PHP Wiki

display_error_function_args - info copied from ML

calvinb (calvinb@undisclosed.example.com) — 2026-04-10T07:20:08+00:00

2026/04/02 18:40		current
Line 1:		Line 1:
	====== PHP RFC: Display Function Arguments in Errors ======		====== PHP RFC: Display Function Arguments in Errors ======
-	* Version: 1.5	+	* Version: 1.6
	* Date: 2026-03-09		* Date: 2026-03-09
	* Author: Calvin Buckley, calvinb@php.net		* Author: Calvin Buckley, calvinb@php.net
Line 57:		Line 57:

	Even if we do set this to 1 by default, we may not want to do so for tests. Because of the wide impact to the formatting of tests, this would involve touching a large majority of PHP tests (there are currently over 21000 today). While my implementation PR does attempt to update ''bless.php'' for common cases where strings can now be visible and need to be adjusted for (e.g. paths including usernames), bless can still munge the expect sections in a way that requires manual adjustment. There is precedent for not using this; the "[[error_backtraces_v2\|Error Backtraces v2]]" RFC chose to not do so.		Even if we do set this to 1 by default, we may not want to do so for tests. Because of the wide impact to the formatting of tests, this would involve touching a large majority of PHP tests (there are currently over 21000 today). While my implementation PR does attempt to update ''bless.php'' for common cases where strings can now be visible and need to be adjusted for (e.g. paths including usernames), bless can still munge the expect sections in a way that requires manual adjustment. There is precedent for not using this; the "[[error_backtraces_v2\|Error Backtraces v2]]" RFC chose to not do so.
		+
		+	==== Performance impact ====
		+
		+	Most benchmarks (like the one in the repository) don't measure the impact of errors. I initially tried using ''benchmark/'', but found nothing measurable - it's to be expected, as I don't think many errors and such should be triggering in a normal run. As such, I had to develop a very naive benchmark (the Lhogstone):
		+
		+	<code php>
		+	<?php
		+
		+	/* -d error_include_args=X -d display_errors=0 -d error_log=/tmp/test */
		+
		+	$iter = isset($argv[1]) ? intval($argv[1]) : 10000;
		+	$start = hrtime(true);
		+	for ($i = 0; $i < $iter; $i++) {
		+	hex2bin("ABC"); /* or like unlink("/") for something that does more */
		+	}
		+	$end = hrtime(true);
		+	$total_ns = $end - $start;
		+	$total = $total_ns / 1_000_000_000;
		+
		+	echo "Finished $iter iterations in $total sec\n";
		+
		+	?>
		+	</code>
		+
		+	On an M1 Pro:
		+
		+	<code>
		+	Iterations With Without
		+	10000 0.025276917 0.016741333
		+	100000 0.189566666 0.123559584
		+	1000000 1.798127917 1.146331917
		+	10000000 18.1332335 11.267384125
		+	</code>
		+
		+	However, note that most code is //not// calling ''php_error_docref'' in a tight loop. If you're getting a million errors a second, you have bigger problems. IMHO, code that emits errors is either infrequent enough to not make a difference, or needs to be fixed before you should or could measure performance. Either way, I think the benefit is worth it in the situation where you //do// need to diagnose problems.

	===== Backward Incompatible Changes =====		===== Backward Incompatible Changes =====
Line 132:		Line 167:
	===== Changelog =====		===== Changelog =====

		+	* 1.6: Add performance impact/benchmarks from ML post
	* 1.5: Rename to "error_include_args" to avoid a confusing INI name.		* 1.5: Rename to "error_include_args" to avoid a confusing INI name.
	* 1.4: Fix default value vote title		* 1.4: Fix default value vote title

rfc - eol-oniguruma started voting

youkidearitai (youkidearitai@undisclosed.example.com) — 2026-04-10T00:42:34+00:00

2026/04/09 08:48		current
Line 15:		Line 15:
	* [[rfc:debugable-enums\|Debugable Enums]] (Created 2026-03-12; discussion started 2026-03-12; voting started 2026-04-02, ends 2026-04-16)		* [[rfc:debugable-enums\|Debugable Enums]] (Created 2026-03-12; discussion started 2026-03-12; voting started 2026-04-02, ends 2026-04-16)
	* [[rfc:tls_session_resumption_api\|TLS Session Resumption Support for Streams]] (Created 2025-12-22; discussion started 2025-12-22)		* [[rfc:tls_session_resumption_api\|TLS Session Resumption Support for Streams]] (Created 2025-12-22; discussion started 2025-12-22)
		+	* [[rfc:eol-oniguruma\|Oniguruma maintenance end and end of mbregex]] (Created 2025-08-21; voting started 2026-04-10, ends 2026-04-25)

	===== Under Discussion =====		===== Under Discussion =====
Line 25:		Line 26:
	* [[rfc:snmp_improvements_2026\|SNMP Improvements]] (Created 2026-03-30)		* [[rfc:snmp_improvements_2026\|SNMP Improvements]] (Created 2026-03-30)
	* [[rfc:release_manager_selection_policy\|Release Manager Selection]] (Created 2026-03-27)		* [[rfc:release_manager_selection_policy\|Release Manager Selection]] (Created 2026-03-27)
-	* [[rfc:eol-oniguruma\|Oniguruma maintenance end and end of mbregex]] (Created 2025-08-21)
	* [[rfc:php-community\|php-community: A faster-moving, community-driven PHP]] (Created 2026-03-14)		* [[rfc:php-community\|php-community: A faster-moving, community-driven PHP]] (Created 2026-03-14)
	* [[rfc: display_error_function_args \| Display Function Arguments in Errors]] (Created 2026-03-09)		* [[rfc: display_error_function_args \| Display Function Arguments in Errors]] (Created 2026-03-09)

eol-oniguruma - Voting for eol-oniguruma

youkidearitai (youkidearitai@undisclosed.example.com) — 2026-04-10T00:39:19+00:00

