PHP’s New URI Extension: An Open Source Success Story 🔗 **Source:** [PHP’s New URI Extension: An Open Source Success Story](https://thephp.foundation/blog/2025/10/10/php-85-uri-extension/) > [!note]+ Document Notes > tags: [PHP 8.5, URI/URL, Open Source] > author: The PHP Foundation > source: The PHP Foundation > reference: [https://thephp.foundation/blog/2025/10/10/php-85-uri-extension/] > date created: 2025-10-11 00:00 > > # 🏷️ Title: PHP’s New URI Extension: An Open Source Success Story > <!-- deep-read:sections start --> ## 🧭 Table of Contents - [📝 Summary](#-summary) - [📖 Main Content](#-main-content) - [🗒️ Notes](#️-notes) - [📚 References](#-references) - [🗣️ Paraphrase](#️-paraphrase) - [📰 Newsletter](#-newsletter) - [✅ Action Items](#-action-items) - [🧪 Hypotheses](#-hypotheses) - [📊 Methodology](#-methodology) - [❓ Questions](#-questions) - [🔮 Future Research](#-future-research) - [💡 Implications](#-implications) - [🧠 Learning Styles Assessment](#-learning-styles-assessment) - [📊 Accessibility Assessment](#-accessibility-assessment) - [🌍 DEIB Assessment](#-deib-assessment) - [✅ Logical Validity](#-logical-validity) - [🛡️ DARVO Analysis](#-darvo-analysis) - [🎯 Conclusion](#-conclusion) ### 🔗 References - Include links cited in or relevant to the article. ## 📝 Summary - What happened. - PHP 8.5 introduces a built-in URI extension providing standards-compliant parsers for RFC 3986 and the WHATWG URL standard, plus safe mutation APIs. - Why it matters. - Replaces ad hoc parsing (e.g., parse_url) that “does not follow any standard” and can cause security issues. - Key stakeholders. - The PHP Foundation, Máté Kocsis, PHP internals reviewers, uriparser and Lexbor maintainers, Tideways. - Risks and tradeoffs. - Back-compat expectations demanded a careful, year-long design; dependency on upstream libraries requires ongoing coordination. - Bottom line. - PHP now ships robust, secure, standards-aligned URL handling, testable in PHP 8.5 RC1. ## 📖 Main Content - Core arguments - URLs are deceptively complex; inconsistent parsers lead to bugs and security issues. - PHP’s legacy parse_url appears to work but is unsafe for malformed/untrusted inputs. - PHP 8.5’s URI extension implements RFC 3986 and WHATWG URL parsing and provides immutable, component-wise “with-” modifiers. - Context/definitions - RFC 3986: the URI standard defining syntax and semantics. - WHATWG URL: browser-aligned parsing algorithm used on the web. - Uncertainties - Migration strategies from parse_url in complex legacy code may vary. - Future additions under the Uri namespace are planned but unspecified. ### 🗒️ Notes - “Because things are not as simple as they appear at first glance, these two commonly used standards are incompatible with each other!” - “parse_url() … does not follow any standard and is explicitly documented not to be used with untrusted or malformed URLs.” - Example pitfall: example.com/example/:8080/foo yields conflicting host/port/path when using parse_url. - “Going forward, PHP will include standards-compliant parsers for both RFC 3986 and the WHATWG URL standard … within a new ‘URI’ extension.” - Normalization vs raw getters: toString vs toRawString. - RFC process: discussions from June 2024; accepted May 2025 by 30:1 vote. - Implementation builds on uriparser (RFC 3986) and Lexbor (WHATWG), with upstream contributions to add cloning and component mutation. - Review by community contributors surfaced and fixed upstream bugs. - “Fully available for testing with PHP 8.5 RC 1.” ## 📚 References - RFC 3986 (URI Standard) https://www.rfc-editor.org/rfc/rfc3986 - WHATWG URL Living Standard https://url.spec.whatwg.org/ - PHP parse_url manual note https://www.php.net/parse_url - uriparser library https://uriparser.github.io/ - Lexbor project https://lexbor.com/ - PHP 8.5 downloads/RC info https://www.php.net/downloads.php#v8.5 - Tideways (sponsor) https://tideways.com/ - The PHP Foundation https://thephp.foundation/ ## 🗣️ Paraphrase - Paragraph A - URLs look simple but are complex; multiple standards (RFC 3986 vs WHATWG) are incompatible, and mixing parsers creates security risks. - Paragraph B - PHP’s new URI extension in 8.5 adds compliant parsers and safe mutation APIs, replacing unsafe parse_url patterns. ## 📰 Newsletter - PHP 8.5 ships a first-class URI extension with RFC 3986 and WHATWG parsers. Goodbye, gotchas from parse_url—hello, consistency and security. Try