WHat's new in PHP 8.2

MergePHP December 2022

Ian Littman

@ian@phpc.social / @iansltx

https://ian.im/php82merge

It's Live!

Thanks to release managers Ben Ramsey, Pierrick Charron, and Sergey Panteleev

What we'll cover

• Where to get it now
• What's new
• What's deprecated/removed
• How to find out more information

How do I get it?

• macOS

  • brew tap shivammathur/php

  • brew install php@8.2

• Ubuntu/Debian instructions (aka use Ondrej's repo)
• Red Hat-based: use Remi's repo
• Inside Docker: e.g. php:8.2.0-fpm-alpine3.17
• Windows builds can be downloaded here
• Source code to build yourself is on php.net

New Features

Before

class Post
{

    public readonly string $title;
    public readonly Status $status;

    // snip
}

After

readonly class Post
{

    public string $title;
    public Status $status;

    // snip
}

Readonly Classes

This also disables dynamic properties and untyped properties (use "mixed")

Type improvements

• Disjunctive Normal Form (DNF) types
  • (A&B)|C -> Must be both A and B, or C; builds on:
    • A&B -> Must implement/extend/be both A and B (PHP 8.1)
    • A|C -> Must be either A or C (PHP 8.0)
  • Parentheses required when OR'ing AND'd types
  • One layer of nesting; (A&(B|C)) is not valid
  • Only intersections in parentheses: A&(B|D) is not valid
• New standalone types
  • null and false
  • true
  • Powerful when combined with union or DNF types

Random extension

• random_* functions, plus e.g. rand/srand/mt_rand, now live in this extension
• New Random\Randomizer class
  • Takes a Random\Engine impl (default "Secure")

  • nextInt(): int

  • getInt(int $min, int $max): int

  • getBytes(int $length): string

  • shuffleArray(array $array): array

  • shuffleBytes(string $bytes): string

  • pickArrayKeys(array $array, int $num): array

  • __serialize()/__unserialize()

Random Engines

namespace Random;

interface Engine {
    public function generate(): string;
}

interface CryptoSafeEngine extends Engine {}

• Non-crypto-safe, seedable Engines

  • Mt19937 (Mersenne Twister, from mt_rand)

  • PcgOneseq128XslRr64 (Permutated congruential generator)
  • Xoshiro256StarStar (Xoshiro); fastest randomizer
• Secure (same method as random_int/bytes uses; only CryptoSafe engine)
• Implement your own (for mocks, plz no rolling your own crypto)

Constants in traits!

• Cannot be referenced directly
• Cannot collide with already-declared constants in class
  • Can be redeclared in the class using the trait, but must be compatible
    • Same visibility
    • Same value
    • Same finality (final consts are new in PHP 8.1)
  • Can import multiple traits with the same constants
    as long as they're compatible

Sansitive Parameter Value Redaction

Enum properties in constant expressions

enum A: string 
{
    case B = 'B';
    
    const C = [self::B->value => self::B];
}

Useful primarily for array keys mapping to enum names/values

minor tweaks

• DateTime*::createFrom*() now return static

• PCRE no-auto-capture modifier

• ini_parse_quantity(), e.g. '256M' -> 268435456

• curl_upkeep() to keep a conneciton alive

• CURLINFO_EFFECTIVE_METHOD (e.g. form POST redirected to GET)

• memory_reset_peak_usage()

• $mysqli->execute_query($sql, $params)

• error_log_mode INI setting for when PHP creates the file

• openssl_cipher_key_length($cipher_algo): int|false

• ZipArchive::getStreamIndex(), getStreamName(), clearError()

• ReflectionFunction::isAnonymous() and ReflectionMethod::isPrototype()

• libxml_get_external_entity_loader(), sodium_crypto_stream_xchacha_xor_id()

BC Breaks and Deprecations

Dynamic properties

• Deprecation -> fatal in PHP 9.0
• Can still use __set/__get
• Can still use \stdClass
• Can opt out of warning via #[AllowDynamicProperties] attribute
  • Attribute is automatically inherited

Function deprecations

• utf8_encode(), utf8_decode()
• strtolower(), strtoupper() locale sensitivity (use mb_strto*)
  • Other string functions are also affected
• mbstring encodings (base64, uuencode, qprint, HTML entity)
  • Use dedicated functions instead, leaving mbstring for Unicode

Other Deprecations

• ${} string interpolation; {$} syntax still works
• Callable forms that work with call_user_func($callable) but not $callable(),
  e.g. "self::method", ["parent", "method"], [new Foo, "Bar::method"]
• SplFileInfo::_bad_state_ex​

Other Changes

• SplFileInfo/Object signature changes
• ODBC usernames and passwords (including PDO) are now escaped
• MySQLi can no longer be compiled with libmysqli (mysqlnd only)
  • You can still compile pdo_mysql with libmysql
• INI parsing will now warn on invalid integer (or SI unit, e.g. K/M/G) values
• ksort() with SORT_REGULAR flag now sorts numbers first, then letters
• str_split('') now returns an empty array

Further Reading

• php.watch/versions/8.2

• stitcher.io/blog/new-in-php-82

• php.net/releases/8.2

Thanks! Questions?

• This talk: ian.im/php82merge
• GitHub: github.com/iansltx
• Fediverse: phpc.social/@ian
• Twitter: @iansltx