Skip to content
Find out why your PHP app is slow before it costs you. Try Tideways free for 14 days.
PHP News
Search
Accepted PHP 8.7

hexdec() and bindec(): Throw on Invalid Characters

On the PHP wiki as Throw exception for invalid characters in number base functions

Makes bindec(), octdec(), hexdec() and base_convert() throw an Exception on invalid characters instead of ignoring them.

Throw a Exception for invalid characters in number base conversion functions?

Primary vote · 2/3 majority

27 Yes 1 No 96% approval

This poll has closed.

Sjoerd Langkemper opened the vote on October 16, 2026, after the internals discussion. Voters answer one question: throw an Exception for invalid characters in these four functions in PHP 8.7? Voting closed on November 1, 2026 at 15:30 UTC with 27 votes in favor and 1 against, well past the two-thirds majority it needed. The RFC is accepted for PHP 8.7 and is waiting to be merged.

Summary

PHP has four functions that convert a number string from one base to another: bindec(), octdec(), hexdec() and base_convert(). Today they silently skip any character that doesn't belong in that base. This RFC from Sjoerd Langkemper would make them throw an Exception instead, starting in PHP 8.7.

Why change it

Skipping bad characters hides mistakes. z isn't a hex digit, for example, so hexdec('z') ignores it and gives you 0.

PHP 7.4 started emitting a deprecation for this, as part of the Base Convert Improvements RFC. The plan back then was to throw an error in PHP 8. The deprecation shipped but the error never did, and this RFC finishes that job.

Show me

var_dump(hexdec('z'));

// PHP 7.4 - 8.6:
// Deprecated: Invalid characters passed for attempted conversion, these have been ignored in ...
// int(0)

// PHP 8.7 (proposed):
// Fatal error: Uncaught Exception: Invalid characters passed for attempted conversion in ...

With base_convert(), what counts as invalid depends on the base you pass in:

base_convert('f', 16, 10); // 'f' is fine in base 16
base_convert('f', 15, 10); // throws an Exception

Why Exception and not ValueError

The first version of the RFC used ValueError, and the author switched to Exception in version 0.3. A ValueError suggests a bug in your program, but bad input here isn't always a bug, since it can come straight from users. A plain Exception fits that case better.

What it means for existing code

Code that relies on invalid characters being skipped will now get an Exception. If your input comes from users, wrap these calls in try/catch.

The author expects the most common case to be separators, like hexdec('1234-5678'), which already triggers a deprecation today. You can strip the separators out first with ordinary string functions.

Related functions like base64_decode() and intval() aren't affected.