PHP 8.5 enables secure URI and URL parsing

PHP 8.5 has been released, adding an extension for securely parsing URIs and URLs to the now-30-year-old server-side scripting language.

Described as a major update, PHP 8.5 was released November 20 and can be accessed at PHP.net. The URI extension featured in the update is always available and provides APIs to securely parse and modify URIs and URLs based on the RFC 3986 and WHATWG (Web Hypertext Application Technology Working Group) URL standards. PHP 8.5 also features a pipe operator that allows chaining function calls together without dealing with intermediary variables. The pipe operator enables replacing many “nested calls” with a chain that can be read forward, instead of inside-out. Additionally in version 8.5, developers can update properties during object cloning by passing an associative array to the clone() function. This enables straightforward support of the “with-er” pattern for read-only classes.

Developers using PHP 8.5 can also take advantage of a #[NoDiscard] attribute. By adding this attribute to a function, PHP will check whether the returned value is consumed and emit a warning if it is not. The associated (void) cast can be used to indicate that a value is intentionally unused. Additionally in PHP 8.5, static closures and first-class callables now can be used in constant expressions. This includes attribute parameters, default values of properties and parameters, and constants, according to the update documents.

PHP 8.5. also features persistent cURL handles. Unlike curl_share_init(), handles built by curl_share_init_persistent() will not be destroyed at the end of a PHP request. If a persistent share handle with the same set of share options is found, it will be reused, avoiding the cost of initializing cURL handles every time. The array_first() and array_last() functions in PHP 8.5, meanwhile, return the first or last value of an array, respectively. If the array is empty, null is returned, making it easy to compose with the?? operator. Additional features in PHP 8.5 include the following:

A #[DelayedTargetValidation] attribute can suppress compile-time errors from core and extension attributes used on invalid targets.

Fatal errors, such as an exceeded maximum execution time, now include a backtrace.

Attributes now can target constants.

The #[Override] attribute can be applied to properties.

The #[Deprecated] attribute can be used on constants and traits.

Static properties support asymmetric visibility.

Properties can be marked as final via constructor property promotion.

The backtick operator as an alias for shell_exec() has been deprecated.