PHP Release 5.4.0


    PHP 5.4.0 Release Announcement

    The PHP development team is proud to announce the immediate availability of PHP 5.4.0. This release is a major leap forward in the 5.x series, and includes a large number of new features and bug fixes.

    The key features of PHP 5.4.0 include:

    • New language syntax including Traits, shortened array syntax and more
    • Improved performance and reduced memory consumption
    • Support for multibyte languages now available in all builds of PHP at the flip of a runtime switch
    • Built-in webserver in CLI mode to simplify development workflows and testing
    • Cleaner code base thanks to the removal of multiple deprecated language features
    • Many more improvements and fixes

    Changes that affect compatibility:

    Extensions moved to PECL:

    PHP 5.4 will be the last series to support Windows XP and Windows 2003. We will not provide binary packages for these Windows versions after PHP 5.4.

    For users upgrading from PHP 5.3 there is a migration guide available here, detailing the changes between PHP 5.3 and PHP 5.4.0.

    For a full list of changes in PHP 5.4.0, see the ChangeLog.

    Source Code
    Change Logs
    installation
    • autoconf 2.59+ is now supported (and required) for generating the configure script with ./buildconf. Autoconf 2.60+ is desirable otherwise the configure help order may be incorrect.
    removed legacy features
    • break/continue $var syntax.
    • Safe mode and all related php.ini options.
    • register_globals and register_long_arrays php.ini options.
    • import_request_variables().
    • allow_call_time_pass_reference.
    • define_syslog_variables php.ini option and its associated function.
    • highlight.bg php.ini option.
    • safe_mode, safe_mode_gid, safe_mode_include_dir, safe_mode_exec_dir, safe_mode_allowed_env_vars and safe_mode_protected_env_vars php.ini options.
    • zend.ze1_compatibility_mode php.ini option.
    • Session bug compatibility mode (session.bug_compat_42 and session.bug_compat_warn php.ini options).
    • session_is_registered(), session_register() and session_unregister() functions.
    • y2k_compliance php.ini option.
    • magic_quotes_gpc, magic_quotes_runtime and magic_quotes_sybase php.ini options. get_magic_quotes_gpc, get_magic_quotes_runtime are kept but always return false, set_magic_quotes_runtime raises an E_CORE_ERROR.
    • Removed support for putenv("TZ=..") for setting the timezone.
    • Removed the timezone guessing algorithm in case the timezone isn't set with date.timezone or date_default_timezone_set(). Instead of a guessed timezone, "UTC" is now used instead.
    moved extensions to pecl
    • ext/sqlite. (Note: the ext/sqlite3 and ext/pdo_sqlite extensions are not affected)
    general improvements
    • Added short array syntax support ([1,2,3]), see UPGRADING guide for full details.
    • Added binary number format (0b001010).
    • Added support for Class::{expr}() syntax
    • Added multibyte support by default. Previously PHP had to be compiled with --enable-zend-multibyte. Now it can be enabled or disabled through the zend.multibyte directive in php.ini.
    • Removed compile time dependency from ext/mbstring
    • Added support for Traits.
    • Added closure $this support back.
    • Added array dereferencing support.
    • Added callable typehint.
    • Added indirect method call through array. FR #47160.
    • Added DTrace support.
    • Added class member access on instantiation (e.g. (new foo)->bar()) support.
    • <?= is now always available regardless of the short_open_tag setting.
    • Implemented Zend Signal Handling (configurable option --enable-zend-signals, off by default).
    • Improved output layer, see README.NEW-OUTPUT-API for internals.
    • Improved UNIX build system to allow building multiple PHP binary SAPIs and one SAPI module the same time. FR #53271, FR #52419.
    • Implemented closure rebinding as parameter to bindTo.
