Modernizing PHP with Rust β a memory-safe PHP interpreter and toolchain written in Rust. Performance is a goal; rigorous, published comparisons against PHP are not claimed here yet.
PHP powers much of the web; many production runtimes are implemented in C and C++. phprs is an experiment in implementing PHP semantics in Rust so we can lean on the borrow checker and modern tooling. It aims to be:
- Safer by construction (Rust): Memory errors that plague C/C++ code are largely ruled out in safe Rust; the interpreter still has correctness and parity work ahead.
- A performance-minded design: Opcode dispatch, JIT hooks, and LLVM for the host binary β without promising a given speedup over Zend until we publish reproducible benchmarks.
- Concurrency-friendly host code: Rustβs type system helps avoid data races in the engine itself; PHPβs shared mutable runtime model is still evolving in phprs.
- Test-backed: 346+ workspace tests (library + CLI + integration), plus end-to-end example runs in CI.
phprs brings PHP into the future by:
Traditional PHP (C-based) Problems:
- β Memory leaks from manual allocation/deallocation
- β Buffer overflows leading to security exploits
- β Use-after-free vulnerabilities
- β Dangling pointers causing crashes
- β Segmentation faults in production
What Rust gives the codebase:
- Strong memory safety guarantees for safe code (no dangling pointers from the borrow checkerβs rules).
- Bounds-checked access patterns by default, reducing classic buffer overruns.
OptionandResultinstead of nullable pointers everywhere.unsafeis explicit and should stay rare and reviewed.
This does not automatically make every PHP script βmore secureβ end-to-end β it raises the bar for the interpreter implementation itself. Application security still depends on how you deploy and what you run.
Rust is a good host language for a VM: LLVM, predictable allocation patterns, and room to optimize hot paths. phprs includes pieces like direct opcode dispatch and JIT-oriented hooks, but we do not publish head-to-head PHP 8.x numbers here β workloads and completeness differ too much for a fair slogan.
If you want the engineering direction (dispatch, JIT ideas, etc.), see PERFORMANCE.md. Treat it as design notes, not a audited benchmark report, until we link reproducible methodology and results.
Traditional PHP Limitations:
- β No true multi-threading support
- β Process-based concurrency (high memory overhead)
- β Race conditions in extensions
- β Global state issues
Rust (host code):
- The borrow checker and
Send/Syncrules catch many concurrency mistakes at compile time in the Rust parts of the project. - Primitives like
Arc, mutexes, andOnceLockare the usual tools for shared engine state.
PHP scripts under phprs still run through a single runtime model; donβt assume βmulti-threaded PHPβ parity with extensions or Zend here.
Progressive compatibility with popular PHP frameworks and CMSs (stubs and demos ship in examples/):
- WordPress β
- Hooks, wpdb, plugin/theme loading (see
examples/wordpress/) - CodeIgniter 4 β
- Minimal bootstrap + routed controller demo (
examples/codeigniter/, covered bytests/examples_runtime.rs) - Drupal β
- Minimal kernel/bootstrap stub (
examples/drupal/, covered bytests/examples_runtime.rs) - Laravel π - Routing, Eloquent, Blade (planned)
- Symfony π - HTTP kernel, DI (planned)
Leveraging crates.io:
- HTTP:
reqwestfor HTTP/HTTPS from the host - Regex: the
regexcrate (different tradeoffs vs PCRE β not a drop-in performance claim) - Crypto / hashing: common Rust crates for checksums and tooling
- PDO / sessions / JSON: implemented or stubbed to varying degrees β see source and tests for whatβs real today
- Package manager: Composer-oriented workflows with
semverfor version parsing - Dev server:
phprs servefor local tries
There is a huge ecosystem of maintained Rust libraries; phprs only uses a small slice.
Deployment:
- Single binary (typical Rust workflow): fewer moving parts than a full PHP build with many extensions.
- Image size and static linking depend on how you package the CLI β compare measurements for your own Dockerfile, donβt trust a slogan.
- Cross-compilation is possible in principle; CI mainly exercises tier-1 targets you care about.
- Library crate: embed from Rust; FFI to other languages is possible but not the focus of this README.
- WASM / every platform: aspirational until documented.
Rust helps with predictable builds; it doesnβt magically shrink every deployment.
# Clone the repository
git clone https://github.com/yingkitw/phprs.git
cd phprs
# Build library + CLI (workspace)
cargo build --release
# CLI binary: target/release/phprs (from `phprs-cli` workspace member)Run any PHP file - Zero configuration needed:
# Run a PHP script
phprs run script.php
# Or use cargo during development
cargo run -p phprs-cli -- run script.phpStart development server:
# Built-in web server on port 3080
phprs serve
# Custom port
phprs serve --port 8080Package management:
# Initialize composer.json
phprs pkg init
# Install dependencies
phprs pkg install
# Add a package
phprs pkg require vendor/packagephprs targets PHP language compatibility, but many extensions, ini settings, and edge cases differ from Zend PHP. Try your script and fix gaps β we donβt promise bit-for-bit behavior yet.
