PHP upgrade questions, answered

php2shell is a PHP upgrade compatibility scanner and code migration assistant. You give it a PHP project, it reports the compatibility problems that break a PHP 8 upgrade with the exact file and line, previews the automatic fixes as a unified diff and exports an HTML or PDF report.

The analysis is rule based. The engine reads the source files, applies 26 upgrade rules that mirror the Rector upgrade rule sets and reports every match with its location, the PHP version it affects and the recommended change. The automatic fixing applies the transformations that can be applied safely by a program and leaves the rest to you.

Targets between PHP 7.4 and 8.3 are supported. The current runtime version is read from the php requirement in composer.json when that file is present, and can be set manually otherwise. Rules that only affect a newer target, such as the implicit nullable parameter deprecation of PHP 8.4, are listed in the rule catalog and only reported when you select that target.

No. php2shell runs in the browser: you upload a zip archive of your project or paste the files into the workspace. There is no extension to install and no command to remember.

Yes. The scanner never talks to your repository. You upload a zip archive or paste the files, and nothing is stored after the analysis is finished.

Removed function families such as each(), create_function(), the mysql_* and ereg() functions, null passed to a non-nullable internal function parameter, required parameters that follow optional ones, the removal of the automatic conversion of false to an empty string and, from PHP 8.2, the creation of dynamic properties.

Writing to a property that the class does not declare is deprecated in PHP 8.2 and raises a notice. It becomes an error in PHP 9. The fix is to declare the property on the class, or to add the #[AllowDynamicProperties] attribute when the class intentionally stores extra data.

It depends on the function. utf8_encode() and utf8_decode() are deprecated since PHP 8.2 but still work. each(), create_function(), the mysql_* family and the ereg() family were removed and now raise a fatal error when called.

utf8_encode() only handled ISO-8859-1 input, so the correct replacement is mb_convert_encoding($value, 'UTF-8', 'ISO-8859-1'). The decode direction is mb_convert_encoding($value, 'ISO-8859-1', 'UTF-8').

You can, but it is much safer to move branch by branch. PHP 8.0 removed whole function families, 8.1 tightened null handling, 8.2 deprecated dynamic properties and 8.3 deprecated a few more calls. Smaller steps mean smaller diffs to review.

It analyses the source code you submit and reads the php requirement from composer.json. It does not resolve your dependency tree, so the usual first step is still to update the dependencies with composer update and then scan the result.

Only after you confirm. The dry-run shows a unified diff of every change without touching anything. When you apply the fix, the tool returns the patched files and a change summary: which files changed, which issues were fixed automatically and which still need a developer.

No. It applies well-defined Rector style transformations on a best-effort basis. Review the diff and run your test suite in a staging environment before you deploy. php2shell does not guarantee that an upgrade is free of runtime errors or business interruptions.

Yes. The HTML report is free for every account and contains the summary, the runtime advisories, every issue with its location and the disclaimer. The PDF report is included with the Fixer licence.

You run your test suite locally, paste the output and php2shell parses it: the pass rate, the number of failures and errors, and the list of failing test cases with their location. The parsing happens on the output, never on your code.

php2shell bundles a small database of PHP runtime advisories. It compares the detected PHP version with the fixed release of each branch and reports the versions that are older than the fix. It reports the version status only, no exploitation details.

The full compatibility scan, the runtime advisory check, the issue list with file and line numbers, and the HTML report. The free plan does not include the automatic fixing, the diff preview or the PDF export.

The dry-run diff preview, the one-click automatic fixing, the change summary after every run and the PDF report export. The licence is bound to your account and can be released from it at any time.

Prepaid credits for the AI assisted review. One credit covers one review of a finding the rule engine cannot decide on its own. You never bring your own API key: the platform pays the model provider and the credit is the unit.

One credit per review. A pack of 10 credits costs $9, 50 credits cost $39 and 200 credits cost $129, so the unit price falls the larger the pack. The balance and the consumption history are visible in the dashboard.

Yes, self-service from the subscription page. The plan stays active until the end of the billing period and you are not charged again. Refund windows are described on the refund policy page.

The Fixer + Verify plan is priced for agencies and hosting companies and includes batch project handling, the PHPUnit verification and AI review credits. Write to support@php2shell.top for a volume licence.

The scan, the fix and the report are produced by the server that hosts this tool, so the files you submit are processed there. They are used to produce your result and are not shared with anyone else.

The fragment is de-identified before it is sent: comments are removed, string literals and variable names are replaced by placeholders, and credentials, e-mail addresses, URLs, IP addresses and file system paths are masked. The de-identified fragment is used for the answer and then discarded. It is never stored.

No. The AI review is part of the token quality pack, which is prepaid. php2shell does not resell API keys and does not give you access to the provider account.

No advertising cookie and no cross-site tracking. The browser local storage only keeps your session token and your profile so that you stay signed in. The home page loads a cookie-less traffic statistics script and a session replay script from Umami, which see the pages you visit and never receive your source code, your licence key or your payment data.

Yes. The dashboard can export your data as JSON and delete the account, which anonymises the personal data within 30 days. You can also write to support@php2shell.top and we will do it for you.

support@php2shell.top. We answer within two business days. The support mailbox is also linked in the footer of every page.