2026/03/27 05:32		current
Line 3:		Line 3:
	* Date: 2025-08-21		* Date: 2025-08-21
	* Author: Yuya Hamada youkidearitai@gmail.com		* Author: Yuya Hamada youkidearitai@gmail.com
-	* Status: Under Discussion	+	* Status: Voting
	* Implementation: https://github.com/php/php-src/pull/21490		* Implementation: https://github.com/php/php-src/pull/21490

Line 166:		Line 166:
	===== Voting Choices =====		===== Voting Choices =====

-	* Drop support the mbregex functions, Deprecate 8.6 and delete 9.0	+	Primary Vote requiring a 2/3 majority to accept the RFC:
		+
		+	<doodle title="Drop support the mbregex functions, Deprecate 8.6 and delete 9.0" voteType="single" closed="false" closeon="2026-04-25T00:00:00Z">
		+	* Yes
		+	* No
		+	* Abstain
		+	</doodle>

	===== Implementation =====		===== Implementation =====

promoted_readonly_constructor_reassign

nicolasgrekas (nicolasgrekas@undisclosed.example.com) — 2026-04-09T08:48:36+00:00

2026/04/09 08:46		current
Line 4:		Line 4:
	* Date: 2026-02-19		* Date: 2026-02-19
	* Author: Nicolas Grekas <nicolasgrekas@php.net>		* Author: Nicolas Grekas <nicolasgrekas@php.net>
-	* Status: Rejected	+	* Status: Declined
	* First Published at: https://wiki.php.net/rfc/promoted_readonly_constructor_reassign		* First Published at: https://wiki.php.net/rfc/promoted_readonly_constructor_reassign

const_object_property_write - Add “Abstain” option to vote

timwolla (timwolla@undisclosed.example.com) — 2026-04-09T08:34:09+00:00

2026/04/04 00:53		current
Line 188:		Line 188:
	* Yes		* Yes
	* No		* No
		+	* Abstain
	</doodle>		</doodle>

array_only_except - was declined, update state

daniels (daniels@undisclosed.example.com) — 2026-04-09T01:13:20+00:00

2026/03/12 17:20		current
Line 3:		Line 3:
	* Date: 2026-02-20		* Date: 2026-02-20
	* Author: Muhammed Arshid KV, arshidkv12@gmail.com		* Author: Muhammed Arshid KV, arshidkv12@gmail.com
-	* Status: Voting	+	* Status: Declined
	* Implementation: TBD		* Implementation: TBD

deprecations_php_8_6 - Remove entry not needing a RFC anymore

alexandredaubois (alexandredaubois@undisclosed.example.com) — 2026-04-08T17:06:26+00:00

2026/04/08 17:02		current
Line 20:		Line 20:
	* Deprecate <php>strcoll()</php>		* Deprecate <php>strcoll()</php>
	* Deprecate <php>SORT_LOCALE_STRING</php> flag for <php>sort()</php> functions		* Deprecate <php>SORT_LOCALE_STRING</php> flag for <php>sort()</php> functions
-	* Providing invalid values to <php>log()</php> second argument
	* Deprecate <php>mail.add_x_header</php> INI setting		* Deprecate <php>mail.add_x_header</php> INI setting
	* Deprecate <php>mysqli::stmt_init()</php>		* Deprecate <php>mysqli::stmt_init()</php>
Line 87:		Line 86:
	* Relies on global state from <php>setlocale()</php>		* Relies on global state from <php>setlocale()</php>
	* Alternative: <php>Collator::sort()</php>, <php>Collator::asort()</php>, <php>Collator::sort()</php>, <php>Collator::sortWithSortKeys()</php>		* Alternative: <php>Collator::sort()</php>, <php>Collator::asort()</php>, <php>Collator::sort()</php>, <php>Collator::sortWithSortKeys()</php>
-
-	==== Providing invalid values to log() second argument ====
-
-	* Author: Alexandre Daubois <alexandredaubois@php.net>
-
-	Providing 1 or any number less or equal to 0 results on a NaN result. This is error-prone. Deprecating then throwing a <php>ValueError</php> in PHP 9.0 would help early error detection and avoid propagating a NaN value.

	==== Deprecate mail.add_x_header INI setting ====		==== Deprecate mail.add_x_header INI setting ====

context-managers - Convert continue question back to a secondary vote.

crell (crell@undisclosed.example.com) — 2026-04-07T16:06:30+00:00

2026/04/07 16:06		current
Line 719:		Line 719:

	<doodle title="How should continue behave?" voteType="single" closed="true" closeon="2025-01-01T15:30:00Z">		<doodle title="How should continue behave?" voteType="single" closed="true" closeon="2025-01-01T15:30:00Z">
-	* Exactly like switch	+	* Exactly like in switch
	* Ignore using blocks entirely, like try		* Ignore using blocks entirely, like try
	* Abstain		* Abstain

explicit_this_parameter

timwolla (timwolla@undisclosed.example.com) — 2026-04-07T15:29:25+00:00

2026/04/05 19:06		current
Line 43:		Line 43:
	We propose allowing a named argument <php>this:</php> to be combined with the “scope resolution operator” syntax of referring to a method to be used as an alternative way of calling an instance method. The value passed to the <php>this:</php> argument will effectively be used as the left side of the <php>-></php> operator.		We propose allowing a named argument <php>this:</php> to be combined with the “scope resolution operator” syntax of referring to a method to be used as an alternative way of calling an instance method. The value passed to the <php>this:</php> argument will effectively be used as the left side of the <php>-></php> operator.

-	Since the <php>this:</php> argument does not refer to a parameter in the underlying argument list and thus there is no ambiguity with regard to positional arguments it may be placed at any position of the argument list. In particular it may appear at the first position, before all positional arguments, mirroring the left-most position for a regular method call.	+	Since the <php>this:</php> argument does not refer to a parameter in the underlying parameter list and thus there is no ambiguity with regard to positional arguments it may be placed at any position of the argument list. In particular it may appear at the first position, before all positional arguments, mirroring the left-most position for a regular method call.

