PHP 4.2: What's New, Release History & Support Lifecycle

What Is New in PHP 4.2

Why did PHP 4.2 change the default for register_globals?

PHP 4.2 flipped the default value of the register_globals directive from ON to OFF. This was a major security-focused change to prevent variables from user input (like GET, POST, and COOKIE data) from being automatically created as global variables.

In practice, this meant developers had to explicitly access user data through the $_GET, $_POST, and $_COOKIE superglobal arrays instead of relying on magically created variables. This change forced better coding habits and significantly reduced a common class of security vulnerabilities.

What new output handler was introduced?

The ob_iconv_handler() output handler was added. This function works with PHP's output buffering system to convert character encoding on the fly.

You use it with ob_start() to automatically convert the internal character set of your script to a different one before sending it to the browser. This was particularly useful for ensuring consistent character encoding in multilingual applications.

ob_start("ob_iconv_handler");
// Output some content in internal encoding
echo $content;
// The buffer is converted and sent to the browser
ob_end_flush();

Were there other notable changes in this release?

Beyond the headline security change, PHP 4.2 included a range of bug fixes and minor improvements. The release focused on stability and closing potential issues that existed in previous 4.x versions.

Fixes were applied across various extensions and the core engine. This maintenance work was crucial for the overall health of the PHP ecosystem at the time, even if the register_globals shift was the most talked-about feature.