## Changed functions

### PHP Core

- crypt() will now raise an `E_NOTICE` error if the `salt` parameter is omitted.
- substr_compare() will now accept `0` for its `length` parameter.
- unserialize() will now fail if passed serialised data that has been manipulated to attempt to instantiate an object without calling its constructor.

### cURL

- Uploads using the `@file` syntax are now only supported if the `CURLOPT_SAFE_UPLOAD` option is set to `false`. CURLFile should be used instead.

### Mcrypt

- The `source` parameter of mcrypt_create_iv() now defaults to `MCRYPT_DEV_URANDOM` instead of `MCRYPT_DEV_RANDOM`.

### OpenSSL

- stream_socket_enable_crypto() now allows the `crypto_type` parameter to be optional if the stream's SSL context includes the new `crypto_type` option.

### PostgreSQL

- pg_insert(), pg_select(), pg_update() and pg_delete() are no longer experimental.
- pg_send_execute(), pg_send_prepare(), pg_send_query() and pg_send_query_params() will no longer block until query write completion if the underlying socket stream for the database connection is set to non-blocking mode.

### Reflection

- ReflectionClass::newInstanceWithoutConstructor() now allows non-final internal classes to be instantiated.

### XMLReader

- XMLReader::getAttributeNs() and XMLReader::getAttributeNo() now return `null` if the attribute could not be found, like XMLReader::getAttribute().