My temporary PHP fix from 2014 has nearly 20M installs. Today I'm deprecating it. — Jake A. Smith Jake A. Smith Home Blog ← All posts My temporary PHP fix from 2014 has nearly 20M installs. Today I'm deprecating it. September 15, 2026 Twelve years ago, I wrote 174 lines of PHP as a stopgap for AOL’s content management system. I put it on Packagist in case anyone else needed the same patch, and somehow it’s been installed nearly 20 million times since. Today I marked it deprecated.
A temporary shim
In 2014, we were in the middle of upgrading AOL’s CMS from PHP 5.2 to 5.3. Part of that upgrade was dropping version 1 of the pecl_http extension, which gave us a function called http_build_url(). A CMS deals with a lot of URLs, and ours called that function in dozens of places. I wasn’t touching those. The function seemed straightforward enough to reproduce, so I wrote my own http_build_url(), defined only if the real one didn’t already exist. The old code never knew anything had changed.
Composer was just taking off at the time, which made sharing it easy. I figured it would earn its keep for a year or two, until the PHP community moved on to something better.
That’s a lot of installs
Well, it wasn’t temporary. It’s been installed from Packagist nearly 20 million times, and it still picks up over 400,000 installs a month.

And it turns out Composer is only part of the picture. WPML, the market-leading multilingual plugin for WordPress, bundles the polyfill directly in its codebase, and WPML says it’s installed on over 1.5 million sites. The domain-name library idna-convert depends on it too, which is how it ships inside the source of SPIP, a French content management system, and how it ended up packaged in Debian and Ubuntu. Between all of them, there’s a pretty good chance you’ve visited a website that is still running my code.
I never imagined it would go this far.
Coming back to it
I didn’t grasp how far it had spread until a few months ago, when I looked at the package for the first time in years. I knew it had users. By 2021 I’d been out of PHP for a while, and the downloads were surprising enough that I asked for a new maintainer. Three people offered. Shortly after I asked, we lost a family member unexpectedly, and it turned our world upside down for a while. I never followed up, and that’s on me. By the time things settled, other goals had taken over, and I forgot about the package for years.
Along with the numbers, there were a handful of GitHub issues, including one where joining a path onto a URL with a trailing slash strips every letter “a” out of the path. So much for straightforward. Under a comment that reads // Workaround for trailing slashes, my code tacks an “a” onto the path so there’s always a last segment to cut off, then cuts it off with a find-and-replace. When the path ends in a slash, that last segment is just the “a”, and the find-and-replace takes every other “a” in the path with it. I can’t believe the bug went unnoticed for as long as it did.
So I had a decision to make. I could dive back into PHP after almost a decade away, hand the package to one of the people who’d offered, or let it keep sitting there.
None of the above
It was always meant to be temporary, so I’m retiring it. The PHP League’s URI library has been the community’s answer for years, and PHP 8.5 now ships a standards-compliant URI API in the language itself (thanks to jawira for pointing me at it). Both are better than a 174-line shim from 2014. Maintaining the package would only delay the move everyone should be making, and handing it over would add a risk on top of that. I don’t doubt anyone who offered, and ozh has kept a fork going for YOURLS. But a widely installed package with a new maintainer nobody downstream has vetted is exactly what attackers look for. Veritasium’s video on the xz Utils backdoor is the best telling I’ve seen of how that plays out.
The package will keep installing, but it won’t get new fixes, including for the missing-”a” bug. After this long without a change, even a one-line fix could have unintended consequences for someone, with no one around to support it. The README shows how to switch.
I wrote this code to ease a painful migration, for myself and anyone else going through the same one. Thank you to everyone who sent a pull request or offered to take it over, and to the people who kept filing issues long after I’d stopped reading them. It was a good run for a temporary fix.
P.S. We never migrated AOL’s CMS off the “temporary” polyfill. It ran there until the whole platform was shut down around 2020. Keep in touch © 2026 Jake A. Smith

A developer is deprecating a temporary PHP fix created in 2014, which has amassed nearly twenty million installations since its creation. This code was initially written as a stopgap measure during an upgrade of AOL’s Content Management System from PHP 5.2 to 5.3 to handle the loss of the http_build_url() function, which was necessitated by dropping the pecl_http extension. The original intent was for this fix to be temporary, relying on the expectation that the PHP community would transition to superior solutions.

The package has achieved significant widespread adoption far beyond its initial context. It is installed through Packagist nearly twenty million times and continues to receive over four hundred thousand monthly installations. This proliferation stems from its indirect dependency within larger systems; for instance, the multilingual plugin WPML bundles the polyfill directly into its codebase, which has been installed on over one and a half million sites. Furthermore, it is relied upon by libraries such as domain-name library idna-convert, which is utilized within the source code of SPIP, a French content management system, and consequently within Debian and Ubuntu distributions. This demonstrates that the code has permeated various software ecosystems indirectly.

The author later became aware of the package's extensive reach, noting several related issues on GitHub, including bugs concerning path manipulation and trailing slashes. One specific bug involved how the code handled URL paths ending with a slash, where a modification to the path could inadvertently affect the structure of the URL. Despite these issues, the author faced a decision regarding the code's future, weighing the option of returning to PHP development against retiring the package.

The author concluded that the code should be deprecated because superior alternatives now exist. The PHP League’s URI library and the inclusion of a standards-compliant URI API within PHP 8.5 fulfill the necessary functionality, rendering the original shim obsolete. Maintaining the existing package would delay the community’s necessary migration, and handing the package to a new maintainer introduced a significant risk, particularly given its wide installation base, which could expose potential security vulnerabilities, referencing concerns raised by incidents such as the xz Utils backdoor. Therefore, the decision was made to retire the package, acknowledging the contributions of the community who offered to take over maintenance, and ensuring that future development focuses on modern, vetted standards rather than legacy code.