	<PHP>		<PHP>

mariadb_rfc

georg (georg@undisclosed.example.com) — 2026-04-07T15:18:29+00:00

2026/04/07 10:52		current
Line 419:		Line 419:

	===== Impacts =====		===== Impacts =====
-
-	Performance Improvements: Existing PHP functions that prepare and execute statements, such as mysql_execute_query() (introduced in PHP 8.2), could be updated to use execute_direct when connected to a MariaDB server. This would allow one-time statements to bypass the extra round-trip and metadata fetch, providing immediate performance gains.

	Backward Compatibility: All invisible features are fully backward-compatible with MySQL. Visible features are MariaDB-specific but can be safely ignored or no-oped when connected to a MySQL server.		Backward Compatibility: All invisible features are fully backward-compatible with MySQL. Visible features are MariaDB-specific but can be safely ignored or no-oped when connected to a MySQL server.
Line 482:		Line 480:

	===== Changelog =====		===== Changelog =====
-	2026-04-07: Updated benchmark results	+	* 2026-04-07: Updated benchmark results
		+	* 2026-04-07: removed performance improvement by execute_direct (this doesn't seem to work with php streams yet)

php86 - Fix dates

edorian (edorian@undisclosed.example.com) — 2026-04-07T12:11:38+00:00

2026/03/31 18:16		current
Line 57:		Line 57:
	There are 7 candidates for two available seats. While it might not be likely that all preferences are necessary, you are encouraged to use all votes. If you vote for the same person twice, this will not help that person's chances; it will only throw away one of your votes and deprioritize the remaining ones, so please cast //unique// votes.		There are 7 candidates for two available seats. While it might not be likely that all preferences are necessary, you are encouraged to use all votes. If you vote for the same person twice, this will not help that person's chances; it will only throw away one of your votes and deprioritize the remaining ones, so please cast //unique// votes.

-	Voting using STV (Single Transferable Vote) started on 31 April 2025 18:00:00 UTC. Voting will be open until 15 April 2025 18:00:00 UTC. Tiebreaking will be at the discretion of the prior branch RMs.	+	Voting using STV (Single Transferable Vote) started on 31 March 2026 18:00:00 UTC. Voting will be open until 15 April 2026 18:00:00 UTC. Tiebreaking will be at the discretion of the prior branch RMs.

	==== 1st Preference ====		==== 1st Preference ====

array_get_and_array_has

barel (barel@undisclosed.example.com) — 2026-04-06T16:18:40+00:00

2026/04/06 14:55		current
Line 159:		Line 159:
	* ''array_get()''		* ''array_get()''
	<PHP>		<PHP>
-	function array_get(array $array, string\|int\|null $key, mixed $default = null): mixed {	+	function array_get(array $array, array\|string\|int\|null $key, mixed $default = null): mixed {
	if ($key === null) {		if ($key === null) {
	return $array;		return $array;
Line 202:		Line 202:
	* ''array_has()''		* ''array_has()''
	<PHP>		<PHP>
-	function array_has(array $array, string\|int $key): bool {	+	function array_has(array $array, array\|string\|int $key): bool {
	if (is_int($key)) {		if (is_int($key)) {
	return array_key_exists($key, $array);		return array_key_exists($key, $array);

uri_followup

kocsismate (kocsismate@undisclosed.example.com) — 2026-04-06T05:52:50+00:00

2026/04/06 05:34		current
Line 545:		Line 545:
	RFC 3986 defines a generic URI syntax. Its host categorization reflects this generality as it uses the "registered name" phrasing, without assuming any particular name resolution mechanism. In particular, a registered name is a syntactic production and does not imply a DNS domain.		RFC 3986 defines a generic URI syntax. Its host categorization reflects this generality as it uses the "registered name" phrasing, without assuming any particular name resolution mechanism. In particular, a registered name is a syntactic production and does not imply a DNS domain.

-	In contrast, the WHATWG URL specification defines a host model mostly tailored to web interoperability. Because these two specifications operate at different abstraction levels and assign different semantics to superficially similar host forms, their host type systems are not compatible. For example, an RFC 3986 registered name cannot in general be mapped to a WHATWG domain, and WHATWG’s opaque and empty host concepts have no direct equivalents in RFC 3986.	+	In contrast, the WHATWG URL specification defines a host model mostly tailored to web interoperability. Because these two specifications operate at different abstraction levels and assign different semantics to superficially similar host forms, their host type systems are not compatible. For example, an RFC 3986 registered name cannot in general be mapped to a WHATWG domain, and WHATWG’s opaque host concept has no direct equivalent in RFC 3986.

-	Therefore, a unified host type enum would either blur these semantic distinctions or incorrectly suggest compatibility where none exists. Using separate enums ensures that the host classification faithfully reflects the underlying specification being applied.	+	Therefore, a unified host type enum would either blur these semantic distinctions or incorrectly suggest full compatibility, but only partial compatibility exists. Using separate enums ensures that the host classification faithfully reflects the underlying specification being applied.

	<doodle title="Add support for host type detection as outlined in the RFC?" voteType="single" closed="true" closeon="2026-04-10T09:00:00Z">		<doodle title="Add support for host type detection as outlined in the RFC?" voteType="single" closed="true" closeon="2026-04-10T09:00:00Z">

php_license_update

ramsey (ramsey@undisclosed.example.com) — 2026-04-06T00:20:11+00:00

2026/04/04 03:07		current
Line 401:		Line 401:
	* Andrei Zmievski //(approved, 2024-05-14)//		* Andrei Zmievski //(approved, 2024-05-14)//

-	In addition to the dates listed above, which are from separate private correspondence with each PHP Group member, I have captured a complete email thread where each member of the PHP Group replied to note their approval of this proposal; [[https://static.ben.ramsey.dev/php/rfc/license-update/php-license-update-php-group-correspondence.pdf\|a PDF of this email thread is available]].	+	In addition to the dates listed above, which are from separate private correspondence with each PHP Group member, I have captured a complete email thread where each member of the PHP Group replied to note their approval of this proposal; [[https://github.com/php/policies/blob/main/php-license/php-group-consent.pdf\|a PDF of this email thread is available]].

