PHP Release 5.3.2


    PHP 5.3.2 Release Announcement

    The PHP development team is proud to announce the immediate release of PHP 5.3.2. This is a maintenance release in the 5.3 series, which includes a large number of bug fixes.

    Security Enhancements and Fixes in PHP 5.3.2:

    • Improved LCG entropy. (Rasmus, Samy Kamkar)
    • Fixed safe_mode validation inside tempnam() when the directory path does not end with a /). (Martin Jansen)
    • Fixed a possible open_basedir/safe_mode bypass in the session extension identified by Grzegorz Stachowiak. (Ilia)

    Key Bug Fixes in PHP 5.3.2 include:

    • Added support for SHA-256 and SHA-512 to php's crypt.
    • Added protection for $_SESSION from interrupt corruption and improved "session.save_path" check.
    • Fixed bug #51059 (crypt crashes when invalid salt are given).
    • Fixed bug #50940 Custom content-length set incorrectly in Apache sapis.
    • Fixed bug #50847 (strip_tags() removes all tags greater then 1023 bytes long).
    • Fixed bug #50723 (Bug in garbage collector causes crash).
    • Fixed bug #50661 (DOMDocument::loadXML does not allow UTF-16).
    • Fixed bug #50632 (filter_input() does not return default value if the variable does not exist).
    • Fixed bug #50540 (Crash while running ldap_next_reference test cases).
    • Fixed bug #49851 (http wrapper breaks on 1024 char long headers).
    • Over 60 other bug fixes.

    For users upgrading from PHP 5.2 there is a migration guide available here, detailing the changes between those releases and PHP 5.3.

    For a full list of changes in PHP 5.3.2, see the ChangeLog.

