php-src/UPGRADING

$Id$

PHP 5.5 UPGRADE NOTES

1.  Backward Incompatible Changes
2.  New Features
2.  Changes in SAPI modules
3.  Deprecated Functionality
4.  Changed Functions
    a. unserialize() change
5.  New Functions
6.  New Classes and Interfaces
7.  Removed Extensions
8.  Other Changes to Extensions
9.  New Global Constants
10. Changes to INI File Handling
11. Windows Support
12. Other Changes


========================================
1. Backward Incompatible Changes
========================================

- Dropped Windows XP and 2003 support. (Pierre)

- All internal case insensitivity handling for class, function and constant
  names is done according to ASCII rules.  Current locale settings are ignored.

- self, parent & static keywords now are always case-insensitive (see bug
  #60833).

- Removed Logo GUIDs: php_logo_guid(), php_egg_logo_guid(),
  php_real_logo_guid() and zend_logo_guid()

========================================
2. New Features
========================================

- Support list in foreach. (Laruence)
  (http://php.net/foreach#control-structures.foreach.list,
  http://wiki.php.net/rfc/foreachlist)

- Support "finally" keyword. (Laruence)
  (http://php.net/exceptions, http://wiki.php.net/rfc/finally)

- Support constant array/string dereferencing. (Laruence)
  (http://php.net/manual/en/language.types.array.php,
   https://wiki.php.net/rfc/constdereference)

- Add support for using empty() on the result of function calls and
  other expressions. Thus it is now possible to write empty(getArray()),
  for example. (http://php.net/manual/en/function.empty.php,
  https://wiki.php.net/rfc/empty_isset_exprs)

- Added generators.
  (http://php.net/generators, https://wiki.php.net/rfc/generators)

- ClassName::class syntax returning full class name for a class as a
  string constant.  (http://php.net/oop5.basic,
  https://wiki.php.net/rfc/class_name_scalars)

- Added support for non-scalar Iterator keys in foreach.
  (http://php.net/manual/en/control-structures.foreach.php,
  https://wiki.php.net/rfc/foreach-non-scalar-keys).

- Bundled Zend OPcache extension to improve performance
  (http://php.net/manual/en/book.opcache.php,
  https://wiki.php.net/rfc/optimizerplus)

- Added a simplified password hashing API
  (http://php.net/password, https://wiki.php.net/rfc/password_hash)

========================================
2. Changes in SAPI modules
========================================

- Support for changing the process's title in CLI/CLI-Server
  SAPIs. (Keyur)
  (http://php.net/manual/en/function.cli-set-process-title.php,
  http://php.net/manual/en/function.cli-get-process-title.php,
  https://wiki.php.net/rfc/cli_process_title)

- Support for systemd in php-fpm: Add --with-fpm-systemd option to
  report health to systemd, and add systemd_interval option to
  configure this. The service can now use Type=notify in the systemd
  unit file. (Remi)

- Support for several XML MIME types in the built-in CLI server. For static
  files with extensions .xml, .xsl, .xsd the Content-Type header
  application/xml is now sent automatically.

========================================
3. Deprecated Functionality
========================================

- The original MySQL extension is now deprecated and will generate
  deprecation warnings when connecting to a database through
  mysql_connect(), mysql_pconnect() or by establishing an implicit
  connection. Use MySQLi or PDO instead.

- The preg_replace /e modifier is now deprecated.  Use
  preg_replace_callback instead.
  (https://wiki.php.net/rfc/remove_preg_replace_eval_modifier)

- IntlDateFormatter::setTimeZoneID() and datefmt_set_timezone_id() are
  deprecated. Use IntlDateFormatter::setTimeZone() or
  datefmt_set_timezone() instead.

- mcrypt_ecb(), mcrypt_cbc(), mcrypt_cfb() and mcrypt_ofb() now throw
  E_DEPRECATED. Their use was already previously discouraged in the
  documentation, but that predated the existence of E_DEPRECATED.

========================================
4. Changed Functions
========================================

- pack()/unpack() had the following changes, which bring it more in
  line with Perl's behavior: - Implemented format character "Z": NULL
  padded string, with trailing NULL bytes removed.  - Changed format
  character "a": this no longer removes trailing NULL bytes.  -
  Changed format character "A": all trailing ASCII whitespace is now
  removed (defined as spaces, tabs, \r, \n and NULL).

- MessageFormatter::format() and related functions now accepted named
  arguments and mixed numeric/named arguments in ICU 4.8+.

- MessageFormatter::format() and related functions now don't error out
  when an insufficient argument count is provided. Instead, the
  placeholders will remain unsubstituted.

- MessageFormatter::parse() and MessageFormat::format() (and their
  static equivalents) now don't throw away better than second
  precision in the arguments.

