The why and how of moving to php 7.x
0 likes•496 views
The document discusses the importance of upgrading to PHP 7.x, addressing the reasons for and methods of upgrading, and highlighting significant changes and improvements in PHP 7, including performance enhancements and new features. It outlines the challenges developers face with compatibility and automation during upgrades, offers insights on tools like php_codesniffer and phpcompatibility for testing, and emphasizes the necessity of moving away from outdated PHP versions due to end-of-life policies. Ultimately, it advocates for proactive measures to ensure compatibility and streamline the upgrade process for existing applications.
The why and how of moving to php 7.x
- 1. The Why and How of moving to PHP 7.x
- 2. Who am I ? Wim Godden (@wimgtr)
- 9. My town
- 10. My town
- 11. Belgium – the traffic
- 12. Who am I ? Wim Godden (@wimgtr) Founder of Cu.be Solutions (http://cu.be) Open Source developer since 1997 Developer of PHPCompatibility, OpenX, ... Speaker at Open Source conferences
- 13. Why vs How Part 1 : why upgrade ? Bad reasons : It's cool to have the latest version Annoy sysadmins Oh cool, a new toy ! Part 2 : how to upgrade ? The nightmare of compatibility The joy of automation No miracles here !
- 14. Show of hands 3 / 4 5.0 5.1 5.2 5.3 5.4 5.5 5.6 6.0 7.0 7.1 7.2 7.3 8.0
- 15. The numbers W3Techs (http://w3techs.com/technologies/details/pl-php/all/all) Now Jan 2015 Aug 2013 PHP 4 : 0.8% 1.8% 2.9% PHP 5 : 87.2% 98.2% 97.1% 5.0 : < 0.1% < 0.1% 0.1% 5.1 : 0.5% 1.2% 2.2% 5.2 : 7.8% 19.2% 40.2% 5.3 : 19.7% 45.5% 51.7% 5.4 : 21.2% 26.9% 5.7% 5.5 : 15.4% 6.3% 0.1 % 5.6 : 35.3% 0.5% PHP 7 : 12.0% 7.0 : 66.8% 7.1 : 31.2% 7.2 : 2.1%
- 16. 5.3 – 5.6 quick recap Namespaces () Late static binding Closures Better garbage collection Goto Mysqlnd Performance gain Short array syntax Traits Built-in webserver Binary notation No more register_globals, magic_quotes_gpc and safe_mode Generators (yield keyword) password_hash() function Built-in opcache
- 17. 5.6 – people are not even using it ! 49.2% still on PHP < 5.5 No : Symfony 3+ Zend Framework 3 Problematic for developers
- 18. PHP 7.x – what's changed ? New features Performance and memory usage Improved consistency Lots of things removed or deprecated
- 19. New things – Scalar type + return type declarations (7.0) New scalar types : int, float, bool and string Return type can be specified as well (and can be scalar type as well)
- 20. Weak and strong typing Weak : Default Parameters will be coerced (PHP 5 style) Strong/strict : At top of file : Strict typing is file-specific, so must be enabled in each file ! If wrong type is given, a TypeError is thrown : Fatal error: Uncaught TypeError: Return value of testFunction() must be of the type integer, string returned Returning null is also invalid → if you want an int, you will get an int or an error
- 21. Null coalescing operator (??) PHP 5 : PHP 7 : Can be chained :
- 23. Spaceship operator (<=>) Compares expressions Returns -1, 0 or 1 Examples :
- 24. Unicode codepoint escape syntax Converts hexadecimal Unicode codepoint to UTF8 double quoted string will output :
- 25. Filterable unserialize() Defines which classes can be unserialized New 2nd parameter Examples : returns __PHP_Incomplete_Class objects returns objects of type Article, User, or __PHP_Incomplete_Class
- 26. CSPRNG functions Cross platform functions to generate random data Cryptographically secure 2 functions : random_bytes($length) random_int($min, $max)
- 27. Deprecated in PHP 7.0 PHP 4 style constructors Static calls to non-static methods
- 28. preg_replace preg_replace no longer supports e → Use preg_replace_callback()
