What Is New in PHP 7.2
| Category | Key Changes |
|---|---|
| New Features | New object type, Trailing commas in grouped namespaces, Sodium extension |
| Security | Libsodium becomes core extension, Hash context serialization, LDAP controls |
| Deprecations | __autoload(), create_function(), each(), assert() with string argument |
| Improvements | Counting non-countable objects, Parameter type widening, Argon2 password hash |
| Bug Fixes | Over 120 various bug fixes across all extensions |
What new language features were added?
PHP 7.2 introduced several syntax enhancements that make code more flexible. The new object type hint allows for parameter, return type, and property declarations that accept any object. This is cleaner than using a class name or iterable when you just need an object.
You can now use trailing commas in grouped namespace use declarations. This is a small but welcome change that makes diffs cleaner when adding new namespaces. The syntax looks like this:
use Foo\Bar\{
Baz,
Qux,
Quux,
};How did security improve in this release?
The Sodium extension for modern cryptography was promoted to a core extension, meaning it's always available. This provides a well-audited alternative to the older mcrypt extension for encryption, decryption, and hashing.
Hash contexts can now be serialized using serialize() and unserialize(). This allows you to save and restore the state of a hash operation, which is useful for processing large streams of data. LDAP controls are now supported in the LDAP extension for more advanced directory server operations.
What functions became deprecated?
Several legacy functions were marked for deprecation. The __autoload() function is superseded by spl_autoload_register(). The create_function() function, which had security and performance issues, should be replaced with anonymous functions.
The each() function is deprecated in favor of foreach. Using assert() with a string argument is also deprecated; you should use a boolean expression instead. These changes push the language toward more modern and efficient patterns.
Were there any behavior changes to existing functions?
Yes, the behavior of the count() function was changed for non-countable types. Now, if you call count() on a non-countable object like a scalar, it will emit an E_WARNING and return 0. This helps catch bugs where the wrong variable type is passed to count.
Parameter type widening was implemented. This means a subclass can now override a method and widen the parameter types from the parent class. For example, a method that accepts DateTime in the parent can accept DateTimeInterface in the child. This provides more flexibility in object-oriented design.
FAQ
What is the new object type hint used for?
The object type hint is used in parameter types, return types, and property declarations to specify that a value must be an object. It's a more generic alternative to specifying a particular class name when any object will suffice.
Is the Sodium extension now always available?
Yes, the Sodium extension was added to core in PHP 7.2. This means you can use its modern cryptographic functions without needing to install it separately via PECL.
Why was __autoload() deprecated?
The __autoload() function was deprecated because the spl_autoload_register() function provides a more flexible way to register multiple autoloaders, which is essential for modern component-based applications.
What happens if I call count() on a non-countable value?
In PHP 7.2, calling count() on a scalar value (like a string or integer) or null will now generate a warning and return 0. Previously, it would return 1 for scalars and 0 for null.
Can I still use assert() with a string?
Using assert() with a string argument is deprecated. You should pass a boolean expression instead. The string evaluation feature of assert was a potential security risk if used incorrectly.