PHP compatibility of an old OpenCart: scan, then fix only what runs

Which old PHP constructs become fatal in which version, how to scan an OpenCart tree, and why most findings can be ignored.

OpenCart 2.3 officially supports PHP up to 7.0/7.1. The real ceiling is set by the code in the shop, not by the documentation. A scan tells you what is in the way.

Scan

W=/path/to/webroot
for p in "each(" "mcrypt_" "create_function(" "ereg(" "money_format(" "get_magic_quotes"; do
  echo "$p : $(grep -rlF "$p" $W --include='*.php' | wc -l)"
done
grep -rlE '\$[a-zA-Z_]+\{[0-9$]' $W --include='*.php' | wc -l   # curly-brace string offsets

What breaks and when

Construct	Deprecated	Fatal	Replace with
`mcrypt_*`	7.1	7.2 (removed)	`openssl_encrypt`
`each()`	7.2	8.0	`foreach` or `key()` + `current()`
`create_function()`	7.2	8.0	an anonymous function
`$str{0}`	7.4	8.0	`$str[0]`
`ereg()`	5.3	7.0	`preg_match`
`money_format()`	7.4	8.0	`NumberFormatter`
`get_magic_quotes_*`	7.4	8.0	remove the call

Do not fix every hit

Most findings are in places that never run:

vendored libraries (for example PHPExcel),
extensions that are installed but not enabled (for example OpenBay),
cached modifications in system/storage/modification, which are regenerated from their sources.

Fix what executes. Switch the PHP version on a copy of the shop and read the error log, not the grep output.

An example from a real 2.3 shop: 190 files contained each(), of which 49 were PHPExcel and 17 were cached modifications. Of 10 files with mcrypt_, 7 belonged to the unused OpenBay and two were real: the encryption library and the session library.

In our experience, 2.3 on PHP 7.4 is hours of work. 2.3 on PHP 8.x is days.

Encoded (ionCube) modules

A file encoded with ionCube runs only under the PHP branch it was encoded for. Check this before planning, by including the module file from the CLI of the target PHP:

/opt/alt/php81/usr/bin/php -d display_errors=1 -r 'class Controller{} class Model{} include "<file>"; echo "ok";'

"Encoded for PHP 5.6 and cannot run under PHP 7.1 or later" means you need a new version of the module from its author. The loader itself can be enabled on the server, the encoded code cannot be made to run on another branch.