    Source Code
    Change Logs
    added reflectionmethod
    • Added LIBXML_PARSEHUGE constant to override the maximum text size of a single text node when using libxml2.7.3+. (Kalle) through the Reflection API.
    added collator
    • Added support for CURLOPT_POSTREDIR. FR #49571.
    • Added support for CURLOPT_CERTINFO. FR #49253.
    • Added client-side server name indication support in openssl.
    • Improved fix for bug #50006 (Segfault caused by uksort()).
    • Fixed mysqlnd hang when queries exactly 16777214 bytes long are sent.
    • Fixed incorrect decoding of 5-byte BIT sequences in mysqlnd.
    • Fixed error_log() to be binary safe when using message_type 3.
    • Fixed unnecessary invocation of setitimer when timeouts have been disabled.
    • Fixed memory leak in extension loading when an error occurs on Windows.
    • Fixed safe_mode validation inside tempnam() when the directory path does not end with a /).
    • Fixed a possible open_basedir/safe_mode bypass in session extension identified by Grzegorz Stachowiak.
    • Fixed possible crash when a error/warning is raised during php startup.
    • Fixed possible bad behavior of rename on windows when used with symbolic links or invalid paths.
    • Fixed error output to stderr on Windows.
    • Fixed memory leaks in is_writable/readable/etc on Windows.
    • Fixed memory leaks in the ACL function on Windows.
    • Fixed memory leak in the realpath cache on Windows.
    • Fixed memory leak in zip_close.
    • Fixed crypt's blowfish sanity check of the "setting" string, to reject iteration counts encoded as 36 through 39.
    • Fixed bug #51059 (crypt crashes when invalid salt are given).
    • Fixed bug #50952 (allow underscore _ in constants parsed in php.ini files).
    • Fixed bug #50940 (Custom content-length set incorrectly in Apache SAPIs).
    • Fixed bug #50930 (Wrong date by php_date.c patch with ancient gcc/glibc versions).
    • Fixed bug #50907 (X-PHP-Originating-Script adding two new lines in *NIX).
    • Fixed bug #50859 (build fails with openssl 1.0 due to md2 deprecation).
    • Fixed bug #50847 (strip_tags() removes all tags greater then 1023 bytes long).
    • Fixed bug #50829 (php.ini directive pdo_mysql.default_socket is ignored).
    • Fixed bug #50832 (HTTP fopen wrapper does not support passwordless HTTP authentication).
    • Fixed bug #50787 (stream_set_write_buffer() has no effect on socket streams).
    • Fixed bug #50761 (system.multiCall crashes in xmlrpc extension).
    • Fixed bug #50756 (CURLOPT_FTP_SKIP_PASV_IP does not exist).
    • Fixed bug #50732 (exec() adds single byte twice to $output array).
    • Fixed bug #50728 (All PDOExceptions hardcode 'code' property to 0).
    • Fixed bug #50723 (Bug in garbage collector causes crash).
    • Fixed bug #50690 (putenv does not set ENV when the value is only one char).
    • Fixed bug #50680 (strtotime() does not support eighth ordinal number).
    fixed bug #50661 (domdocument
    • Fixed bug #50657 (copy() with an empty (zero-byte) HTTP source succeeds but returns false).
    • Fixed bug #50636 (MySQLi_Result sets values before calling constructor).
    • Fixed bug #50632 (filter_input() does not return default value if the variable does not exist).
    • Fixed bug #50576 (XML_OPTION_SKIP_TAGSTART option has no effect).
    • Fixed bug #50558 (Broken object model when extending tidy).
    • Fixed bug #50540 (Crash while running ldap_next_reference test cases).
    • Fixed bug #50519 (segfault in garbage collection when using set_error_handler and DomDocument).
    fixed bug #50508 (compile failure
    • Fixed bug #50496 (Use of <stdbool.h> is valid only in a c99 compilation environment.
    • Fixed bug #50464 (declare encoding doesn't work within an included file).
    fixed bug #50458 (pdo
    • Fixed bug #50445 (PDO-ODBC stored procedure call from Solaris 64-bit causes seg fault).
    • Fixed bug #50416 (PROCEDURE db.myproc can't return a result set in the given context).
    • Fixed bug #50394 (Reference argument converted to value in __call).
    • Fixed bug #50351 (performance regression handling objects, ten times slower in 5.3 than in 5.2).
    • Fixed bug #50392 (date_create_from_format() enforces 6 digits for 'u' format character).
    • Fixed bug #50345 (nanosleep not detected properly on some solaris versions).
    • Fixed bug #50340 (php.ini parser does not allow spaces in ini keys).
    • Fixed bug #50334 (crypt ignores sha512 prefix).
    • Fixed bug #50323 (Allow use of ; in values via ;; in PDO DSN).
    • Fixed bug #50285 (xmlrpc does not preserve keys in encoded indexed arrays).
    • Fixed bug #50282 (xmlrpc_encode_request() changes object into array in calling function).
    • Fixed bug #50267 (get_browser(null) does not use HTTP_USER_AGENT).
