No Deprecated Functions

ID

php.no_deprecated_functions

Severity

low

Remediation Complexity

trivial

Remediation Risk

low

Remediation Effort

low

Resource

Reliability

Language

Php

Tags

deprecation, reliability

Description

Reports calls to standard-library functions that have been deprecated or removed in PHP 7 and 8, such as the mysql_* family, each, create_function, money_format, get_magic_quotes_gpc and utf8_encode. The list of flagged functions is configurable through the deprecatedFunctions property.

Rationale

A removed function raises a fatal error on a current runtime, so code that calls one simply stops working after an upgrade; a deprecated function emits a notice today and is scheduled to be removed later. Either way the call is a latent break that should be migrated to the supported replacement while the change is cheap. The POSIX regular-expression functions (ereg, split and relatives) are handled by a dedicated POSIX-regex rule and are not reported here.

<?php
$link = mysql_connect('localhost');   // FLAW — mysql_* removed in PHP 7.0
$pair = each($array);                 // FLAW — each() removed in PHP 8.0
$cb = create_function('$a', '...');   // FLAW — removed in PHP 8.0
$s = utf8_encode($text);              // FLAW — deprecated in PHP 8.2

$pdo = new PDO($dsn);                  // OK — supported database API
foreach ($array as $value) {}         // OK — replacement for each()
$s = mb_convert_encoding($text, 'UTF-8', 'ISO-8859-1'); // OK

Remediation

Replace each deprecated call with its supported equivalent: mysqli or PDO for the mysql_* functions, a foreach loop for each, an arrow or anonymous function for create_function, NumberFormatter for money_format, and mb_convert_encoding for utf8_encode/utf8_decode.

References