# RFC: Default character encoding - Status: Implemented (PHP 5.6) - Authors: Yasuo Ohgaki yohgaki@ohgaki.net - Date: 2014-01-01 - Version: 1.0.1 - Original: https://wiki.php.net/rfc/default_encoding - Page: https://externals.io/rfc/default_encoding - More for agents: search with https://externals.io/search.md?q={query} · RFCs at https://externals.io/rfc.md · JSON API at https://externals.io/api · documentation at https://externals.io/llms.txt ## Votes ### Default Character Encoding (closed) Yes: 8 · No: 1 Voters: ajf (Yes), chobieeee (Yes), indeyets (Yes), lstrojny (Yes), oaass (Yes), pollita (No), treffynnon (Yes), willfitch (Yes), yohgaki (Yes) ## Discussions on the mailing list - [Request for Comments: Use default_charset As Default Character Encoding](https://externals.io/message/68020.md) — started on 2013-06-29, 1 messages - [\[RFC\] Use default_charset As Default Character Encoding](https://externals.io/message/69933.md) — started on 2013-10-29, 11 messages - [\[VOTE\] Default character encoding](https://externals.io/message/70779.md) — started on 2013-12-20, 29 messages - [default_encoding RFC – aftermath](https://externals.io/message/103087.md) — started on 2018-08-12, 4 messages - [mbstring/iconv encoding deprecation](https://externals.io/message/128623.md) — started on 2025-09-04, 5 messages --- ## Introduction This RFC proposes that use default\_charset as default character encoding. Current PHP does not have default encoding setting. This makes adoption of PHP 5.4 difficult, since PHP 5.4's htmlentities/htmlspecialchars is now default to UTF-8. Some applications are required to set proper encoding for htmlentities/htmlspecialchars for proper character processing. If users mixed ISO-8859-1 and UTF-8 (AND many other multibyte character encodings), it could cause security problem. There are many encoding setting in php.ini and functions that users simply ignore and leave it alone. However, it is required to handle character encoding properly for secure programs. Objectives of this proposal are: 1. Setting charset in HTTP header is recommended since the first XSS advisory in 2000 Feb. by CERT and Microsoft. (Better security) 2. There are too many encoding settings and it is better to consolidated. 3. If we have yet another multibyte string module in the future, the new common ini settings can be used. (No more module specific INIs) ## Proposal Set **default\_charset=“UTF-8”** as PHP default for both compiled and php.ini-\* option. Add **php.input\_encoding, php.internal\_encoding and php.output\_encoding** for encoding related module/functions. - php.input\_encoding (Default: empty) - php.internal\_encoding (Default: default\_charset php.ini setting) - php.output\_encoding (Default: empty) Use **default\_charset as default** for encoding related php.ini settings and module/functions. Not touched - zend.script\_encoding PHP 5.6 and master, introduce new php.ini setting. Old iconv.\*/mbstring.\* php.ini parameters will be removed for master PHP6. Use of iconv.\*/mbstring.\* php.ini parameters raise E\_DEPRECATED for 5.6 and up. - php.input\_encoding - php.internal\_encoding - php.output\_encoding - iconv.input\_encoding (Default: php.input\_encoding) - iconv.internal\_encoding (Default: php.internal\_encoding) - iconv.output\_encoding (Default: php.output\_encoding) - mbstring.http\_input (Default: php.input\_encoding) - mbstring.internal\_encoding (Default: php.internal\_encoding) - mbstring.http\_output (Default: php.output\_encoding) - all functions that take encoding option use php.internal\_encoding as default (e.g. htmlentities/mb\_strlen/mb\_regex/etc) PHP 5.5 - leave as it is now ### Precedence of settings ``` default_charset < php.* < mbstring.*/iconv.* < encoding specified by functions ``` ### Encoding name handling mbstring and iconv have different level of support. - mbstring: - iconv: [http://www.gnu.org/savannah-checkouts/gnu/libiconv/documentation/libiconv-1.13/iconv\_open.3.html](http://www.gnu.org/savannah-checkouts/gnu/libiconv/documentation/libiconv-1.13/iconv_open.3.html) Notes: - iconv does not have API for getting supported encoding and iconv is built with system's iconv library. - mbstring has API to check encoding is supported or not. - users are responsible to set proper encoding name. e.g. mbstring has SJIS-win, but iconv only has SJIS - if encoding names conflicts, users should set module specific ini to valid(non empty) value ### Use cases It simplify i18n applications. Unifies \*.output\_encoding/\*.internal\_encoding/\*.input\_encoding setting. Users may check default\_charset see if encoding conversion is needed or not. For example, pcre/sqlite only suports UTF-8 and users may check & convert encoding as follows. ``` if (ini_get('default_charset') !== 'UTF-8') { $str = mb_convert_encoding($str, 'UTF-8'); } preg, sqlite function calls here. ``` ### Other related issues escapeshellcmd/escapeshellarg/fgetcsv or like, are using locale based MBCS support via php\_mblen(). These functions are out side of this RFC scope. Database character encoding is also out side of this RFC scope. ### BC issues None when users already using UTF-8 as their encoding. Other users may have to change “default\_encoding” php.ini setting (leave it empty or set it to desired encoding) ## Patch PoC Patch ## Vote Options - Yes - No ## Vote Vote start: 2013/12/20 01:00 UTC Vote end: 2014/01/10 01:00 UTC **Vote: Default Character Encoding** — Yes: 8 · No: 1 (closed) ## References - Internals discussion - ## Implementation - - [http://svn.php.net/viewvc?view=revision&revision=332850](http://svn.php.net/viewvc?view=revision&revision=332850) - [http://svn.php.net/viewvc?view=revision&revision=332851](http://svn.php.net/viewvc?view=revision&revision=332851) - [http://svn.php.net/viewvc?view=revision&revision=332852](http://svn.php.net/viewvc?view=revision&revision=332852) - [http://svn.php.net/viewvc?view=revision&revision=332857](http://svn.php.net/viewvc?view=revision&revision=332857) ## Changelog - 2014-01-01 Revised unneeded php.ini removal process. - 2013-12-17 Added use case and related issues. - 2013-10-31 Added objectives. - 2013-10-29 Update target PHP version to 5.6.0. - 2013-06-29 Add PoC patch and update RFC, since PHP 5.5 has been released. - 2012-08-31 Initial version. (yohgaki)