- 29. Error handling in PHP 7 Most fatal errors in PHP 5 → Exceptions in PHP 7 New class : Error If your PHP 5 code has a class called Error, you will need to rename it All Error and Exception classes now implement Throwable Error Flow : Error is thrown Bubbles up through called functions/methods At first matching catch block, code is run No matching catch → default exception handler No default exception handler → Fatal error
- 31. Error handling in PHP 7 Important : does not catch errors and does not catch exceptions For PHP 5 and 7 :
- 32. Error handling in PHP 7 - set_error_handler() No longer works in PHP 7 : Works in PHP 5 and 7 : PHP 7 only :
- 33. Variable handling PHP 7 uses abstract syntax tree (AST) Can be detected automatically in some cases Requires manual fixing and testing
- 34. Removed functionality global + variable variable = no longer allowed salt option in password_hash = deprecated → PHP will generate one automatically
- 36. Removed functions ereg* call_user_method() and call_user_method_array() dl() in PHP-FPM All GD functions with support for PostScript Type 1 fonts (imageps*)
- 37. Removed ini settings always_populate_raw_post_data asp-tags xsl.security_prefs sql.safe_mode (PHP 7.2) mbstring.internal_encoding mbstring.http_input mbstring.http_output iconv.internal_encoding iconv.input_encoding iconv.output_encoding
- 38. Other changes (1/2) Invalid octals now throw a ParseError PHP Parse error: Invalid numeric literal in octal.php Negative bitshifts throw an ArithmeticError Fatal error: Uncaught ArithmeticError: Bit shift by negative number Division by zero throws DivisionByZeroError Hexadecimal strings are no longer numeric In PHP 5 : bool(true) In PHP 7 : bool(false)
- 39. Other changes (2/2) New reserved keywords : bool, float, int, null, string, true, false Reserved for future use : mixed, number, object, resource, void (7.1), iterable (7.1) However, keyword usage inside classes is less restrictive. This is now allowed : Assign by reference on new is no longer allowed : Parse error: syntax error, unexpected 'new' (T_NEW) ASP and script PHP tags removed (<% %>, <%= %> and <script language=”php”>) Switch statements can no longer have multiple default blocks date.timezone warning has been removed
- 40. Performance and memory usage from 5.6 to 7.0 Performance : 200 – 300% increase How ? Core optimizations More direct approach Fewer memory allocations Smaller data structures across all data types … Reduced memory usage : up to 50% ! Big impact on large frameworks Even bigger impact on codebases such as Wordpress, Drupal, ...
- 41. PHP 7.0 → 7.1 (1/2) Nullable types Exception on passing too few function arguments Fatal error: Uncaught ArgumentCountError: Too few arguments to function test(), 0 passed in %s on line %d and exactly 1 expected in %s:%d
- 42. PHP 7.0 → 7.1 (2/2) rand() and srand() are aliases of of mt_rand() and mt_srand() Empty index operator on a string throws a fatal error DateTime constructor now uses microseconds SSLv2 stream support has been dropped session_gc() function was added → Allows manual call of the garbage collection
- 43. PHP 7.1 → 7.2 object type is available call parameter type and return type of any objects Sodium extension added : modern cryptographic library Argon2 added to password_hash() TLS version used is now 1.0, 1.1 or 1.2 (instead of 1.0 only) sql.safe_mode ini setting removed (unset) cast is deprecated create_function() is deprecated __autoload() is deprecated each() is deprecated
- 44. So... Should you upgrade today ?
- 45. Upgrade : yes / no Yes No Using removed extensions x Using removed functions x Need extra performance / reduced memory x Really need new feature x Want to use recent framework x No unit tests x No package available (.rpm, .deb, ...) x
- 46. Postponing upgrades - End-Of-Life In the past : we'll see Now : minor release + 2 = out → EOL Critical security patches : 1 year No bugfixes In practice 7.2 = OUT → 7.0 = EOL (!) 7.3 = OUT → 7.1 = EOL 5.6 = security patches only → EOL on Jan 1, 2019 (!) → End of PHP 5.x support If you’re on PHP 7.0 or 7.1 → start upgrading !