it on PHP 8.5 RC1. Bonus: upstream wins in uriparser and Lexbor mean the whole ecosystem benefits. Resources: RFC 3986, WHATWG URL, and PHP 8.5 RC notes. WordPress developers: safer URL handling for plugins, REST endpoints, and redirects is now standard. ## ✅ Action Items #### DevRel - Publish migration guide from parse_url to URI extension; record a 10-minute demo. - Add examples to docs: normalization, raw getters, with-er methods, error handling. - Host office hours on URL security pitfalls and standards differences. - Track adoption via code search queries; attribute tutorial-driven installs. #### OSPO - Define contribution pathways to upstream (uriparser/Lexbor) and PHP. - Add license/compliance checks for upstream deps; set review cadence. - Establish vuln intake and coordinated disclosure playbook with upstreams. - Maintain SBOM updates for PHP 8.5 builds; set freshness SLOs. #### Community - Run “first-issue” sessions for URI tests/docs. - Publish roadmap clinic notes; encourage component-focused reviews. - Share sponsor impact reports highlighting upstream fixes. #### WordPress - Core: audit parse_url usage; propose phased replacements. - Core Performance: benchmark URL-heavy routes; set perf budgets. - Plugins/Themes: provide lints and examples; add provenance checks for redirects. - Documentation: examples-first patterns and style guide updates. - Accessibility/Meta: ensure docs have clear, plain-language callouts. - CLI: add commands/snippets for safe URL mutation; smoke tests. #### The WPOCC - Fund microgrants for migrators; stipend maintainers. - Run documentation sprints; publish migration checklists. ### FAIR - Require provenance and signatures for upstream libs. - Publish funding transparency and sunset clauses for programmatic support. - Offer reusable governance charters and operator agreements. ## 🧪 Hypotheses - Projects replacing parse_url with the URI extension will reduce URL-related security bugs by ≥50% within a year. - Normalization defaults will cut duplicate-URL storage by ≥25% in typical apps. - Availability in core will increase standards-compliant parsing in PHP repos by ≥30% within six months. - Upstream collaboration shortens bug resolution times by ≥20% compared to bespoke forks. ### 📊 Methodology - Before/after bug analysis across popular PHP repos (CVE/issue labels). - Storage dedup assessment on URL datasets with/without normalization. - Ecosystem code search (e.g., GitHub) for adoption metrics over time. - Time-to-fix comparisons from upstream issue trackers pre/post-collaboration. ### ❓ Questions - What’s the recommended migration pattern for ambiguous parse_url outputs? - How are error states exposed and typed in the new API? - Any performance tradeoffs vs parse_url under high load? - How will future URI features integrate under the Uri namespace? ### 🔮 Future Research - Formal migration tooling (codemods) for parse_url usage. - Patterns for base-URL resolution aligning with WHATWG in server contexts. - Security guidelines for user-generated URL inputs at scale. ### 💡 Implications - Practice: safer redirects, HTTP client configs, and sanitization. - Policy: org standards mandating URI extension over parse_url. - Security: reduced SSRF/open redirect classes of bugs. - Education: curriculum updates on URL standards. - Funding: demonstrate ROI of upstream-first collaboration. ### 🧠 Learning Styles Assessment - Reading level: Flesch-Kincaid Grade ≈ 10–11 (estimate). #### 👀 Visual learners - Present: code-like examples inline. - Improve: side-by-side RFC vs WHATWG parse diagrams. #### 🔊 Aural learners - Improve: 3–5 minute audio summary of pitfalls and fixes. #### 🗣️ Verbal learners - Present: clear definitions and contrasts. - Improve: glossary of URL terms and edge cases. #### 🧩 Kinesthetic learners - Improve: hands-on labs parsing tricky URLs and applying with-ers. #### 🧠 Logical learners - Present: standards comparison and rationale. - Improve: decision trees for standard selection. #### 🧑‍🤝‍🧑 Social learners - Present: community credits. - Improve: moderated Q&A threads with maintainers. #### 🧘‍♀️ Solitary learners - Improve: self-check quizzes on URL edge cases. #### 🌿 Naturalistic learners - Improve: ecosystem impact framing of upstream-first work. ### 📊 Accessibility Assessment #### Screen reader semantics - Present: clear headings. - Improve: ensure descriptive link texts and alt text for examples. #### Keyboard navigation - Present: logical structure. - Improve: skip links in long docs pages. #### Contrast and readability - Present: readable web typography on site. - Improve: confirm 4.5:1 across code samples. #### Text resizing and reflow - Present: responsive layout. - Improve: test 200% zoom for code blocks. #### Media and captions - Improve: add captions/transcripts if videos are added. #### Forms and interactions - Improve: accessible feedback widgets on docs pages. #### Standards reference - Map gaps to WCAG 2.2 AA: 1.4.