PHP 7.2

PHP 7.2 is a release of the PHP language shipped in November 2017 that placed particular emphasis on security and tidying up the language. Its flagship addition was bundling the Sodium cryptography library directly into the PHP core, making modern encryption available without installing extra extensions.

Why PHP 7.2 mattered

PHP 7.2 introduced changes affecting both syntax and data security:

• the object parameter type — the ability to declare that an argument or return value is any object;
• the Sodium extension in core — modern, well-vetted encryption algorithms available out of the box;
• removal of the deprecated mcrypt extension — an incentive to migrate to safer solutions;
• abstract method overriding and numerous performance fixes.

Bundling Sodium was an important step for the whole ecosystem — developers gained a standard encryption tool, which reduced the temptation to use weak, home-grown cryptography.

Practical applications

Official support for PHP 7.2 ended in 2020, so today it is an obsolete version. During its active life it was a popular choice for applications processing sensitive data, where robust cryptography working alongside SSL certificates mattered. Applications running on this version should be updated for security reasons. Modern hosting provides only supported releases, and moving to PHP 7.3 or later is usually fairly straightforward.

A focus on modern cryptography

The decision to bundle Sodium while simultaneously removing the outdated mcrypt extension was a clear signal that the language's maintainers took security seriously. mcrypt had not been developed for years and relied on outdated algorithms, so leaving it in the core was a risk. Sodium provided a modern, well-tested set of encryption functions in its place, and it remains the recommended way to handle cryptography in PHP applications today.