- IntlDateFormatter::__construct and datefmt_create() now accept for
  the $timezone argument time zone identifiers, IntlTimeZone objects,
  DateTimeZone objects and NULL. It used to accept only time zone
  identifiers and NULL.  Invalid time zone identifiers are no longer
  accepted. Empty strings are no longer accepted.

- The default time zone used in IntlDateFormatter::__construct and
  datefmt_create() (when the corresponding argument is not passed or
  NULL is passed) is now the one given by date_default_timezone_get(),
  not the default ICU time zone.

- The time zone passed to the IntlDateFormatter is ignored if it is
  NULL and if the calendar passed is an IntlCalendar object -- in this
  case, the IntlCalendar's time zone will be used instead. Otherwise,
  the time zone specified in the $timezone argument is used
  instead. This does not affect old code, as IntlCalendar was
  introduced in this version.

- IntlDateFormatter::__construct and datefmt_create() now accept for
  the $calendar argument also IntlCalendar objects.

- IntlDateFormatter::getCalendar() and datefmt_get_calendar() return
  false if the IntlDateFormatter was set up with an IntlCalendar
  instead of the constants
  IntlDateFormatter::GREGORIAN/TRADITIONAL. IntlCalendar did not exist
  before this version.

- IntlDateFormatter::setCalendar() and datefmt_set_calendar() now also
  accept an IntlCalendar object, in which case its time zone is
  taken. Passing a constant is still allowed, and still keeps the time
  zone.

- IntlDateFormatter::format() and datefmt_format() now also accept an
  IntlCalendar object for formatting.

- set_error_handler(NULL) can now be used to reset the error handler.
  Furthermore both set_error_handler(NULL) and
  set_exception_handler(NULL) will now return the previously defined
  error/exception handler. Previously bool(true) was returned.

- setcookie(), setrawcookie() and ext/session now send Max-Age headers
  alongside Expires headers. (see
  https://wiki.php.net/rfc/cookie_max-age)

- curl_setopt now accepts new option CURLOPT_SAFE_UPLOAD and CURLFile
  object for safer file uploads (see
  https://wiki.php.net/rfc/curl-file-upload)

- Functions in the socket extension now do not emit warnings when the
  errno is EAGAIN, EWOULDBLOCK or EINPROGRESS.

- Since 5.5.2, spl_autoload_functions() returns different names for 
  different lambda functions registered via spl_autoload_register().

- Since 5.5.3, DOMDocument::schemaValidateSource() and 
  DOMDocument::schemaValidate() accept flag parameter. Only flag 
  available now is LIBXML_SCHEMA_CREATE. Default is 0.

- Since 5.5.4, fputcsv() has fifth parameter escape_char, allowing to
  specify escape char.

4a. unserialize() change
------------------------

- Starting PHP 5.5.13, the bug fix for bug #67072 introduces a change to 
  unserialize() function, detailed below:

    If the string looking like 'O:..:"ClassName":...' is unserialized, and
    the class named is an internal class that declares custom unserializer
    function, or extends such class, unserialize would fail.

    Using O: for user classes not extending internal classes (including
    those implementing Serializable) is still supported in 5.4, though
    it is deprecated and may not be supported in 5.6 for classes that do not 
    originally serialize to O:. Same for using O: for internal classes 
    implementing Serializable (like ArrayObject) and classes that extend 
    them.

    The reason for that is that O: format is meant to be used with classes
    that do not define custom handlers, and was never intended for the use
    with classes that do. When used with the class that relies on custom
    unserializer, it can leave the object of such internal class in an
    inconsistent state which has been observed to result in crashes and may
    also lead to memory corruption and ultimately even arbitrary code
    execution. This was never the intended use of unserializer, and mere
    possibility of doing this constitutes a bug, since the data passed to
    unserialize() is not a valid serialization of any object. Since there
    are many applications applying unserialize() to untrusted data, this
    presents a potential security vulnerability. Thus, keeping such bug in
    the code base was considered too dangerous.

    We are aware that some applications use O: format as a way to
    instantiate classes. This was never the intended usage of serializer,
    and ReflectionClass methods such as newInstance or
    newInstanceWithoutConstructor can be used for that. We're working on
    providing more comprehensive solution for such use cases in PHP 5.6 and
    welcome the ideas in this area.

    We note also that using unserialize() on any data that is not the result
    of serialize() call continues to be an unsupported scenario and should
    not be relied on to produce any specific result.

