constants have been removed as they are now marked "obsolete" 345 in the underlying library and never had any effect to begin with: 346 . CURLOPT_CLOSEPOLICY 347 . CURLCLOSEPOLICY_CALLBACK 348 . CURLCLOSEPOLICY_LEAST_RECENTLY_USED 349 . CURLCLOSEPOLICY_LEAST_TRAFFIC 350 . CURLCLOSEPOLICY_OLDEST 351 . CURLCLOSEPOLICY_SLOWEST 352 353- GMP: 354 The GMP extension now uses objects as the underlying data structure, rather 355 than resources. GMP instances now support dumping, serialization, cloning, 356 casts to primitive types and have overloaded operators. 357 (RFC: https://wiki.php.net/rfc/operator_overloading_gmp) 358 359- OCI8: 360 - Added Implicit Result Set support for Oracle Database 12c with a 361 new oci_get_implicit_resultset() function. 362 - Using 'oci_execute($s, OCI_NO_AUTO_COMMIT)' for a SELECT no longer 363 unnecessarily initiates an internal ROLLBACK during connection 364 close. 365 - Multi-row OCI_RETURN_LOB queries require fewer "round trips" to the database. 366 - Added DTrace probes enabled with PHP's generic --enable-dtrace 367 - The oci_internal_debug() function is now a no-op. 368 - The phpinfo() output format for OCI8 has changed. 369 370- OpenSSL: 371 - The "SNI_enabled" SSL stream context option is now set to TRUE by default 372 if supported by the underlying openssl library. 373 374- PCRE: 375 - The information collected by the (*MARK) backtracking control verb is now 376 collected into the "MARK" index of the $matches array for preg_match(), 377 preg_match_all() and preg_replace_callback(). 378 379- Pgsql: 380 - pg_insert()/pg_select()/pg_update()/pg_delete()/pg_meta_data()/pg_convert() 381 are no longer EXPERIMENTAL 382 - Added PGSQL_DML_ESCAPE option for pg_insert()/pg_select()/pg_update()/pg_delete() 383 that simply escapes all supplied parameters. These functions can be as fast as 384 native query. Unvalidated data(Unknown data types) is passed as string. 385 JSON/Array/etc are supported both PGSQL_DML_ESCAPE and pg_convert() as string. 386 - pg_select() returns PostgreSQL query resource when query is executed. 387 - Added extended flag parameter for pg_meta_data(). pg_meta_data() always 388 returns "is enum" attribute. 389 - The new pg_socket() function returns a socket stream with no behavior other 390 than to allow IO-readiness polling on a DB connection socket. Calling 391 stream_set_blocking() on its result enables non-blocking behavior. 392 - Passing the new PGSQL_CONNECT_ASYNC flag to pg_connect() allows applications 393 to poll for IO readiness via pg_connect_poll() and establish connections 394 asynchronously. 395 396- PDO_pgsql: 397 - Added PDO::PGSQL_ATTR_DISABLE_PREPARES constant to execute the queries 398 without preparing them, while still passing parameters separately from 399 the command text using PQexecParams. 400 - Added LISTEN/NOTIFY support via PDO::pgsqlGetNotify / PDO::pgsqlGetPid() 401 as described in https://bugs.php.net/bug.php?id=42614. 402 403- DOM: 404 - DOMNode::textContent is now a writeable property. (>= 5.6.1) 405 406======================================== 40710. New Global Constants 408======================================== 409 410- CURL: 411 CURL_HTTP_VERSION_2_0 and CURL_VERSION_HTTP2 (>= 5.6.8) 412 413- GD: 414 IMG_WEBP (>= 5.6.25) 415 416- LDAP: 417 LDAP_ESCAPE_FILTER int(1) 418 LDAP_ESCAPE_DN int(2) 419 420- Pgsql: 421 PGSQL_DML_ESCAPE int(4096) 422 PGSQL_CONNECT_ASYNC 423 PGSQL_CONNECTION_STARTED 424 PGSQL_CONNECTION_MADE 425 PGSQL_CONNECTION_AWAITING_RESPONSE 426 PGSQL_CONNECTION_AUTH_OK 427 PGSQL_CONNECTION_SSL_STARTUP 428 PGSQL_CONNECTION_SETENV 429 PGSQL_POLLING_FAILED 430 