Tag: php-86

PHP 8.6 adds mysqli::quote_string(), a single-quote-only escaper modeled on PDO::quote(). See the injection gap it closes and how to migrate safely.

PHP 8.6 is in release candidate stage with GA planned for November 19. Here is how to run your tests against it with Docker and a CI matrix job now.

PHP 8.6 ships November 19 with a long list of deprecations. Here is which ones will hit real code and a small token-based scanner that finds them.

PHP 8.6 adds < and > endianness modifiers to pack() and unpack() for signed integers and floats. Here is the syntax, the rules, and one upgrade gotcha.

PHP 8.6 adds clamp() and a nanosecond-precision Time\Duration class. See how they tidy up exponential backoff and other bounded-value code.

PHP 8.6 lets readonly properties declare default values. Here is what changed, why interface properties made it worthwhile, and the edge cases to watch.

The PHP Foundation's first quarterly report covers ext/uri Builder classes, raw AF_PACKET sockets, a zval size experiment, PIE 1.5, and 100+ security fixes.

PHP 8.6 flips three insecure session defaults, use_strict_mode, cookie_httponly, and cookie_samesite, closing gaps OWASP has flagged for years.