    • Improved the warning message of incompatible arguments.
    • Improved ternary operator performance when returning arrays.
    • Changed error handlers to only generate docref links when the docref_root php.ini setting is not empty.
    • Changed silent conversion of array to string to produce a notice.
    • Changed default encoding from ISO-8859-1 to UTF-8 when not specified in htmlspecialchars and htmlentities.
    • Changed casting of null/''/false into an Object when adding a property from E_STRICT into a warning.
    • Changed E_ALL to include E_STRICT.
    • Disabled Windows CRT warning by default, can be enabled again using the php.ini directive windows_show_crt_warnings.
    • Fixed bug #55378: Binary number literal returns float number though its value is small enough.
    improved zend engine memory usage
    • Improved parse error messages.
    • Replaced zend_function.pass_rest_by_reference by ZEND_ACC_PASS_REST_BY_REFERENCE in zend_function.fn_flags.
    • Replaced zend_function.return_reference by ZEND_ACC_RETURN_REFERENCE in zend_function.fn_flags.
    • Removed zend_arg_info.required_num_args as it was only needed for internal functions. Now the first arg_info for internal functions is represented by the zend_internal_function_info structure.
    • Moved zend_op_array.size, size_var, size_literal, current_brk_cont, backpatch_count into CG(context) as they are used only during compilation.
    • Moved zend_op_array.start_op into EG(start_op) as it's used only for 'interactive' execution of a single top-level op-array.
    • Replaced zend_op_array.done_pass_two by ZEND_ACC_DONE_PASS_TWO in zend_op_array.fn_flags.
    • op_array.vars array is trimmed during pass_two.
    • Replaced zend_class_entry.constants_updated by ZEND_ACC_CONSTANTS_UPDATED in zend_class_entry.ce_flags.
    • Reduced the size of zend_class_entry by sharing the same memory space by different information for internal and user classes. See zend_class_entry.info union.
    • Reduced size of temp_variable.
    improved zend engine - performance tweaks and optimizations
    • Inlined most probable code-paths for arithmetic operations directly into executor.
    • Eliminated unnecessary iterations during request startup/shutdown.
    • Changed $GLOBALS into a JIT autoglobal, so it's initialized only if used.
    • Improved performance of @ operator.
    • Simplified string offset reading. Given $str="abc" then $str[1][0] is now a legal construct.
    • Added caches to eliminate repeatable run-time bindings of functions, classes, constants, methods and properties.
    • Added concept of interned strings. All strings constants known at compile time are allocated in a single copy and never changed.
    • ZEND_RECV now always has IS_CV as its result.
    • ZEND_CATCH now has to be used only with constant class names.
    • ZEND_FETCH_DIM_? may fetch array and dimension operands in different order.
    • Simplified ZEND_FETCH_*_R operations. They can't be used with the EXT_TYPE_UNUSED flag any more. This is a very rare and useless case. ZEND_FREE might be required after them instead.
    • Split ZEND_RETURN into two new instructions ZEND_RETURN and ZEND_RETURN_BY_REF.
    • Optimized access to global constants using values with pre-calculated hash_values from the literals table.
    • Optimized access to static properties using executor specialization. A constant class name may be used as a direct operand of ZEND_FETCH_* instruction without previous ZEND_FETCH_CLASS.
    • zend_stack and zend_ptr_stack allocation is delayed until actual usage.
    other improvements to zend engine
    • Added an optimization which saves memory and emalloc/efree calls for empty HashTables.
    • Added ability to reset user opcode handlers .
    • Changed the structure of op_array.opcodes. The constant values are moved from opcode operands into a separate literal table.
    • Fixed (disabled) inline-caching for ZEND_OVERLOADED_FUNCTION methods.
    improved core functions