- 47. The numbers W3Techs (http://w3techs.com/technologies/details/pl-php/all/all) Now Jan 2015 Aug 2013 PHP 4 : 0.8% 1.8% 2.9% PHP 5 : 87.2% 98.2% 97.1% 5.0 : < 0.1% < 0.1% 0.1% 5.1 : 0.5% 1.2% 2.2% 5.2 : 7.8% 19.2% 40.2% 5.3 : 19.7% 45.5% 51.7% 5.4 : 21.2% 26.9% 5.7% 5.5 : 15.4% 6.3% 0.1 % 5.6 : 35.3% 0.5% PHP 7 : 12.0% 7.0 : 66.8% 7.1 : 31.2% 7.2 : 2.1%
- 48. Postponing upgrades Security Performance Framework support Symfony 4 : PHP 7.1.3+ Zend Framework 3 : PHP 5.6+ Laravel 5.6 : PHP 7.1.3+ Developer motivation
- 49. Upgrade paths 1 upgrade every 5 years Knowledge of upgrade steps will be forgotten Documentation is not very useful (for example : SysvInit → Systemd) Massive task to upgrade all apps, all environments, all servers Upgrade every release Upgrade steps can be automated Can be integrated with continuous integration and continuous deployment Documentation is in the automation flow
- 50. So you want to upgrade... Option 1 : run your unit tests Option 2 : visit each page (good luck !) + check error_log Or : record visits, then replay log on test environment Or : proxy requests to 2 environments Option 3 : automated static analysis
- 51. Unit tests on different PHP versions Vagrant boxes Integrate into your CI Use Travis CI (http://travis-ci.org)
- 52. Why make it so hard ? A best-case scenario... Development environment : 5.6 Production environment : 5.6 All is well, right ? End of 2018 : PHP 5.6 becomes EOL → PHP 7 upgrade required How can you test compatibility ? → Set up your test environment today → Even for new projects
- 53. Back in 2010... PHP Architect @ Belgian Railways 8 years of legacy code (4.x and 5.x) 40+ different developers 40+ projects Challenge : migrate all projects from PHP 5.1.x (on Solaris) to PHP 5.3.x (on Linux)
- 54. The idea Automate it How ? → Use the CI environment Which tool ? → PHP_CodeSniffer
- 55. PHP_CodeSniffer Originally PEAR package (pear install PHP_CodeSniffer) Also on Composer now Detects coding standard violations Supports multiple standards Static analysis tool → Runs without executing code → Splits code in tokens Ex. : T_OPEN_CURLY_BRACKET T_FALSE T_SEMICOLON → Parses each file separately
- 56. PHP_CodeSniffer Let's see what it looks like
- 57. PHP_CodeSniffer options -i Show available standards -p Show progress -s Show real error/warning sniff names -n Ignore warnings -v Verbose --parallel=x (since PHP_CodeSniffer 3)
- 58. PHPCompatibility PHP_CodeSniffer standard Only purpose : find compatibility issues Detects : Deprecated functions Deprecated extensions Deprecated php.ini settings and ini_set() calls Prohibited function names, class names, … … Works for PHP 5.0 and above
- 59. PHPCompatibility – making it work - Composer In require-dev : phpcompatibility/php-compatibility If PHPCompatibility is the only PHP CodeSniffer standard : "scripts": { "post-install-cmd": ""vendor/bin/phpcs" --config-set installed_paths vendor/wimg/php-compatibility/PHPCompatibility", "post-update-cmd" : ""vendor/bin/phpcs" --config-set installed_paths vendor/wimg/php-compatibility/PHPCompatibility" } Otherwise use one of these : DealerDirect/phpcodesniffer-composer-installer higidi/composer-phpcodesniffer-standards-plugin
- 60. PHPCompatibility – making it work - Github Download PHP CodeSniffer Download from http://github.com/phpcompatibility/PHPCompatibility Run phpcs --config-set installed_paths /path/to/PHPCompatibility
- 61. PHPCompatibility – making it work – testing and running Check if coding standard is available : phpcs -i Should output something similar to : The installed coding standards are MySource, PEAR, PHPCompatibility, PHPCS, PSR1, PSR2, Squiz and Zend To run : phpcs --standard=PHPCompatibility /path/of/your/code
- 62. Important notes Large directories → can be slow ! Use --extensions=php,phtml,... No point scanning .js files Test PHP x.x compatibility → needs PHP x.x on the system Static analysis Doesn't actually run the code Can not detect every single incompatibility → some things only happen on runtime Provides filename and line number
- 63. PHPCompatibility Let's see what it looks like
- 64. Checking for specific versions Default : latest PHP version Check for single version : phpcs --standard=PHPCompatibility --runtime-set testVersion 7.0 srcdir Check for multiple specific versions : phpcs --standard=PHPCompatibility --runtime-set testVersion 7.0-7.1 srcdir Check for minimum version : phpcs --standard=PHPCompatibility --runtime-set testVersion 7.0- srcdir Checking for older version : phpcs --standard=PHPCompatibility --runtime-set testVersion 5.0 srcdir
- 65. Disabling warnings for specific sniff Define custom ruleset in phpcs.xml :
- 66. Other tools For Wordpress : PHP Compatibility Checker (uses PHPCompatibility)
- 67. Other tools For Wordpress : PHP Compatibility Checker (uses PHPCompatibility) PhpStorm 10+ : PHP 7 Compatibility Inspection sstalle/php7cc : similar functionality, slightly less up-to-date phan/phan : general static analyzer, compatibility checks are mostly useful for type checking adamculp/php-compatibility-check : docker image that uses PHPCompatibility, php7cc and phan
- 68. Conclusion No 100% detection But : 95% automation = lots of time saved ! First : PHPCompatibility on local machine Then : use your CI environment Start upgrading !
- 69. Questions ?
- 70. Questions ?
- 71. Thanks !