    • Fixed bug #50266 (conflicting types for llabs).
    • Fixed bug #50261 (Crash When Calling Parent Constructor with call_user_func()).
    • Fixed bug #50255 (isset() and empty() silently casts array to object).
    • Fixed bug #50240 (pdo_mysql.default_socket in php.ini shouldn't used if it is empty).
    • Fixed bug #50231 (Socket path passed using --with-mysql-sock is ignored when mysqlnd is enabled).
    • Fixed bug #50219 (soap call Segmentation fault on a redirected url).
    • Fixed bug #50212 (crash by ldap_get_option() with LDAP_OPT_NETWORK_TIMEOUT).
    • Fixed bug #50209 (Compiling with libedit cannot find readline.h).
    • Fixed bug #50207 (segmentation fault when concatenating very large strings on 64bit linux).
    • Fixed bug #50196 (stream_copy_to_stream() produces warning when source is not file).
    • Fixed bug #50195 (pg_copy_to() fails when table name contains schema.
    • Fixed bug #50185 (ldap_get_entries() return false instead of an empty array when there is no error).
    • Fixed bug #50174 (Incorrectly matched docComment).
    • Fixed bug #50168 (FastCGI fails with wrong error on HEAD request to non-existant file).
    • Fixed bug #50162 (Memory leak when fetching timestamp column from Oracle database).
    • Fixed bug #50159 (wrong working directory in symlinked files).
    • Fixed bug #50158 (FILTER_VALIDATE_EMAIL fails with valid addresses containing = or ?).
    fixed bug #50146 (property_exists
    • Fixed bug #50145 (crash while running bug35634.phpt).
    • Fixed bug #50140 (With default compilation option, php symbols are unresolved for nsapi).
    • Fixed bug #50087 (NSAPI performance improvements).
    • Fixed bug #50073 (parse_url() incorrect when ? in fragment).
    • Fixed bug #50023 (pdo_mysql doesn't use PHP_MYSQL_UNIX_SOCK_ADDR).
    • Fixed bug #50005 (Throwing through Reflection modified Exception object makes segmentation fault).
    • Fixed bug #49990 (SNMP3 warning message about security level printed twice).
    • Fixed bug #49985 (pdo_pgsql prepare() re-use previous aborted transaction).
    fixed bug #49938 (phar
    • Fixed bug #49936 (crash with ftp stream in php_stream_context_get_option()).
    • Fixed bug #49921 (Curl post upload functions changed).
    • Fixed bug #49866 (Making reference on string offsets crashes PHP).
    • Fixed bug #49855 (import_request_variables() always returns NULL).
    • Fixed bug #49851, #50451 (http wrapper breaks on 1024 char long headers).
    • Fixed bug #49800 (SimpleXML allow (un)serialize() calls without warning).
    fixed bug #49719 (reflectionclass
    • Fixed bug #49677 (ini parser crashes with apache2 and using ${something} ini variables).
    • Fixed bug #49660 (libxml 2.7.3+ limits text nodes to 10MB).
    • Fixed bug #49647 (DOMUserData does not exist).
    • Fixed bug #49600 (imageTTFText text shifted right).
    • Fixed bug #49585 (date_format buffer not long enough for >4 digit years).
    fixed bug #49560 (oci8
    • Fixed bug #49521 (PDO fetchObject sets values before calling constructor).
    • Fixed bug #49472 (Constants defined in Interfaces can be overridden).
    • Fixed bug #49463 (setAttributeNS fails setting default namespace).
    • Fixed bug #49244 (Floating point NaN cause garbage characters).
    • Fixed bug #49224 (Compile error due to old DNS functions on AIX systems).
    • Fixed bug #49174 (crash when extending PDOStatement and trying to set queryString property).
    • Fixed bug #48811 (Directives in PATH section do not get applied to subdirectories).
    • Fixed bug #48590 (SoapClient does not honor max_redirects).
    • Fixed bug #48190 (Content-type parameter "boundary" is not case-insensitive in HTTP uploads).
    • Fixed bug #47848 (importNode doesn't preserve attribute namespaces).
    • Fixed bug #47409 (extract() problem with array containing word "this").
    • Fixed bug #47281 ($php_errormsg is limited in size of characters)
    • Fixed bug #46478 (htmlentities() uses obsolete mapping table for character entity references).
    • Fixed bug #45599 (strip_tags() truncates rest of string with invalid attribute).
    • Fixed bug #45120 (PDOStatement->execute() returns true then false for same statement).
    fixed bug #44827 (define() allows
    • Fixed bug #44098 (imap_utf8() returns only capital letters).
    • Fixed bug #34852 (Failure in odbc_exec() using oracle-supplied odbc driver).
    PHP logo

    PHP is developed and maintained by a global community of contributors.

    The PHP Foundation helps fund this work. If PHP is part of your business or projects, consider sponsoring the Foundation.
    PHP

    Learn

    The PHP Foundation

    Legal

    Copyright © 2001 - 2026 the PHP Group. All Rights Reserved.
    To Top