	==== Do We Require Permission From Perforce Software? ====		==== Do We Require Permission From Perforce Software? ====
Line 421:		Line 421:
	To make the changes proposed in this RFC, the PHP project will require that a representative (or representatives) from the PHP Group work with representatives from Perforce Software to agree to this proposal.		To make the changes proposed in this RFC, the PHP project will require that a representative (or representatives) from the PHP Group work with representatives from Perforce Software to agree to this proposal.

-	Perforce Software has indicated their support for this proposal in their letter [[https://static.ben.ramsey.dev/php/rfc/license-update/zend-technologies-php-license-consent.pdf\|Re: Formal Consent to PHP RFC]]:	+	Perforce Software has indicated their support for this proposal in their letter [[https://github.com/php/policies/blob/main/php-license/zend-technologies-consent.pdf\|Re: Formal Consent to PHP RFC]]:

	<blockquote>		<blockquote>

mysqli_quote_string - Implemented

dharman (dharman@undisclosed.example.com) — 2026-04-05T19:11:05+00:00

2026/03/10 23:24		current
Line 3:		Line 3:
	* Date: 2025-12-18		* Date: 2025-12-18
	* Author: Kamil Tekiela		* Author: Kamil Tekiela
-	* Status: Accepted	+	* Status: Implemented
	* Implementation: https://github.com/php/php-src/pull/20729		* Implementation: https://github.com/php/php-src/pull/20729

Line 117:		Line 117:

	===== Implementation =====		===== Implementation =====
-	After the RFC is implemented, this section should contain:	+	https://github.com/php/php-src/commit/fbf8bf84dbe3bed33a179a668e2c3d5d109d469a
-	- the version(s) it was merged into	+
-	- a link to the git commit(s)	+
-	- a link to the PHP manual entry for the feature	+

	===== References =====		===== References =====

policy-exempt-type-value-error-bc-policy - RFC is accepted

girgias (girgias@undisclosed.example.com) — 2026-04-05T12:15:54+00:00

2026/03/21 18:53		current
Line 4:		Line 4:
	* Date: 2026-03-02		* Date: 2026-03-02
	* Author: Gina Peter Banyard <girgias@php.net>		* Author: Gina Peter Banyard <girgias@php.net>
-	* Status: Voting	+	* Status: Accepted
	* First Published at: https://wiki.php.net/rfc/policy-exempt-type-value-error-bc-policy		* First Published at: https://wiki.php.net/rfc/policy-exempt-type-value-error-bc-policy

Line 88:		Line 88:
	Voting started on 2026-03-21 and will end on 2026-04-04.		Voting started on 2026-03-21 and will end on 2026-04-04.

-	<doodle title="Accept php/policies PR #27?" auth="girgias" voteType="single" closed="false" closeon="2026-04-04T12:00:00Z">	+	<doodle title="Accept php/policies PR #27?" auth="girgias" voteType="single" closed="true" closeon="2026-04-04T12:00:00Z">
	* Yes		* Yes
	* No		* No

