The Legacy of a "Quick Fix": Retiring a PHP Polyfill with 20M Installs

Date: September 15, 2026
Author: Smith

Twelve years ago, I penned a mere 174 lines of PHP code. It was intended to be a permanent temporary stopgap for the content management system (CMS) at AOL. I uploaded it to Packagist just in case other developers were facing the same hurdle. To my absolute astonishment, that small patch has since been installed nearly 20 million times.

🛠️ The Origin: A Temporary Shim

Back in 2014, our team was navigating a migration of the AOL CMS, moving from PHP version $5.2 \to 5.3$. This transition required us to abandon the first version of the pecl_http extension, which unfortunately meant losing a specific, highly useful function: http_build_url().

Because our CMS relied heavily on URL manipulation, this function was scattered across dozens of files. Since the logic seemed simple enough to replicate, I created my own version of http_build_url(), ensuring it only defined itself if the native function was absent.

With Composer gaining momentum at the time, sharing the code was effortless. I assumed it would be useful for a year or two until the broader community developed a standardized replacement.

The Scale of Impact

The reach of this "temporary" fix far exceeded my wildest expectations:

The dependency chain grew in unexpected directions:

Given this trajectory, it is statistically probable that you have browsed a website powered by my 2014 code.

🔍 Rediscovering the Code

I didn't realize the magnitude of the package's footprint until a few months ago. By 2021, I had transitioned away from PHP development. Surprised by the download volume, I attempted to find a new maintainer. However, shortly after, a sudden family tragedy occurred, shifting my priorities and causing the project to slip my mind for several years.

Upon returning, I noticed several open GitHub issues. One, in particular, was baffling: joining a path to a URL with a trailing slash would somehow delete every letter "a" from the path.

The Bug Logic: To handle trailing slashes, I implemented a workaround where I appended the character "a" to the path to ensure there was always a final segment to trim, then used a find-and-replace to remove it.

If the path already ended in a slash, the "last segment" became just that added "a". Consequently, the find-and-replace operation would indiscriminately strip every other "a" present in the entire string.

// Conceptual representation of the bug
$path = $path . 'a'; 
// ... logic to trim ...
$path = str_replace('a', '', $path); // Oops: removes ALL 'a's

I am genuinely shocked this bug persisted unnoticed for so long.

🛑 The Decision: Why I'm Deprecating

Faced with the situation, I considered several paths:

• Dive back into PHP after a decade-long hiatus.
• Hand the keys to one of the volunteers who offered to maintain it.
• Leave it exactly as it is.
• Retire the package entirely.

I have chosen the latter. This code was always meant to be a bridge, not a destination. Modern alternatives are far superior:

1. The PHP League’s URI library has been the gold standard for years.
2. PHP 8.5 now includes a native, standards-compliant URI API (shoutout to jawira for the tip).

The Security Risk

While I trust the people who offered to take over, introducing a new, unvetted maintainer to a package with millions of downstream dependencies is a massive security liability.

As highlighted in the Veritasium video regarding the xz Utils backdoor, this is exactly the kind of vector attackers exploit. Furthermore, after years of stagnation, even a tiny one-line fix for the "missing-a" bug could trigger unpredictable regressions for users who have built dependencies around the bug itself.

Final Thoughts

The package will remain available for installation, but it is now officially deprecated. No further updates or bug fixes will be issued.

I wrote this code to solve a specific pain point during a difficult migration. It served its purpose at AOL until the platform was decommissioned around 2020, and it apparently served millions of others along the way.

To the contributors who sent pull requests, the users who filed issues long after I stopped checking them, and those who offered to help: Thank you.