<?php
// Example that may run once the engine supports the features you use
class User {
public function __construct(
private string $name,
private string $email
) {}
public function greet(): string {
return "Hello, {$this->name}!";
}
}
$user = new User('John', 'john@example.com');
echo $user->greet();cargo run -p phprs-cli -- run your-app.phpWordPress / Laravel / Symfony: not production migration targets today β use the examples/ trees and TODO.md to see what is implemented. Large apps should expect porting work.
<?php
// examples/01_hello_world.php
echo "Hello from phprs!\n";
// Many PHP 8 features work; unsupported ones fail at compile or runtime
$numbers = [1, 2, 3, 4, 5];
$squared = array_map(fn($n) => $n ** 2, $numbers);
print_r($squared);<?php
// Email validation with PCRE
$email = "user@example.com";
if (preg_match('/^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$/', $email)) {
echo "Valid email!\n";
}
// Pattern replacement
$text = "Hello World";
$result = preg_replace('/World/', 'phprs', $text);
echo $result; // "Hello phprs"<?php
// Fetch data from APIs
$json = file_get_contents('https://api.example.com/data');
$data = json_decode($json, true);
// Works with any HTTP/HTTPS URL
$html = file_get_contents('https://example.com');<?php
// Connect to database
$pdo = new PDO('mysql:host=localhost;dbname=myapp', 'user', 'pass');
// Prepared statements (SQL injection safe)
$stmt = $pdo->prepare('SELECT * FROM users WHERE email = :email');
$stmt->bindParam(':email', $email);
$stmt->execute();
$user = $stmt->fetch();<?php
// Secure session handling
session_start();
// Store user data
$_SESSION['user_id'] = 123;
$_SESSION['username'] = 'john_doe';
// Access anywhere in your app
if (isset($_SESSION['user_id'])) {
echo "Welcome back, " . $_SESSION['username'];
}<?php
/**
* Plugin Name: My Plugin
* Description: Runs on phprs
*/
// WordPress hooks work perfectly
add_action('init', function() {
register_post_type('custom_type', [
'public' => true,
'label' => 'Custom Type'
]);
});
add_filter('the_content', function($content) {
return $content . "\n<!-- Powered by phprs -->";
});<?php
// Modern PHP web app with all features
session_start();
// Database connection
$pdo = new PDO('mysql:host=localhost;dbname=webapp', 'root', '');
// Handle form submission
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
$email = $_POST['email'];
// Validate with regex
if (preg_match('/^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$/', $email)) {
// Store in database
$stmt = $pdo->prepare('INSERT INTO users (email) VALUES (:email)');
$stmt->bindParam(':email', $email);
$stmt->execute();
// Set session
$_SESSION['user_email'] = $email;
echo "Registration successful!";
}
}More Examples:
examples/control_flow.php- if/switch, for, while, foreach (seetests/examples_runtime.rs)examples/mbstring.php- Multibyte string helpers (mb_*subset)examples/match_expression.php-matchexpressionsexamples/regex-examples.php- Regex patternsexamples/http-stream-examples.php- HTTP streamsexamples/session-examples.php- Sessionsexamples/pdo-examples.php- PDO usageexamples/integration-test.php- Combined feature scriptexamples/wordpress/- WordPress integrationexamples/codeigniter/public/index.php- CodeIgniter-style bootstrap demoexamples/drupal/index.php- Drupal-style kernel stub
phprs/
βββ src/
β βββ engine/ # Core PHP engine
β β βββ types.rs # Type system (PhpValue, PhpType, Val)
β β βββ compile/ # Lexer, parser, AST compilation
β β βββ vm/ # Virtual machine, opcodes, execution
β β βββ jit.rs # JIT compiler
β β βββ operators.rs # PHP operators implementation
β βββ php/ # PHP runtime & standard library
β βββ regex.rs # PCRE-compatible regex
β βββ http_stream.rs # HTTP/HTTPS streams
β βββ pdo.rs # Database abstraction
β βββ streams.rs # Stream wrappers
β βββ filesystem.rs # File operations
βββ bin/phprs/ # CLI application
βββ examples/ # Curated demos (WordPress, CI, Drupal, language features)
β βββ wordpress/ # WordPress integration
β βββ regex-examples.php
β βββ pdo-examples.php
β βββ integration-test.php
βββ tests/ # Comprehensive test suite
use phprs::engine::compile::{compile_string, compile_string_with_functions};
use phprs::engine::vm::{execute_ex, ExecuteData};
use std::sync::Arc;
// Compile a snippet (no user functions)
let op_array = compile_string("<?php echo 'Hello'; ?>", "inline.php")?;
// Scripts with `function` definitions need the function table:
let (op_array, fn_table) =
compile_string_with_functions("<?php function f() { return 1; } echo f(); ?>", "t.php")?;
let mut exec_data = ExecuteData::new();
exec_data.function_table = Some(Arc::new(fn_table));
let _ = execute_ex(&mut exec_data, &op_array);There is a WordPress-shaped demo under examples/wordpress/ (stubs, hooks, wpdb-ish pieces, sample plugin/theme). It is useful for development and tests, not a claim that arbitrary WordPress sites run unchanged in production on phprs.
