PHP 7.3 and forbidden functions

Last month PHP 7.3.0 was released and with that a lot of functions or aliases were deprecated that may lead to issues down the road. While Xdebug still needs to be released for PHP 7.3 an automated test with GitLab isn’t possible yet as the build phase of Xdebug fails. Luckily I’m using PHP Code Sniffer and extending phpcs.xml.dist with the lines below make the build already fail if any of the forbidden functions are being used in the code.

    <!-- Ban some functions -->
    <rule ref="Generic.PHP.ForbiddenFunctions">
        <properties>
            <property name="forbiddenFunctions" type="array">
                <!-- Deprecated Features 7.0, https://secure.php.net/manual/en/migration70.deprecated.php -->
                <element key="ldap_sort" value="null"/>
                <!-- Deprecated Features 7.1, https://secure.php.net/manual/en/migration71.deprecated.php -->
                <!-- Deprecated Features 7.2, https://secure.php.net/manual/en/migration72.deprecated.php -->
                <element key="create_function" value="null"/>
                <element key="each" value="null"/>
                <element key="gmp_random" value="null"/>
                <element key="read_exif_data" value="exif_read_data"/>
                <element key="png2wbmp" value="null"/>
                <element key="jpeg2wbmp" value="null"/>
                <element key="__autoload" value="null"/>
                <!-- Deprecated Features 7.3, https://secure.php.net/manual/en/migration73.deprecated.php -->
                <!-- Searching Strings for non-string Needle -->
                <element key="strpos" value="chr"/>
                <element key="strrpos" value="chr"/>
                <element key="stripos" value="chr"/>
                <element key="strstr" value="chr"/>
                <element key="stristr" value="chr"/>
                <element key="strchr" value="chr"/>
                <element key="strrchr" value="chr"/>
                <!-- Strip-Tags Streaming -->
                <element key="fgetss" value="fgets"/>
                <element key="gzgets" value="gzgets"/>
                <!-- Image Processing and GD -->
                <element key="image2wbmp" value="imagewbmp"/>
                <!-- Multibyte String -->
                <element key="mbregex_encoding" value="mb_regex_encoding"/>
                <element key="mbreg" value="mb_ereg"/>
                <element key="mbregi" value="mb_eregi"/>
                <element key="mbreg_replace" value="mb_ereg_replace"/>
                <element key="mbregi_replace" value="mb_eregi_replace"/>
                <element key="mbsplit" value="mb_split"/>
                <element key="mbreg_match" value="mb_ereg_match"/>
                <element key="mbreg_search" value="mb_ereg_search"/>
                <element key="mbreg_search_post" value="mb_ereg_search_post"/>
                <element key="mbreg_search_regs" value="mb_ereg_search_regs"/>
                <element key="mbreg_search_init" value="mb_ereg_search_init"/>
                <element key="mbreg_search_getregs" value="mb_ereg_search_getregs"/>
                <element key="mbreg_search_getpos" value="mb_ereg_search_getpos"/>
                <element key="mbreg_search_setpos" value="mb_ereg_search_setpos"/>
            </property>
        </properties>
    </rule>

Hopefully PHP Code Sniffer will be extended to check on deprecated constants as well, but for now all code running on PHP 7.2 can be checked to run smoothly on PHP 7.3 and later.

Published by Hans Spaans

Unix & security consultant with a passion for Linux, Solaris, PostgreSQL, Perl and network services, but also a strong believer in open and free source, standards and content.