session_security_defaults - created

jorg_sowa (jorg_sowa@undisclosed.example.com) — 2026-04-04T09:17:43+00:00

2026/04/10 10:30	current
Line 1:	Line 1:
	+	====== PHP RFC: Secure Session Configuration Defaults ======
	+	* Date: 2026-04-04
	+	* Target version: PHP 8.6
	+	* Author: Jorg Sowa
	+	* Status: Draft
	+	* First Published at: http://wiki.php.net/rfc/session_security_defaults
	+
	+	===== Introduction =====
	+
	+	Three ini settings in PHP's session extension have security implications but ship with defaults that leave applications unnecessarily exposed. This RFC proposes changing those defaults so that new PHP installations are secure out of the box, without requiring application code changes for the common case.
	+
	+	The affected settings are:
	+
	+	- ''session.use_strict_mode'' — reject unrecognised session IDs supplied by the client
	+	- ''session.cookie_httponly'' — exclude the session cookie from the JavaScript cookie API
	+	- ''session.cookie_samesite'' — restrict cross-site delivery of the session cookie
	+
	+	Each change is a single-line edit to ''ext/session/session.c''. No new ini entries, functions, or constants are introduced.
	+
	+	===== Background =====
	+
	+	==== Session Fixation (use_strict_mode) ====
	+
	+	Session fixation allows an attacker to pre-plant a known session ID and wait for a victim to authenticate against it. With ''use_strict_mode=0'' (the current default), ''session_start()'' accepts any well-formed ID supplied in a cookie, ''$_GET'', or ''$_POST'' and begins a session under that ID without verifying that the ID already exists in storage.
	+
	+	With ''use_strict_mode=1'', ''php_session_initialize()'' calls ''s_validate_sid()'' on the proposed ID before accepting it. The built-in files handler checks whether a session file for that ID exists on disk; because an attacker-planted ID has no corresponding file, a fresh random ID is generated instead.
	+
	+	==== JavaScript Cookie Access (cookie_httponly) ====
	+
	+	The ''[[https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#httponly\|HttpOnly]]'' cookie attribute, defined in [[https://www.rfc-editor.org/rfc/rfc6265#section-4.1.2.6\|RFC 6265 §4.1.2.6]] and supported by all browsers since IE 6, instructs the browser to exclude the cookie from the ''document.cookie'' API. A script running in the page — whether first-party or injected by an XSS attack — cannot read or exfiltrate an HttpOnly cookie.
	+
	+	PHP has supported ''session.cookie_httponly'' since PHP 5.2.0 (2006) and the flag has been universally recommended by security guidance ([[https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html#httponly-attribute\|OWASP]], [[https://infosec.mozilla.org/guidelines/web_security.html#cookies\|Mozilla]], [[https://pages.nist.gov/800-63-4/sp800-63b/session/#sesscookies\|NIST]]) ever since. There is no legitimate reason to default it to off.
	+
	+	==== CSRF via Cross-Site Requests (cookie_samesite) ====
	+
	+	The ''[[https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#samesitesamesite-value\|SameSite]]'' attribute controls whether the browser attaches a cookie to cross-site requests. Without it, a forged form or link on an attacker-controlled site can trigger authenticated requests using the victim's session.
	+
	+	PHP's ''session.cookie_samesite'' defaults to an empty string, which emits ''Set-Cookie'' with no ''SameSite'' attribute. Browsers have progressively tightened their handling of such cookies: Chrome applied ''SameSite=Lax'' as the default starting with [[https://www.chromium.org/updates/same-site/\|Chrome 80 (February 2020)]], and [[https://groups.google.com/g/mozilla.dev.platform/c/nx2uP0CzA9k\|Firefox followed with version 103 (August 2022)]]. Setting the attribute explicitly in PHP aligns the ''Set-Cookie'' header with browser behaviour and removes reliance on per-browser inference.
	+
	+	Setting ''SameSite=Lax'' on session cookies is recommended by ([[https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html#samesite-cookie-attribute\|OWASP]], [[https://infosec.mozilla.org/guidelines/web_security.html#cookies\|Mozilla]], [[https://pages.nist.gov/800-63-4/sp800-63b/session/#sesscookies\|NIST]]).
	+
	+	===== Comparison with Other Platforms =====
	+
	+	^ Platform ^ Session cookie ^ HttpOnly default ^ SameSite default ^
	+	\| [[https://www.php.net/manual/en/session.security.ini.php\|PHP]] \| ''PHPSESSID'' \| [[https://www.php.net/manual/en/session.configuration.php#ini.session.cookie-httponly\|''0'' (off)]] \| [[https://www.php.net/manual/en/session.configuration.php#ini.session.cookie-samesite\|not set]] \|
	+	\| [[https://tomcat.apache.org/tomcat-10.1-doc/config/context.html\|Java (Tomcat 10)]] \| ''JSESSIONID'' \| [[https://tomcat.apache.org/tomcat-10.1-doc/config/context.html#Common_Attributes\|''true'']] \| not set \|
	+	\| [[https://learn.microsoft.com/en-us/dotnet/api/system.web.sessionstate.httpsessionstate\|.NET Framework]] \| ''ASP.NET_SessionId'' \| [[https://learn.microsoft.com/en-us/dotnet/api/system.web.httpcookie.httponly?view=netframework-4.8.1\|''false'' (off)]] \| not set \|
	+	\| [[https://learn.microsoft.com/en-us/aspnet/core/fundamentals/app-state?view=aspnetcore-9.0\|ASP.NET Core]] \| ''.AspNetCore.Session'' \| [[https://learn.microsoft.com/en-us/aspnet/core/fundamentals/app-state?view=aspnetcore-9.0#configure-session-options\|''true'']] \| [[https://learn.microsoft.com/en-us/aspnet/core/fundamentals/app-state?view=aspnetcore-9.0#configure-session-options\|''Lax'']] \|
	+	\| [[https://github.com/rack/rack-session\|Ruby (Rack)]] \| ''rack.session'' \| [[https://github.com/rack/rack-session/blob/4af61147b4ad40d6f692330f278c7cd349e1cd21/lib/rack/session/abstract/id.rb#L267\|''true'']] \| not set \|
	+	\| [[https://docs.djangoproject.com/en/stable/topics/http/sessions/\|Python (Django)]] \| ''sessionid'' \| [[https://docs.djangoproject.com/en/stable/ref/settings/#session-cookie-httponly\|''true'']] \| [[https://docs.djangoproject.com/en/stable/ref/settings/#session-cookie-samesite\|''Lax'']] \|
	+	\| [[https://github.com/expressjs/session\|Node.js (express-session)]] \| ''connect.sid'' \| [[https://github.com/expressjs/session/blob/408229ea3373097732875315d6f63c45e39fd3b6/session/cookie.js#L28\|''true'']] \| not set \|
	+	\| [[https://pkg.go.dev/github.com/gorilla/sessions\|Go (gorilla/sessions)]] \| configurable \| [[https://github.com/gorilla/sessions/blob/ef99c782e9aae430b326a614151c983dcd7c2c1d/options.go#L21\|''false'' (off)]] \| not set \|
	+	\| [[https://laravel.com/docs/session\|PHP (Laravel)]] \| ''laravel_session'' \| [[https://github.com/laravel/laravel/blob/75cef503c6edc3447dd79053a648ea981857e15b/config/session.php#L185\|''true'']] \| [[https://github.com/laravel/laravel/blob/75cef503c6edc3447dd79053a648ea981857e15b/config/session.php#L202\|''Lax'']] \|
	+	\| [[https://symfony.com/doc/current/session.html\|PHP (Symfony)]] \| ''PHPSESSID'' \| [[https://symfony.com/doc/current/reference/configuration/framework.html#cookie-httponly\|''true'']] \| [[https://symfony.com/doc/current/reference/configuration/framework.html#cookie-samesite\|''Lax'']] \|
	+
	+	===== Proposal =====
	+
	+	Change the following three default values in ''ext/session/session.c'':
	+
	+	^ INI setting ^ Old default ^ New default ^
	+	\| ''session.use_strict_mode'' \| ''0'' \| ''1'' \|
	+	\| ''session.cookie_httponly'' \| ''0'' \| ''1'' \|
	+	\| ''session.cookie_samesite'' \| '''' \| ''Lax'' \|
	+
	+	===== Backward Incompatible Changes =====
	+
	+	==== session.use_strict_mode = 1 ====
	+
	+	Applications that deliberately supply an externally controlled session ID — for example, a shared-secret hand-off between subdomains using the files save handler — will have the ID rejected because no matching session file exists at the time of the first request. The correct approach is to write and close the session on the originating side (''session_write_close()'') before presenting the ID to the receiving side.
	+
	+	Applications using a custom session handler whose ''validateId()'' method returns ''true'' unconditionally are unaffected. This includes common backends such as Redis and Memcached when using the default ''php-memcached'' or ''phpredis'' session handlers, which do not implement ''validateId()'' and therefore fall back to returning ''true''.
	+
	+	==== session.cookie_httponly = 1 ====
	+
	+	The ''HttpOnly'' flag is enforced by the browser. It prevents the session cookie value from being read via ''document.cookie''; it has no effect on whether the browser sends the cookie with requests.
	+
	+	Applications that read the session cookie value from ''document.cookie'' in JavaScript (for example, to embed the ID in a custom request header) will no longer be able to do so. The session ID is a server-side credential and should not be consumed by client-side code. Applications that need a client-accessible token for request correlation should use a separate, explicitly non-HttpOnly CSRF token rather than the session cookie itself.
	+
	+	==== session.cookie_samesite = Lax ====
	+
	+	With ''SameSite=Lax'', the browser sends the session cookie on same-site requests and on top-level cross-site navigations using safe HTTP methods (GET, HEAD). It does not send the cookie on cross-site sub-resource requests or cross-site POST requests.
	+
	+	Applications that rely on cross-site POST carrying the session cookie — for example, SP-initiated SAML SSO flows or legacy cross-origin form submissions — must either set ''SameSite=None; Secure'' explicitly for those endpoints or migrate to a token-based flow.
	+
	+	As noted above, Chrome and Firefox already apply ''Lax'' as the implicit default for cookies sent without a ''SameSite'' attribute. Applications running on those browsers are already subject to this behaviour; the change makes it explicit and consistent across all browsers and PHP versions.
	+
	+	==== Browser support ====
	+
	+	The ''SameSite'' cookie attribute is supported across all modern browsers:
	+
	+	^ Browser ^ SameSite support since ^ Lax-by-default since ^ Reference ^
	+	\| Chrome \| 51 (May 2016) \| [[https://www.chromium.org/updates/same-site/\|80 (February 2020)]] \| [[https://developer.chrome.com/blog/samesite-cookies-explained\|Chrome blog]] \|
	+	\| Firefox \| 60 (May 2018) \| [[https://groups.google.com/g/mozilla.dev.platform/c/nx2uP0CzA9k\|103 (August 2022)]] \| [[https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#samesitesamesite-value\|MDN]] \|
	+	\| Safari \| 12.1 (March 2019) \| not applied \| [[https://webkit.org/blog/10218/full-third-party-cookie-blocking-and-more/\|WebKit blog]] \|
	+	\| Edge \| 18 (October 2018) \| [[https://learn.microsoft.com/en-us/microsoft-edge/web-platform/site-impacting-changes\|85 (August 2020)]] \| [[https://learn.microsoft.com/en-us/microsoft-edge/web-platform/site-impacting-changes\|Edge docs]] \|
	+
	+	Safari supports the attribute and respects an explicit ''SameSite=Lax'' value but does not apply Lax as an implicit default for cookies lacking the attribute. Setting the attribute explicitly in PHP therefore closes the cross-browser gap and removes reliance on per-browser inference.
	+
	+	===== Proposed PHP Versions =====
	+
	+	PHP 8.6.
	+
	+	===== Vote =====
	+
	+	As per the [[https://wiki.php.net/rfc/voting\|voting RFC]], a Yes/No vote with a 2/3 majority is required for each item. Each change is voted on separately so that the internals list can accept a subset.
	+
	+	- Change ''session.use_strict_mode'' default to ''1'': Yes / No
	+	- Change ''session.cookie_httponly'' default to ''1'': Yes / No
	+	- Change ''session.cookie_samesite'' default to ''Lax'': Yes / No
	+
	+	===== Implementation =====
	+
	+	Patch to the ''PHP_INI_BEGIN()'' block in ''ext/session/session.c''. No PR exists yet.
	+
	+	===== References =====
	+
	+	* [[https://www.php.net/manual/en/session.security.ini.php\|PHP Manual: Session security-related ini settings]]
	+	* [[https://www.rfc-editor.org/rfc/rfc6265#section-4.1.2.6\|RFC 6265 §4.1.2.6: HttpOnly attribute]]
	+	* [[https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#httponly\|MDN: HttpOnly attribute]]
	+	* [[https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#samesitesamesite-value\|MDN: SameSite attribute]]
	+	* [[https://caniuse.com/same-site-cookie-attribute\|Can I Use: SameSite]]
	+	* [[https://www.chromium.org/updates/same-site/\|Chromium: SameSite cookie changes]]
	+	* [[https://groups.google.com/g/mozilla.dev.platform/c/nx2uP0CzA9k\|Firefox: SameSite=Lax by default]]
	+	* [[https://web.dev/articles/samesite-cookies-explained\|web.dev: SameSite cookies explained]]