*, 2.1.*, 3.3.*. ### 🌍 DEIB Assessment #### Cultural breadth - Improve: highlight global contributors and locales. #### Inclusive language - Present: neutral, clear tone. - Improve: more plain-language summaries for non-specialists. #### Neurodiversity support - Present: consistent structure. - Improve: chunking with callouts and icon+text markers. #### Representation - Improve: include diverse examples and imagery with proper alt text. #### Psychological safety - Present: respectful framing of prior shortcomings. - Improve: publish clear community guidelines for discussions. ### ✅ Logical Validity #### Strong reasoning - Inductive: real-world incompatibilities → need for standard parsers; supported by concrete parse_url example. - Causal: upstream collaboration → faster fixes and shared benefits; evidenced by bug discoveries and prompt merges. #### Fallacies - None apparent; claims are scoped and example-based. #### Tone of voice - Constructive, collaborative, and forward-looking; emphasizes “doing things right rather than fast.” ### 🛡️ DARVO Analysis - No denial, attack, or reversal patterns. The piece acknowledges past gaps and focuses on solution-building. ## 🎯 Conclusion - Bottom line: PHP 8.5’s URI extension delivers secure, standards-compliant URL handling with a future-proof API, built through exemplary upstream collaboration. - Next steps: Test on PHP 8.5 RC1, plan migrations from parse_url, and contribute feedback/issues upstream. ## 🧱 Refactor Appendix (append after 🎯 Conclusion) ### 📚 Literature Split Pad - Purpose: Stage Konik CEE units that become per-source Literature notes. - Split level: **H3**. - Include verbatim quotes under 25 words and a [view highlight] link. ### [H1] 5–10-word present-tense claim > [!quote] [PHP’s New URI Extension: An Open Source Success Story](https://thephp.foundation/blog/2025/10/10/php-85-uri-extension/) by [[The PHP Foundation]] via [[The PHP Foundation]]. Published 2025-10-10. Accessed 2025-10-11. > “Going forward, PHP will include standards-compliant parsers for both RFC 3986 and the WHATWG URL standard.” Two lines: context and use. Cite data if relevant. [view highlight](https://thephp.foundation/blog/2025/10/10/php-85-uri-extension/#H1) #xref #articleseed ID:rw_[MISSING] ### [H2] 5–10-word present-tense claim > [!quote] [PHP’s New URI Extension: An Open Source Success Story](https://thephp.foundation/blog/2025/10/10/php-85-uri-extension/) > “parse_url() … is explicitly documented not to be used with untrusted or malformed URLs.” Two lines: context and use. [view highlight](https://thephp.foundation/blog/2025/10/10/php-85-uri-extension/#H2) #xref ID:rw_[MISSING] --- ### 🔖 Atomic Split Pad (Zettel Candidates) - Purpose: Promote reusable claims into Atomic notes. - Split level: **H4**. - Each item: one idea, present tense, specific, testable. #### [Z1] Built-in URI parsers reduce security bugs - Applies to PHP projects migrating from parse_url. - Pointer: PHP 8.5 URI announcement. - Links: [[URL-Parsing]] [[Secure-Defaults]] #### [Z2] Normalization lowers duplicate URL storage - Applies when canonicalizing URLs server-side. - Pointer: normalization vs toRawString example. - Links: [[Data-Hygiene]] [[Canonicalization]] --- ### ✏️ Fleeting Queue (Extract by Selection) - Purpose: Capture quick actions or sparks for Fleeting notes. - Extraction: Select one line → “Refactor: Extract selection to new note (content only).” - Keep each line short and self-contained. - [F1] Draft codemod to replace parse_url with URI APIs — context/https://thephp.foundation/blog/2025/10/10/php-85-uri-extension/ #fleeting #inbox - [F2] Create lab: RFC 3986 vs WHATWG parsing differences — context/https://url.spec.whatwg.org/ #fleeting #inbox - [F3] Benchmark normalization impact on cache keys — context/https://www.rfc-editor.org/rfc/rfc3986 #fleeting #inbox --- <!-- deep-read:sections end -->