========================================
5. New Functions
========================================

- Core:
  - array_column()
  - boolval()
  - password_get_info()
  - password_hash()
  - password_needs_rehash()
  - password_verify()

- cURL:
  - curl_file_create

- GD
  - imageflip
  - imagecrop
  - imagecropauto
  - imagesetinterpolation
  - imageaffine
  - imageaffinematrixget
  - imageaffinematrixconcat
  - imagescale

- Hash:
  - hash_pbkdf2()

- Intl:
  - datefmt_format_object()
  - datefmt_get_calendar_object()
  - datefmt_get_timezone()
  - datefmt_set_timezone()
  - datefmt_get_calendar_object()
  - intlcal_create_instance()
  - intlcal_get_keyword_values_for_locale()
  - intlcal_get_now()
  - intlcal_get_available_locales()
  - intlcal_get()
  - intlcal_get_time()
  - intlcal_set_time()
  - intlcal_add()
  - intlcal_set_time_zone()
  - intlcal_after()
  - intlcal_before()
  - intlcal_set()
  - intlcal_roll()
  - intlcal_clear()
  - intlcal_field_difference()
  - intlcal_get_actual_maximum()
  - intlcal_get_actual_minimum()
  - intlcal_get_day_of_week_type()
  - intlcal_get_first_day_of_week()
  - intlcal_get_greatest_minimum()
  - intlcal_get_least_maximum()
  - intlcal_get_locale()
  - intlcal_get_maximum()
  - intlcal_get_minimal_days_in_first_week()
  - intlcal_get_minimum()
  - intlcal_get_time_zone()
  - intlcal_get_type()
  - intlcal_get_weekend_transition()
  - intlcal_in_daylight_time()
  - intlcal_is_equivalent_to()
  - intlcal_is_lenient()
  - intlcal_is_set()
  - intlcal_is_weekend()
  - intlcal_set_first_day_of_week()
  - intlcal_set_lenient()
  - intlcal_equals()
  - intlcal_get_repeated_wall_time_option()
  - intlcal_get_skipped_wall_time_option()
  - intlcal_set_repeated_wall_time_option()
  - intlcal_set_skipped_wall_time_option()
  - intlcal_from_date_time()
  - intlcal_to_date_time()
  - intlcal_get_error_code()
  - intlcal_get_error_message()
  - intlgregcal_create_instance()
  - intlgregcal_set_gregorian_change()
  - intlgregcal_get_gregorian_change()
  - intlgregcal_is_leap_year()
  - intltz_create_time_zone()
  - intltz_create_default()
  - intltz_get_id()
  - intltz_get_gmt()
  - intltz_get_unknown()
  - intltz_create_enumeration()
  - intltz_count_equivalent_ids()
  - intltz_create_time_zone_id_enumeration()
  - intltz_get_canonical_id()
  - intltz_get_region()
  - intltz_get_tz_data_version()
  - intltz_get_equivalent_id()
  - intltz_use_daylight_time()
  - intltz_get_offset()
  - intltz_get_raw_offset()
  - intltz_has_same_rules()
  - intltz_get_display_name()
  - intltz_get_dst_savings()
  - intltz_from_date_time_zone()
  - intltz_to_date_time_zone()
  - intltz_get_error_code()
  - intltz_get_error_message()

  - IntlDateFormatter::formatObject()
  - IntlDateFormatter::getCalendarObject()
  - IntlDateFormatter::getTimeZone()
  - IntlDateFormatter::setTimeZone()

- LDAP:
  - ldap_modify_batch() (5.5.10)

- SOAP:
  - SoapClient::__getCookies() (5.5.14)

- Sockets:
  - socket_sendmsg()
  - socket_recvmsg()
  - socket_cmsg_space()

- SPL:
  - SplFixedArray::__wakeup()
  - SplDoublyLinkedList::add()
  - RecursiveTreeIterator::getPostfix() (5.5.2)
  - RecursiveTreeIterator::setPostfix() (5.5.2)

- Zend OPcache:
 - opcache_get_configuration()
 - opcache_get_status()
 - opcache_reset()

========================================
6. New Classes and Interfaces
========================================

- Intl:
  - IntlCalendar
  - IntlGregorianCalendar
  - IntlTimeZone
  - IntlBreakIterator
  - IntlRuleBasedBreakIterator
  - IntlCodePointBreakIterator
  - UConverter

- cURL:
  - CURLFile

========================================
7. Removed Extensions
========================================

None

========================================
8. Other Changes to Extensions
========================================

- Intl:
  - This extension now requires ICU 4.0+.
- Phar:
  - Added ability of resolving alias created by Phar::map

========================================
9. New Global Constants
========================================

- mysqli:
  - Added MYSQLI_SERVER_PUBLIC_KEY constant to be used with mysqli_options()

- cURL:
  - Added CURLOPT_SAFE_UPLOAD to be used with curl_setopt().
  - Added CURL_WRAPPERS_ENABLED to reflect --with-curlwrappers.