sort_direction_enum - Implemented

timwolla (timwolla@undisclosed.example.com) — 2026-04-02T19:20:36+00:00

2026/04/01 17:32		current
Line 3:		Line 3:
	* Date: 2026-03-02		* Date: 2026-03-02
	* Author: Tim Düsterhus, timwolla@php.net		* Author: Tim Düsterhus, timwolla@php.net
-	* Status: Accepted	+	* Status: Implemented
-	* Implementation: tbd	+	* Implementation: https://github.com/php/php-src/commit/32c1931f18109655bc074dd5cda3248b838de636

	===== Introduction =====		===== Introduction =====
Line 105:		Line 105:

	===== Implementation =====		===== Implementation =====
-	After the RFC is implemented, this section should contain:	+
-	- the version(s) it was merged into	+	* https://github.com/php/php-src/commit/32c1931f18109655bc074dd5cda3248b838de636
-	- a link to the git commit(s)	+
-	- a link to the PHP manual entry for the feature	+

	===== References =====		===== References =====

stream_errors - Version 2.3

bukka (bukka@undisclosed.example.com) — 2026-04-02T17:21:55+00:00

2026/03/29 18:04		current
Line 1:		Line 1:
	====== PHP RFC: Stream Error Handling Improvements ======		====== PHP RFC: Stream Error Handling Improvements ======
-	* Version: 2.2	+	* Version: 2.3
	* Date: 2025-11-18		* Date: 2025-11-18
	* Author: Jakub Zelenka, bukka@php.net		* Author: Jakub Zelenka, bukka@php.net
Line 102:		Line 102:

	/**		/**
-	* Categorized error codes for stream operations	+	* Error codes for stream operations
	*/		*/
	enum StreamErrorCode		enum StreamErrorCode
	{		{
-	// General errors
	case None;		case None;
	case Generic;		case Generic;
-
-	// I/O operation errors
	case ReadFailed;		case ReadFailed;
	case WriteFailed;		case WriteFailed;
Line 122:		Line 119:
	case NotWritable;		case NotWritable;
	case NotReadable;		case NotReadable;
-
-	// File system operation errors
	case Disabled;		case Disabled;
	case NotFound;		case NotFound;
Line 148:		Line 143:
	case Readonly;		case Readonly;
	case RecursionDetected;		case RecursionDetected;
-
-	// Wrapper/protocol errors
	case NotImplemented;		case NotImplemented;
	case NoOpener;		case NoOpener;
Line 159:		Line 152:
	case WrapperUnregistrationFailed;		case WrapperUnregistrationFailed;
	case WrapperRestorationFailed;		case WrapperRestorationFailed;
-
-	// Filter errors
	case FilterNotFound;		case FilterNotFound;
	case FilterFailed;		case FilterFailed;
-
-	// Cast/conversion errors
	case CastFailed;		case CastFailed;
	case CastNotSupported;		case CastNotSupported;
	case MakeSeekableFailed;		case MakeSeekableFailed;
	case BufferedDataLost;		case BufferedDataLost;
-
-	// Network/socket errors
	case NetworkSendFailed;		case NetworkSendFailed;
	case NetworkRecvFailed;		case NetworkRecvFailed;
Line 184:		Line 171:
	case RedirectLimit;		case RedirectLimit;
	case AuthFailed;		case AuthFailed;
-
-	// Encoding/decoding errors
	case ArchivingFailed;		case ArchivingFailed;
	case EncodingFailed;		case EncodingFailed;
	case DecodingFailed;		case DecodingFailed;
	case InvalidFormat;		case InvalidFormat;
-
-	// Resource/allocation errors
	case AllocationFailed;		case AllocationFailed;
	case TemporaryFileFailed;		case TemporaryFileFailed;
-
-	// Locking errors
	case LockFailed;		case LockFailed;
	case LockNotSupported;		case LockNotSupported;
-
-	// Userspace stream errors
	case UserspaceNotImplemented;		case UserspaceNotImplemented;
	case UserspaceInvalidReturn;		case UserspaceInvalidReturn;
	case UserspaceCallFailed;		case UserspaceCallFailed;
-
-	public function isIoError(): bool {}
-	public function isFileSystemError(): bool {}
-	public function isWrapperError(): bool {}
-	public function isFilterError(): bool {}
-	public function isCastError(): bool {}
-	public function isNetworkError(): bool {}
-	public function isEncodingError(): bool {}
-	public function isResourceError(): bool {}
-	public function isLockError(): bool {}
-	public function isUserspaceError(): bool {}
	}		}

Line 407:		Line 375:
	?>		?>
	</code>		</code>
-
-	==== Error Codes ====
-
-	Error codes are defined as cases on the ''StreamErrorCode'' enum. They are organized into groups by category:
-
-	^ Group ^ Example Cases ^
-	\| General \| ''None'', ''Generic'' \|
-	\| I/O operations \| ''ReadFailed'', ''WriteFailed'' \|
-	\| File system operations \| ''NotFound'', ''PermissionDenied'' \|
-	\| Wrapper/protocol operations \| ''NotImplemented'', ''WrapperNotFound'' \|
-	\| Filter operations \| ''FilterNotFound'', ''FilterFailed'' \|
-	\| Cast/conversion operations \| ''CastFailed'', ''CastNotSupported'' \|
-	\| Network/socket operations \| ''NetworkSendFailed'', ''ProtocolError'' \|
-	\| Encoding/decoding operations \| ''EncodingFailed'', ''DecodingFailed'' \|
-	\| Resource/allocation operations\| ''AllocationFailed'', ''TemporaryFileFailed'' \|
-	\| Locking operations \| ''LockFailed'', ''LockNotSupported'' \|
-	\| Userspace stream operations \| ''UserspaceNotImplemented'' \|
-
-	The ''is*Error()'' convenience methods on ''StreamErrorCode'' check whether the case falls within the corresponding
-	group.

	==== Error Grouping ====		==== Error Grouping ====
Line 456:		Line 404:

	// Get the primary error		// Get the primary error
-	$primary = $errors[0] ?? null;	+	$primary = array_first($errors);

-	// Search for specific codes using array_any (PHP 8.5+)	+	// Search for specific codes
	if (array_any($errors, fn($e) => $e->code === StreamErrorCode::NotImplemented)) {		if (array_any($errors, fn($e) => $e->code === StreamErrorCode::NotImplemented)) {
	echo "Stream does not implement required functionality\n";		echo "Stream does not implement required functionality\n";
	}		}

-	// Find a specific error using array_find (PHP 8.5+)	+	// Find a specific error
	$notImpl = array_find($errors, fn($e) => $e->code === StreamErrorCode::NotImplemented);		$notImpl = array_find($errors, fn($e) => $e->code === StreamErrorCode::NotImplemented);
	if ($notImpl) {		if ($notImpl) {
	echo "Not implemented: " . $notImpl->message . "\n";		echo "Not implemented: " . $notImpl->message . "\n";
-	}
-
-	// Check error categories
-	if (array_any($errors, fn($e) => $e->code->isNetworkError())) {
-	echo "Network-related error occurred\n";
	}		}

Line 497:		Line 440:

	$errors = $e->getErrors();		$errors = $e->getErrors();
-	$first = $errors[0] ?? null;	+	$first = array_first($errors);
	if ($first) {		if ($first) {
	echo "Wrapper: " . $first->wrapperName . "\n";		echo "Wrapper: " . $first->wrapperName . "\n";
Line 526:		Line 469:
	if ($stream === false) {		if ($stream === false) {
	$errors = stream_last_errors();		$errors = stream_last_errors();
-	$first = $errors[0] ?? null;	+	$first = array_first($errors);

	if ($first) {		if ($first) {
Line 533:		Line 476:
	if ($first->code === StreamErrorCode::NotFound) {		if ($first->code === StreamErrorCode::NotFound) {
	echo "Resource not found, using fallback...\n";		echo "Resource not found, using fallback...\n";
-	}
-
-	// Check error category
-	if ($first->code->isNetworkError()) {
-	echo "Network-related error occurred\n";
	}		}
	}		}
Line 639:		Line 577:
	} catch (StreamException $e) {		} catch (StreamException $e) {
	echo "Copy failed: " . $e->getMessage() . "\n";		echo "Copy failed: " . $e->getMessage() . "\n";
-
-	$errors = $e->getErrors();
-	if (array_any($errors, fn($e) => $e->code->isIoError())) {
-	echo "I/O error during copy\n";
-	}
	}		}