    • Enforce an extended class' __construct arguments to match the abstract constructor in the base class.
    • Disallow reusing superglobal names as parameter names.
    • Added optional argument to debug_backtrace() and debug_print_backtrace() to limit the amount of stack frames returned.
    • Added hex2bin() function.
    • number_format() no longer truncates multibyte decimal points and thousand separators to the first byte. FR #53457.
    • Added support for object references in recursive serialize() calls. FR #36424.
    • Added support for SORT_NATURAL and SORT_FLAG_CASE in array sort functions (sort, rsort, ksort, krsort, asort, arsort and array_multisort). FR#55158
    • Added stream metadata API support and stream_metadata() stream class handler.
    • User wrappers can now define a stream_truncate() method that responds to truncation, e.g. through ftruncate(). FR #53888.
    • Improved unserialize() performance.
    • Changed array_combine() to return empty array instead of FALSE when both parameter arrays are empty. FR #34857.
    • Fixed bug #61095 (Incorect lexing of 0x00*+<NUM>).
    • Fixed bug #60965 (Buffer overflow on htmlspecialchars/entities with $double=false).
    • Fixed bug #60895 (Possible invalid handler usage in windows random functions).
    • Fixed bug #60879 (unserialize() Does not invoke __wakeup() on object).
    • Fixed bug #60825 (Segfault when running symfony 2 tests).
    • Fixed bug #60627 .
    • Fixed bug #60613 (Segmentation fault with $cls->{expr}() syntax).
    • Fixed bug #60611 (Segmentation fault with Cls::{expr}() syntax).
    • Fixed bug #60558 (Invalid read and writes).
    • Fixed bug #60444 (Segmentation fault with include & class extending). .
    • Fixed bug #60362 (non-existent sub-sub keys should not have values).
    • Fixed bug #60350 (No string escape code for ESC (ascii 27), normally \e).
    • Fixed bug #60321 (ob_get_status(true) no longer returns an array when buffer is empty).
    • Fixed bug #60282 (Segfault when using ob_gzhandler() with open buffers).
    • Fixed bug #60240 (invalid read/writes when unserializing specially crafted strings).
    • Fixed bug #60227 (header() cannot detect the multi-line header with CR(0x0D)).
    • Fixed bug #60174 (Notice when array in method prototype error).
    • Fixed bug #60169 (Conjunction of ternary and list crashes PHP).
    • Fixed bug #60038 (SIGALRM cause segfault in php_error_cb). (Laruence)
    • Fixed bug #55871 (Interruption in substr_replace()).
    • Fixed bug #55801 (Behavior of unserialize has changed).
    • Fixed bug #55758 (Digest Authenticate missed in 5.4) .
    • Fixed bug #55748 (multiple NULL Pointer Dereference with zend_strndup()) (CVE-2011-4153).
    • Fixed bug #55124 (recursive mkdir fails with current (dot) directory in path).
    • Fixed bug #55084 (Function registered by header_register_callback is called only once per process).
    • Implement FR #54514 (Get php binary path during script execution).
    • Fixed bug #52211 (iconv() returns part of string on error).
    • Fixed bug #51860 (Include fails with toplevel symlink to /).
    improved generic sapi support
    • Added $_SERVER['REQUEST_TIME_FLOAT'] to include microsecond precision.
    • Added header_register_callback() which is invoked immediately prior to the sending of headers and after default headers have been added.
    • Added http_response_code() function. FR #52555.
    • Fixed bug #55500 (Corrupted $_FILES indices lead to security concern). (CVE-2012-1172).
    • Fixed bug #54374 (Insufficient validating of upload name leading to corrupted $_FILES indices). (CVE-2012-1172).
    improved cli sapi
    • Added built-in web server that is intended for testing purpose.
    • Added command line option --rz <name> which shows information of the named Zend extension.
    • Interactive readline shell improvements:
    • Added "cli.pager" php.ini setting to set a pager for output.
    • Added "cli.prompt" php.ini setting to configure the shell prompt.
    • Added shortcut #inisetting=value to change php.ini settings at run-time.
