PHP 8.3

Use these requirements for applications generated or reviewed for PHP 8.3, which is in security-fixes-only support through 2027-12-31.

Types, classes, and trusted state

• Start application files with declare(strict_types=1); and give functions, methods, properties, and returns narrow types. Validate external values before conversion; strict types do not establish provenance, ranges, or authorization.
• Translate accepted input into explicit DTOs or value objects. Never use extract(), broad setters, reflection, or arbitrary request keys to populate domain models.
• Declare every property and avoid #[\AllowDynamicProperties]. Dynamic writes hide mistakes and make attacker-controlled field assignment difficult to audit.
• Do not treat a readonly class or property as deep immutability or access control: objects it references remain mutable, and all constructor values still cross the normal validation boundary.
• Use enums and fixed server-side maps for roles, workflow states, sort fields, handlers, templates, classes, and method names. Do not dispatch a callable or lifecycle hook named by an untrusted value.
• Put PHP 8.3's #[\Override] on methods intended to implement or override authorization, validation, serialization, and lifecycle hooks so a misspelling fails at compile time. In PHP 8.3 it applies to methods, not properties. Apply it to __construct() only when implementing a constructor declared abstract or in an interface.
• Mark secret-bearing parameters on each concrete implementation with #[\SensitiveParameter], while still redacting logs,