PGSQL_POLLING_READING 431 PGSQL_POLLING_WRITING 432 PGSQL_POLLING_OK 433 PGSQL_POLLING_ACTIVE 434 435- OpenSSL: 436 STREAM_CRYPTO_METHOD_TLSv1_0_CLIENT int(9) 437 STREAM_CRYPTO_METHOD_TLSv1_1_CLIENT int(17) 438 STREAM_CRYPTO_METHOD_TLSv1_2_CLIENT int(33) 439 STREAM_CRYPTO_METHOD_ANY_CLIENT int(63) 440 STREAM_CRYPTO_METHOD_TLSv1_0_SERVER int(8) 441 STREAM_CRYPTO_METHOD_TLSv1_1_SERVER int(16) 442 STREAM_CRYPTO_METHOD_TLSv1_2_SERVER int(32) 443 STREAM_CRYPTO_METHOD_ANY_SERVER int(62) 444 OPENSSL_DEFAULT_STREAM_CIPHERS string 445 446======================================== 44711. Changes to INI File Handling 448======================================== 449 450- Core: 451 Changed always_populate_raw_post_data to throw a deprecation warning when 452 enabled and to recognize the value -1 for never populating the global 453 $HTTP_RAW_POST_DATA variable, which will be default in future PHP versions. 454 455 default_charset is set to UTF-8. It was empty previously. default_charset 456 is used where it is applicable. Iconv/Mbstring/htmlentities/htmlspecialchars/ 457 html_entity_decode use default_charset as default encoding. 458 459 internal_encoding/input_encoding/output_encoding is added for encoding 460 handling modules. Refer to "Changes to encodings in PHP 5.6" in "11. Other Changes" 461 section for more details. 462 463- cURL: 464 If the new openssl.cafile ini directive is specified ext/curl will give the 465 openssl path precedence over its own curl.cainfo directive. 466 467- OpenSSL: 468 openssl.cafile and openssl.capath ini directives have been added to allow 469 global CA default specification as necessary. 470 471======================================== 47212. Other Changes 473======================================== 474 475- File upload: 476 Uploads equal or greater than 2GB in size are now accepted. 477 478- HTTP stream wrapper: 479 HTTP 1.1 requests now include a Connection: close header unless explicitly 480 overridden by setting a Connection header via the header context option. 481 482- PDO_pgsql 483 A libpq version providing PQexecParams, PQprepare, PQescapeStringConn, 484 PQescapeByteaConn is now required. According to the release notes that means 485 8.0.8+ or 8.1.4+. 486 487- Zip: 488 New --with-libzip option allow to use system libzip. Version > 0.11 required, 489 Version >= 0.11.2 recommended for all features. 490 491- Changes to encodings in PHP 5.6 492 The default value of default_charset is now UTF-8 when it is not 493 explicitly set in php.ini 494 495 The following php.ini parameters were added: 496 internal_encoding 497 input_encoding 498 output_encoding 499 500 The values of the following php.ini parameters have become empty in 501 PHP 5.6 (previously they were all ISO-8859-1) 502 503 iconv.input_encoding 504 iconv.output_encoding 505 iconv.internal_encoding 506 507 Changes were made to character set handling in: 508 - the iconv and mbstring extensions, 509 - and htmlentities(), htmlspecialchars(), html_entity_decode() functions 510 511 The precedence for these is now: 512 513 default_charset < internal/input/output_encoding < (mbstring.* || iconv.*) < function parameter 514 515 For example, the easiest way to use the UTF-8 encoding is to set 516 default_charset=UTF-8 and leave the following php.ini parameters 517 518 empty: 519 520 iconv.input_encoding 521 iconv.output_encoding 522 iconv.internal_encoding 523 mbstring.http_input 524 mbstring.http_output 525 mbstring.internal_encoding 526 internal_encoding 527 input_encoding 528 output_encoding 529 530 The mb_regex_encoding() default setting is changed from EUC-JP to UTF-8. 531 532