    • Changed shell not to terminate on fatal errors.
    • Interactive shell works with shared readline extension. FR #53878.
    improved cgi/fastcgi sapi
    • Added apache compatible functions: apache_child_terminate(), getallheaders(), apache_request_headers() and apache_response_headers()
    • Improved performance of FastCGI request parsing.
    • Fixed reinitialization of SAPI callbacks after php_module_startup().
    improved php-fpm sapi
    • Removed EXPERIMENTAL flag.
    • Fixed bug #60659 (FPM does not clear auth_user on request accept).
    improved litespeed sapi
    • Fixed bug #55769 (Make Fails with "Missing Separator" error).
    improved date extension
    • Added the + modifier to parseFromFormat to allow trailing text in the string to parse without throwing an error.
    improved dba extension
    • Added Tokyo Cabinet abstract DB support.
    • Added Berkeley DB 5 support.
    improved dom extension
    • Added the ability to pass options to loadHTML
    improved filesystem functions
    • scandir() now accepts SCANDIR_SORT_NONE as a possible sorting_order value. FR #53407.
    improved hash extension
    • Added Jenkins's one-at-a-time hash support.
    • Added FNV-1 hash support.
    • Made Adler32 algorithm faster. FR #53213.
    • Removed Salsa10/Salsa20, which are actually stream ciphers
    • Fixed bug #60221 (Tiger hash output byte order)
    improved intl extension
    • Added Spoofchecker class, allows checking for visibly confusable characters and other security issues.
    • Added Transliterator class, allowing transliteration of strings.
    • Added support for UTS #46.
    • Fixed build on Fedora 15 / Ubuntu 11.
    • Fixed bug #55562 (grapheme_substr() returns false on big length).
    improved json extension
    • Added new json_encode() option JSON_UNESCAPED_UNICODE. FR #53946.
    • Added JsonSerializable interface.
    • Added JSON_BIGINT_AS_STRING, extended json_decode() sig with $options.
    • Added support for JSON_NUMERIC_CHECK option in json_encode() that converts numeric strings to integers.
    • Added new json_encode() option JSON_UNESCAPED_SLASHES. FR #49366.
    • Added new json_encode() option JSON_PRETTY_PRINT. FR #44331.
    improved ldap extension
    • Added paged results support. FR #42060.
    improved mbstring extension
    • Added Shift_JIS/UTF-8 Emoji (pictograms) support.
    • Added JIS X0213:2004 (Shift_JIS-2004, EUC-JP-2004, ISO-2022-JP-2004) support.
    • Ill-formed UTF-8 check for security enhancements.
    • Added MacJapanese (Shift_JIS) and gb18030 encoding support.
    • Added encode/decode in hex format to mb_[en|de]code_numericentity().
    • Added user JIS X0213:2004 (Shift_JIS-2004, EUC-JP-2004, ISO-2022-JP-2004) support.
    • Added the user defined area for CP936 and CP950 .
    • Fixed bug #60306 (Characters lost while converting from cp936 to utf8).
    improved mysql extensions
    • MySQL: Deprecated mysql_list_dbs(). FR #50667.
    • mysqlnd: Added named pipes support. FR #48082.
    • MySQLi: Added iterator support in MySQLi. mysqli_result implements Traversable.
    • PDO_mysql: Removed support for linking with MySQL client libraries older than 4.1.
    • ext/mysql, mysqli and pdo_mysql now use mysqlnd by default.
    • Fixed bug #55473 (mysql_pconnect leaks file descriptors on reconnect).
    • Fixed bug #55653 (PS crash with libmysql when binding same variable as param and out).
    improved openssl extension
    • Added AES support. FR #48632.
    • Added no padding option to openssl_encrypt()/openssl_decrypt().
    • Use php's implementation for Windows Crypto API in openssl_random_pseudo_bytes.
    • On error in openssl_random_pseudo_bytes() made sure we set strong result to false.
    • Fixed possible attack in SSL sockets with SSL 3.0 / TLS 1.0. CVE-2011-3389.
    • Fixed bug #61124 (Crash when decoding an invalid base64 encoded string).
    improved pdo
    • Fixed PDO objects binary incompatibility.
    pdo dblib driver
    • Added nextRowset support.