Line 670:		Line 603:

	* Additional error codes - As new stream operations and wrappers are added		* Additional error codes - As new stream operations and wrappers are added
-	* **Extension-specific error ranges - Reserved ranges for extensions to define custom** error codes	+	* **Error code categories - Convenience methods or interfaces for grouping related** error codes
	* Error metadata - Additional context fields for specific error types		* Error metadata - Additional context fields for specific error types
	* Context parameter for more functions - Additional stream functions may gain optional ''$context'' parameters to enable error handling configuration where currently not possible		* Context parameter for more functions - Additional stream functions may gain optional ''$context'' parameters to enable error handling configuration where currently not possible
Line 684:		Line 617:
	</doodle>		</doodle>

-	The vote started on 2025-XX-XX at XX:XX UTC and ends on 2025-XX-XX at XX:XX UTC.	+	The vote started on 2026-XX-XX at XX:XX UTC and ends on 2026-XX-XX at XX:XX UTC.

	===== Patches and Tests =====		===== Patches and Tests =====
Line 708:		Line 641:
	===== Changelog =====		===== Changelog =====

-	* 2.2 - Replace ''StreamError'' class constants with ''StreamErrorCode'' enum, replace linked-list error chaining with arrays and related functions updates, added stream_clear_errors	+	* 2.3 - Remove error code categories and ''is*Error()'' methods from ''StreamErrorCode'' enum, defer to future scope
		+	* 2.2 - Replace ''StreamError'' class constants with ''StreamErrorCode'' enum, replace linked-list error chaining with arrays and related functions updates, added ''stream_clear_errors()''
	* 2.1 - Replace ''StreamErrorCode'' enum with ''StreamError'' class constants (''CODE_'' prefix), move ''isError()'' methods to ''StreamError'', prohibit error handling options on default context, add context parameter to some stream functions		* 2.1 - Replace ''StreamErrorCode'' enum with ''StreamError'' class constants (''CODE_'' prefix), move ''isError()'' methods to ''StreamError'', prohibit error handling options on default context, add context parameter to some stream functions
	* 2.0 - Major API redesign with enums, error chaining, and simplified retrieval		* 2.0 - Major API redesign with enums, error chaining, and simplified retrieval
	* 1.0 - Initial version		* 1.0 - Initial version

debugable-enums - open the vote

daniels (daniels@undisclosed.example.com) — 2026-04-02T16:58:45+00:00

2026/03/16 18:09		current
Line 3:		Line 3:
	* Date: 2026-03-12		* Date: 2026-03-12
	* Author: Daniel Scherzer, daniel.e.scherzer@gmail.com		* Author: Daniel Scherzer, daniel.e.scherzer@gmail.com
-	* Status: Under Discussion	+	* Status: In voting
	* Implementation: https://github.com/php/php-src/pull/21425		* Implementation: https://github.com/php/php-src/pull/21425
	* Discussion thread: https://news-web.php.net/php.internals/130303		* Discussion thread: https://news-web.php.net/php.internals/130303
Line 114:		Line 114:
	Primary Vote requiring a 2/3 majority to accept the RFC:		Primary Vote requiring a 2/3 majority to accept the RFC:

-	<doodle title="Allow __debugInfo() in enums?" voteType="single" closed="true" closeon="2025-01-01T15:30:00Z">	+	<doodle title="Allow __debugInfo() in enums?" voteType="single" closed="false" closeon="2026-04-16T23:59:59Z">
	* Yes		* Yes
	* No		* No

2026/04/09 08:48		current
Line 15:		Line 15:
	* [[rfc:debugable-enums\|Debugable Enums]] (Created 2026-03-12; discussion started 2026-03-12; voting started 2026-04-02, ends 2026-04-16)		* [[rfc:debugable-enums\|Debugable Enums]] (Created 2026-03-12; discussion started 2026-03-12; voting started 2026-04-02, ends 2026-04-16)
	* [[rfc:tls_session_resumption_api\|TLS Session Resumption Support for Streams]] (Created 2025-12-22; discussion started 2025-12-22)		* [[rfc:tls_session_resumption_api\|TLS Session Resumption Support for Streams]] (Created 2025-12-22; discussion started 2025-12-22)
		+	* [[rfc:eol-oniguruma\|Oniguruma maintenance end and end of mbregex]] (Created 2025-08-21; voting started 2026-04-10, ends 2026-04-25)

	===== Under Discussion =====		===== Under Discussion =====
Line 25:		Line 26:
	* [[rfc:snmp_improvements_2026\|SNMP Improvements]] (Created 2026-03-30)		* [[rfc:snmp_improvements_2026\|SNMP Improvements]] (Created 2026-03-30)
	* [[rfc:release_manager_selection_policy\|Release Manager Selection]] (Created 2026-03-27)		* [[rfc:release_manager_selection_policy\|Release Manager Selection]] (Created 2026-03-27)
-	* [[rfc:eol-oniguruma\|Oniguruma maintenance end and end of mbregex]] (Created 2025-08-21)
	* [[rfc:php-community\|php-community: A faster-moving, community-driven PHP]] (Created 2026-03-14)		* [[rfc:php-community\|php-community: A faster-moving, community-driven PHP]] (Created 2026-03-14)
	* [[rfc: display_error_function_args \| Display Function Arguments in Errors]] (Created 2026-03-09)		* [[rfc: display_error_function_args \| Display Function Arguments in Errors]] (Created 2026-03-09)