Free course · 35 lessons · Intermediate

PHP 7: Maintaining and Upgrading Legacy Apps

Work confidently in PHP 7 codebases: language features, testing and refactoring legacy code, security hardening, and a safe path to PHP 8.

1. PHP 7 Language Essentials

What PHP 7.0–7.4 introduced and what you'll see in real PHP 7 codebases.

What PHP 7 Changed — The PHP 7 engine, scalar and return types, and the Throwable hierarchy.
Null Coalescing, Spaceship and Other Operators — Use ??, <=>, ??= and other PHP 7 conveniences.
PHP 7.1–7.3: Nullable, void, iterable and More — Nullable types, void, iterable, class constant visibility, multi-catch and list() improvements.
PHP 7.4: Typed Properties, Arrow Functions and Preloading — The last PHP 7 release and the features that bridge to PHP 8.
Anonymous Classes, Generators and Closures in PHP 7 — Recognize and modernize idioms common in PHP 7 code.

Find your way around old code, add Composer, tame globals and configuration, and debug production issues.

Reading and Mapping Legacy Code — Build a mental map of an unfamiliar PHP 7 application before changing it.
Introducing Composer to a Legacy Project — Add Composer and autoloading without breaking existing includes.
Taming Globals, Includes and Superglobals — Contain global state so code becomes testable and predictable.
Configuration and Environments — Move hard-coded settings and secrets into environment-based configuration.
Debugging and Logging Legacy Apps — Use Xdebug, error logs and structured logging to understand production behavior.

Characterization tests, seams and PHPUnit 9 to make change safe.

Characterization Tests — Capture what the code does today before you change it.
Seams and Breaking Dependencies — Create seams so hard-to-test code can be isolated.
PHPUnit for PHP 7 Projects — Choose the right PHPUnit version and configure a test suite for an old codebase.
Golden Master and Approval Tests — Snapshot large outputs like reports and HTML pages to refactor safely.

Small, safe steps: extract functions and classes, replace arrays with objects, and strangle old modules.

Extract Function and Extract Class — Break up long scripts and god classes in small, verifiable steps.
Replacing Associative Arrays with Objects — Turn 'array shapes' into typed DTOs and value objects.
The Strangler Fig Pattern — Replace a legacy app piece by piece behind a routing layer.
Static Analysis on Legacy Code — Adopt PHPStan with a baseline and raise strictness over time.

Fix the classic vulnerabilities in old PHP code: SQL injection, weak password hashes, XSS, sessions and outdated dependencies.

Migrating from mysql_* and String SQL to PDO — Remove injection-prone queries and dead extensions.
Upgrading Weak Password Hashes — Move from md5/sha1 hashes to password_hash without forcing resets.
Fixing XSS in Legacy Templates — Systematically escape output in PHP templates mixed with logic.
Hardening Sessions and Authentication — Fix session fixation, insecure cookies and weak 'remember me' implementations.
End-of-Life PHP and Vulnerable Dependencies — Assess and reduce risk when you can't upgrade immediately.

Plan the upgrade, fix breaking changes, automate with Rector, and roll out safely.

Planning a PHP 8 Upgrade — Inventory, test coverage, dependency upgrades and target version choice.
PHP 8.0 Breaking Changes That Bite — String-number comparisons, stricter errors, removed functions and more.
Deprecations in PHP 8.1–8.4 — Dynamic properties, null to non-nullable internal parameters, implicit nullable types and more.
Automating the Upgrade with Rector — Use Rector set lists to upgrade syntax and fix breaking patterns automatically.
Rolling Out PHP 8 in Production — Test, deploy gradually, monitor and keep a rollback path.

Get the most out of PHP 7 runtimes before and during an upgrade.

OPcache and Realpath Cache on PHP 7 — Production OPcache settings and common misconfigurations.
Profiling Slow Legacy Pages — Find where time goes with profilers and query logs.
Adding Caching to a Legacy App — Introduce APCu, Redis and HTTP caching without large rewrites.

Containerize, deploy without downtime, monitor and plan the road ahead.

Containerizing a Legacy PHP App — Make the old app reproducible with Docker before changing it further.
Zero-Downtime Deploys for PHP — Atomic release directories, OPcache resets and safe migrations.
Monitoring Legacy PHP Applications — Know when the app is unhealthy with logs, metrics and uptime checks.
A Roadmap Beyond PHP 7 — Turn maintenance into a sustained modernization plan.