- GD
  - Added constants for imageflip:
    . IMG_FLIP_HORIZONTAL
    . IMG_FLIP_VERTICAL
    . IMG_FLIP_BOTH
  - Added constants for imagecrop
    . IMG_CROP_DEFAULT
    . IMG_CROP_TRANSPARENT
    . IMG_CROP_BLACK
    . IMG_CROP_WHITE
    . IMG_CROP_SIDES
    . IMG_CROP_THRESHOLD
  - Added constants for imagesetinterpolation, used by imagescale
    imagerotate and imageaffine:
    . IMG_BELL
    . IMG_BESSEL
    . IMG_BILINEAR_FIXED
    . IMG_BICUBIC
    . IMG_BICUBIC_FIXED
    . IMG_BLACKMAN
    . IMG_BOX
    . IMG_BSPLINE
    . IMG_CATMULLROM
    . IMG_GAUSSIAN
    . IMG_GENERALIZED_CUBIC
    . IMG_HERMITE
    . IMG_HAMMING
    . IMG_HANNING
    . IMG_MITCHELL
    . IMG_POWER
    . IMG_QUADRATIC
    . IMG_SINC
    . IMG_NEAREST_NEIGHBOUR
    . IMG_WEIGHTED4
    . IMG_TRIANGLE
  - Added constants for imageaffinematrixget
    . IMG_AFFINE_TRANSLATE
    . IMG_AFFINE_SCALE
    . IMG_AFFINE_ROTATE
    . IMG_AFFINE_SHEAR_HORIZONTAL
    . IMG_AFFINE_SHEAR_VERTICAL

========================================
10. Changes to INI File Handling
========================================

- Core:
  - Added sys_temp_dir INI directive, for specifying temporary
    directory.

- Intl:
  - Added intl.use_exceptions INI directive, which controls what
    happens when global errors are set together with intl.error_level.

- MSSQL:
  - mssql.compatability_mode renamed to mssql.compatibility_mode in 5.5.2,
    old directive still supported for BC reasons.

- mysqlnd:
  - Added mysqlnd.sha256_server_public_key INI PERDIR setting that
    affects all APIs which use(are built) for mysqlnd. This allows
    ext/mysqli to be used with the new auth protocol, although at
    coarser level.

- Sessions:
  - Added session.use_strict_mode in 5.5.3, which prevents session
    fixation attacks and session collisions. 
    See also https://wiki.php.net/rfc/strict_sessions

- Zend OPcache (See http://php.net/manual/en/book.opcache.php)
  - Added the following directives:
    - opcache.enable (default "1")
    - opcache.memory_consumption (default "64")
    - opcache.interned_strings_buffer (default "4")
    - opcache.max_accelerated_files (default "2000")
    - opcache.max_wasted_percentage (default "5")
    - opcache.use_cwd (default "1")
    - opcache.validate_timestamps (default "1")
    - opcache.revalidate_freq (default "2")
    - opcache.revalidate_path (default "0")
    - opcache.save_comments (default "1")
    - opcache.load_comments (default "1")
    - opcache.fast_shutdown (default "0")
    - opcache.enable_file_override (default "0")
    - opcache.optimization_level (default "0xffffffff")
    - opcache.inherited_hack (default "1")
    - opcache.blacklist_filename (default "")
    - opcache.max_file_size (default "0")
    - opcache.consistency_checks (default "0")
    - opcache.force_restart_timeout (default "180")
    - opcache.error_log (default "" which means stderr)
    - opcache.log_verbosity_level (default "1")
    - opcache.preferred_memory_model (default "")
    - opcache.protect_memory (default "0")
    - opcache.mmap_base (Windows-only)

========================================
11. Windows Support
========================================

- The Apache 2.4 handler is supported as of PHP 5.5.0

- OPcache: Errors like 'unable to reattach to base address' could
  happen in many common setups.  It is due to some technical and
  design restriction in the engine and could not be fixed easily
  before 5.5.0 was released.

  A possible fix is to tweak the opcache.mmap_base INI setting by
  forcing the first address to be tried.

  For x86 version, the following addreses can be tried:
        .  0x20000000, 0x21000000, 0x30000000, 0x31000000, 0x50000000
  and for x64 (still experimental):
        . 0x0000100000000000, 0x0000200000000000, 0x0000300000000000, 0x0000700000000000

========================================
12. Other Changes
========================================

- If the APC or WinCache user cache APIs were used before, consider
   these alternatives for PHP 5.5:

  - APCu
      - all supported OSes: http://pecl.php.net/package/APCu
      - Windows: http://windows.php.net/downloads/pecl/releases/apcu/

  - WinCache, Windows only: http://pecl.php.net/package/WinCache