Deprecation by Installments

Finally, some features, functions, and syntax elements have been marked as deprecated. For example, PHP programmers should no longer declare constants that are case insensitive: PI and Pi are different constants in PHP 7.3. If you pass in TRUE as the third parameter in define(), and thus try to create a case-insensitive constant, you will now see a warning.

PHP provides several functions that search for a string in text and accept the text to be searched for in a parameter referred to as a "needle." From now on, the needle must consist of a string. The PHP authors recommend casting the needle into a string if in doubt or explicitly using the chr() function. Other functions affected by this change are strpos(), strrpos(), stripos(), strripos(), strstr(), strchr(), strrchr(), and stristr().

As of PHP 7.3, developers can no longer declare assert() within a namespace. The fgetss() and gzgetss() functions, the SplFileObject::fgetss() method, and the string.strip_tags stream filter are also considered obsolete. In the future, PHP programmers will also have to do without the FILTER _FLAG_SCHEME_REQUIRED and FILTER_FLAG_HOST_REQUIRED constants. However, both are included in FILTER_VALIDATE_URL, which is still available.

The PHP team sorted out image2wbmp() and all the undocumented functions that start with mbereg_. Instead of the latter, PHP programmers should now use the mb_ereg_ functions. When accessing ODBC and DB2 databases via the PDO_ODBC driver, the pdo_odbc.db2_instance_name setting is history.

Expired

Support for PHP 5.6 and 7.0 was discontinued at the end of 2018, so the developers will no longer be fixing vulnerabilities in these versions. Various statistics show, however, that the old versions are still used on many websites. At the beginning of 2019, almost two thirds of all Joomla installations still ran PHP version 5.6 or earlier [2] (Figure 1) – a rough estimate, because not all Joomla site operators send their data to the developers.

Figure 1: PHP version legend clockwise from the orange section: versions 5.3-5.6 and 7.0-7.2.

Metasploit provider Rapid7 reports similarly worrying figures. As part of the Sonar project, Rapid7 regularly scans the Internet and collects information about the software in use. In December 2018, the statistics showed around 3 million sites with an outdated PHP version [3].

If you still have an older version, you should switch to the current PHP, if possible, because the days of PHP 7.1 are numbered. The developers are currently only providing security updates for this version, but this support will be terminated December 1, 2019 (Figure 2). The PHP team has actively supported only PHP 7.2 and 7.3 since January 1, 2019, with the first of these receiving only one year of security patches as of November 30, 2019 [4].

Figure 2: According to the timeline on the PHP website, the service life of PHP 5.5, 5.6, and 7.0 has already expired.

Conclusions

If you're starting a new PHP project, your best choice is version 7.3, which has some useful new features. Although manageable, the new kids on the block can disrupt existing software. Site operators and web developers are therefore well advised to adapt existing scripts, especially if PHP 5.6 or 7.0 is still in use. The PHP team has published a migration guide for programmers on its website that explains the differences between versions 7.2 and 7.3 [5].