Deprecated PHP Functions in PHP 8 and Their Modern Replacements

PHP 8 introduces many exciting new features while deprecating several outdated functions that may be removed in future releases; continuing to use these functions can lead to security risks or performance problems. The article outlines which PHP functions should be abandoned and offers modern replacements.

1. create_function()

Problem: This function dynamically created anonymous functions using eval() internally, which poses serious security hazards.

Alternative: Use anonymous functions (closures) introduced in PHP 5.3+.

// Old way (do not use)
$func = create_function('$a, $b', 'return $a + $b;');

// New way
$func = function($a, $b) { return $a + $b; };

2. each()

Problem: This function iterates over arrays but is slower and less intuitive than modern alternatives.

Alternative: Use foreach loops or a combination of current() / next() .

// Old way (do not use)
reset($array);
while (list($key, $value) = each($array)) {
    echo "$key => $value\n";
}

// New way
foreach ($array as $key => $value) {
    echo "$key => $value\n";
}

3. ereg() and eregi()

Problem: These are old POSIX regex functions that perform worse than PCRE regex.

Alternative: Use preg_match() and related PCRE functions.

// Old way (do not use)
if (ereg("^[a-zA-Z0-9]+$", $input)) {
    // ...
}

// New way
if (preg_match("/^[a-zA-Z0-9]+$/", $input)) {
    // ...
}

4. mysql_* functions

Problem: The entire mysql_* extension has been removed for years; these functions are insecure and lack support for modern MySQL features.

Alternative: Use MySQLi or PDO.

// Old way (do not use)
$link = mysql_connect('localhost', 'user', 'pass');
mysql_select_db('database', $link);

// New way (MySQLi)
$mysqli = new mysqli('localhost', 'user', 'pass', 'database');

// Or using PDO
$pdo = new PDO('mysql:host=localhost;dbname=database', 'user', 'pass');

5. split()

Problem: This function is an old alias of preg_split() that uses POSIX regex syntax.

Alternative: Use preg_split() directly or explode() for simple string splitting.

// Old way (do not use)
$parts = split('[.,]', 'one.two,three');

// New way
$parts = preg_split('/[.,]/', 'one.two,three');

6. call_user_method() and call_user_method_array()

Problem: These functions have been deprecated for many years and are remnants of early object‑oriented PHP.

Alternative: Use call_user_func() and call_user_func_array() .

// Old way (do not use)
call_user_method('method', $obj, $arg1, $arg2);

// New way
call_user_func([$obj, 'method'], $arg1, $arg2);

7. mcrypt_* functions

Problem: The mcrypt extension is deprecated, unmaintained, and has security issues.

Alternative: Use the OpenSSL extension.

// Old way (do not use)
$encrypted = mcrypt_encrypt(MCRYPT_RIJNDAEL_128, $key, $data, MCRYPT_MODE_CBC, $iv);

// New way
$encrypted = openssl_encrypt($data, 'AES-128-CBC', $key, OPENSSL_RAW_DATA, $iv);

8. __autoload()

Problem: This magic method has been replaced by spl_autoload_register() because it lacks flexibility.

Alternative: Register custom autoload functions with spl_autoload_register() .

// Old way (do not use)
function __autoload($class) {
    include 'classes/' . $class . '.class.php';
}

// New way
spl_autoload_register(function($class) {
    include 'classes/' . $class . '.class.php';
});

How to Detect Deprecated Functions in Code

Enable PHP's built‑in error reporting: error_reporting(E_ALL);

Use static analysis tools such as PHPStan or Psalm.

Run the code and watch for deprecation warnings.

Perform syntax checks with php -l .

Conclusion

Upgrading code to use modern PHP functions improves security, performance, and maintainability. Although legacy code may still "work," migrating to the recommended alternatives is essential for long‑term maintainability and safety. PHP 8 and future versions will continue to refine language features and retire outdated functionality, making it a developer's responsibility to stay current.