PHP 8.5: All MHASH_* constants deprecated
The Hash extension bundled in PHP core includes a backward compatibility layer for the mhash-class of PHP functions that the hash extension obsoletes. These functions are added only if PHP is compiled with the --with-mhash configuration.
In PHP 8.1, all mhash functions were deprecated. This included mhash, mhash_count, mhash_get_block_size, mhash_get_hash_name, and mhash_keygen_s2k functions.
However, in PHP 8.1, the PHP constants that those functions accepted as parameters were not deprecated. In PHP 8.5, all MHASH_* constants are deprecated along with the existing deprecation for the mhash functions.
The following snippet emits a deprecation message on PHP 8.1 and later for the mhash function deprecation:
mhash(MHASH_SHA1, 'test');Function mhash() is deprecated since 8.1 ...In PHP 8.5 and later, because the MHASH_* constants are also deprecated, the following deprecation notice also gets emitted:
+ Constant MHASH_SHA1 is deprecated ....
Function mhash() is deprecated since 8.1 ...All of the following MHASH_* PHP constants are deprecated in PHP 8.4. See their "string value for hash()" column for the recommended replacement when using the hash function.
mhash constant |
Constant value | string value for hash() |
|---|---|---|
MHASH_CRC32 |
0 |
crc32 |
MHASH_MD5 |
1 |
md5 |
MHASH_SHA1 |
2 |
sha1 |
MHASH_HAVAL256 |
3 |
haval256,3 |
MHASH_RIPEMD160 |
5 |
ripemd160 |
MHASH_TIGER |
7 |
tiger192,3 |
MHASH_GOST |
8 |
gost |
MHASH_CRC32B |
9 |
crc32b |
MHASH_HAVAL224 |
10 |
haval224,3 |
MHASH_HAVAL192 |
11 |
haval192,3 |
MHASH_HAVAL160 |
12 |
haval160,3 |
MHASH_HAVAL128 |
13 |
haval128,3 |
MHASH_TIGER128 |
14 |
tiger128,3 |
MHASH_TIGER160 |
15 |
tiger160,3 |
MHASH_MD4 |
16 |
md4 |
MHASH_SHA256 |
17 |
sha256 |
MHASH_ADLER32 |
18 |
adler32 |
MHASH_SHA224 |
19 |
sha224 |
MHASH_SHA512 |
20 |
sha512 |
MHASH_SHA384 |
21 |
sha384 |
MHASH_WHIRLPOOL |
22 |
whirlpool |
MHASH_RIPEMD128 |
23 |
ripemd128 |
MHASH_RIPEMD256 |
24 |
ripemd256 |
MHASH_RIPEMD320 |
25 |
ripemd320 |
MHASH_SNEFRU256 |
27 |
snefru256 |
MHASH_MD2 |
28 |
md2 |
MHASH_FNV132 |
29 |
fnv132 |
MHASH_FNV1A32 |
30 |
fnv1a32 |
MHASH_FNV164 |
31 |
fnv164 |
MHASH_FNV1A64 |
32 |
fnv1a64 |
MHASH_JOAAT |
33 |
joaat |
MHASH_CRC32C |
34 |
crc32c |
MHASH_MURMUR3A |
35 |
tiger160,3 |
MHASH_MURMUR3C |
36 |
tiger160,3 |
MHASH_MURMUR3F |
37 |
tiger160,3 |
MHASH_XXH32 |
38 |
tiger160,3 |
MHASH_XXH64 |
39 |
tiger160,3 |
MHASH_XXH3 |
40 |
tiger160,3 |
MHASH_XXH128 |
41 |
tiger160,3 |
Recommended replacement
As with the mhash function deprecations, the recommended replacement to prevent the deprecation notice is to prevent using mhash functions and constants altogether, and use the hash family of functions instead.
Calculating a hash
- $hash = mhash(MHASH_SHA1, 'test');
+ $hash = hash('sha1', 'test', true); hash function accepts a string value for the algorithm name (sha1 in the example), as opposed to a constant in mhash. Further, the hash function returns the computed hash value as a hex value by default, unless the third parameter of the hash function is set to true.
Calculating an HMAC
Computing an HMAC (Hash-based Message Authentication Code) can be done with the same mhash function with mhash*() family, but there is a separate hash_hmac function that makes this straight-forward.
- $hmac = mhash(MHASH_SHA1, 'test', 'secret-key');
+ $hmac = hash_hmac('sha1', 'test', 'secret-key', true);Backward Compatibility Impact
PHP Applications that use mhash functions with MHASH_* constants now get an additional deprecation notice for each MHASH_* constant usage.
Follow the recommended replacement with the hash function for a cross-version compatible fix.