    • Fixed bug #50755 .
    improved postgresql extension
    • Added support for "extra" parameter for PGNotify().
    improved pcre extension
    • Changed third parameter of preg_match_all() to optional. FR #53238.
    improved readline extension
    • Fixed bug #54450 (Enable callback support when built against libedit).
    improved reflection extension
    • Added ReflectionClass::newInstanceWithoutConstructor() to create a new instance of a class without invoking its constructor. FR #55490.
    • Added ReflectionExtension::isTemporary() and ReflectionExtension::isPersistent() methods.
    • Added ReflectionZendExtension class.
    • Added ReflectionClass::isCloneable().
    improved session extension
    • Expose session status via new function, session_status (FR #52982)
    • Added support for object-oriented session handlers.
    • Added support for storing upload progress feedback in session data.
    • Changed session.entropy_file to default to /dev/urandom or /dev/arandom if either is present at compile time.
    • Fixed bug #60860 (session.save_handler=user without defined function core dumps).
    • Implement FR #60551 (session_set_save_handler should support a core's session handler interface).
    • Fixed bug #60640 (invalid return values).
    improved snmp extension (boris lytochkin)
    • Added OO API. FR #53594 .
    • Sanitized return values of existing functions. Now it returns FALSE on failure.
    • Allow ~infinite OIDs in GET/GETNEXT/SET queries. Autochunk them to max_oids upon request.
    • Introducing unit tests for extension with ~full coverage.
    • IPv6 support.
    • Way of representing OID value can now be changed when SNMP_VALUE_OBJECT is used for value output mode. Use or'ed SNMP_VALUE_LIBRARY(default if not specified) or SNMP_VALUE_PLAIN.
    • Fixed bug #60749 (SNMP module should not strip non-standard SNMP port from hostname).
    • Fixed bug #60585 (php build fails with USE flag snmp when IPv6 support is disabled).
    • Fixed bug #53862
    • Fixed bug #46065 persists between requests)
    • Fixed bug #45893
    • Fixed bug #44193
    improved soap extension
    • Added new SoapClient option "keep_alive". FR #60329.
    • Fixed basic HTTP authentication for WSDL sub requests.
    improved spl extension
    • Added RegexIterator::getRegex() method.
    • Added SplObjectStorage::getHash() hook.
    • Added CallbackFilterIterator and RecursiveCallbackFilterIterator.
    • Added missing class_uses(..) as pointed out by #55266
    • Immediately reject wrong usages of directories under Spl(Temp)FileObject and friends.
    • FilesystemIterator, GlobIterator and (Recursive)DirectoryIterator now use the default stream context.
    • Fixed bug #60201 (SplFileObject::setCsvControl does not expose third argument via Reflection).
    • Fixed bug #55287 (spl_classes() not includes CallbackFilter classes)
    improved sysvshm extension
    • Fixed bug #55750 (memory copy issue in sysvshm extension).
    improved tidy extension
    • Fixed bug #54682 (Tidy::diagnose() NULL pointer dereference).
    improved tokenizer extension
    • Fixed bug #54089 (token_get_all with regards to __halt_compiler is not binary safe).
    improved xsl extension
    • Added XsltProcessor::setSecurityPrefs($options) and getSecurityPrefs() to define forbidden operations within XSLT stylesheets, default is not to enable write operations from XSLT. Bug #54446
    • XSL doesn't stop transformation anymore, if a PHP function can't be called
    improved zlib extension
    • Re-implemented non-file related functionality.
    • Fixed bug #55544 (ob_gzhandler always conflicts with zlib.output_compression).
    PHP logo

    PHP is developed and maintained by a global community of contributors.

    The PHP Foundation helps fund this work. If PHP is part of your business or projects, consider sponsoring the Foundation.
    PHP

    Learn

    The PHP Foundation

    Legal

    Copyright © 2001 - 2026 the PHP Group. All Rights Reserved.
    To Top