- Hooks, plugin/theme loading, and wpdb-related code paths are incomplete compared to PHP + Zend + extensions.
- Treat real deployments as unsupported until you validate your stack yourself.
# Demo tree only β not a full WP core checkout
cargo run -p phprs-cli -- run examples/wordpress/index.php- Routing and middleware
- Eloquent ORM
- Blade templating
- Artisan CLI
- Service container
- HTTP kernel
- Dependency injection
- Twig templating
- Console component
- Minimal app layout, autoload stubs, router, and sample controller under
examples/codeigniter/ - Full framework parity is not a goal of the demo; it exercises includes and routing-style code paths
- Types: PHP type system (int, float, string, array, object, null, bool) β growing toward full parity
- Operators: Core arithmetic, logical, comparison, and string operators (see
examples/operators.php) - Control Flow: if/else, switch,
match, for (init/cond/inc), foreach (value-only), while; post-increment/decrement on simple variables ($i++) - Functions: User-defined functions, closures, arrow functions
- Classes: OOP with inheritance, traits, interfaces, namespaces
- Error Handling: try/catch/finally, exceptions
String Functions: strlen, substr, str_replace, trim, strtolower, strtoupper, ucfirst, and a growing mbstring subset (mb_strlen, mb_substr, β¦ β see src/php/mbstring.rs, examples/mbstring.php)
URL / query: parse_url, http_build_query, and related helpers (src/php/url.rs)
Array Functions: array_map, array_filter, array_merge, count, in_array, array_key_exists
Regular Expressions: preg_match, preg_match_all, preg_replace, preg_split
File System: file_get_contents, file_put_contents, file_exists, dirname, basename
HTTP Streams: file_get_contents('http://...') - Full HTTP/HTTPS support
Database (PDO): new PDO(), query(), prepare(), execute(), fetch(), fetchAll()
Sessions: session_start(), session_destroy(), $_SESSION, session_id(), session_regenerate_id()
JSON: json_encode, json_decode
Type Checking: isset, empty, is_array, is_string, is_int, is_null
Output: echo, print, var_dump, print_r
- JIT / optimizer hooks: present to varying degrees; see code and tests for whatβs wired today
- Bytecode / op arrays: compiled once per script in the current model
- Memory: Rust ownership for engine structures; PHP values still use runtime-managed lifecycles
- Async I/O: Tokio in the host for HTTP client / server paths where used
- Built-in Web Server:
phprs serve - Package Manager: Composer-compatible
- REPL: Interactive PHP shell (planned)
- Debugger: Step-through debugging (planned)
- Profiler: Performance analysis (planned)
phprs is not marketed with a βNx faster than PHPβ number. A fair comparison needs the same features enabled, representative workloads, and pinned versions. Weβd rather under-promise and add measured results later than publish invented comparison tables.
Why Rust is still a sensible implementation language:
- Mature LLVM backend for the host binary.
- Control over allocation and hot paths in the VM without a GC for the Rust parts.
- Room to grow JIT and other optimizations incrementally.
Inside the project today (high level):
- Opcode execution via a direct dispatch table (see VM sources).
- JIT-related code paths and optimizer scaffolding β completeness varies; read
src/engine/jit.rsand tests. - PERFORMANCE.md discusses intent and architecture; when we have reproducible benchmarks, they should live next to methodology (machine, OS, PHP build flags, phprs commit).
If you need predictable numbers for a decision, measure your own scripts on both runtimes or open an issue asking for a benchmark harness β we welcome contributions there.
- Rust 1.75+ (2024 edition)
- Cargo (comes with Rust)
# Install Rust (if not already installed)
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
# Clone and build
git clone https://github.com/yingkitw/phprs.git
cd phprs
cargo build --release
# Install globally (optional)
cargo install --path bin/phprs# Create a PHP file
echo '<?php echo "Hello from phprs!\n";' > hello.php
# Run it
phprs run hello.php# Run example scripts
phprs run examples/01_hello_world.php
phprs run examples/regex-examples.php
phprs run examples/pdo-examples.php
# WordPress example
phprs run examples/wordpress/index.php
# Integration test (all features)
phprs run examples/integration-test.php
# Run all tests
cd examples
chmod +x run-all-tests.sh
./run-all-tests.sh# Library + CLI + integration tests (recommended)
cargo test --workspace
# Library only
cargo test --lib
# PHP example compile checks
cargo test --test php_examples
# End-to-end: compile + VM + output for curated `examples/*.php`
cargo test --test examples_runtime
# Smoke a script manually
cargo run -p phprs-cli -- run examples/control_flow.php
cargo run -p phprs-cli -- run examples/test-streams-regex-pdo.php
cargo run -p phprs-cli -- run examples/wordpress/test-theme-plugin.phpThe workspace runs clean (no warnings) on cargo test --workspace and cargo build --workspace.
- SPEC.md - Project specification and scope
- ARCHITECTURE.md - Module structure and execution flow
- TODO.md - Migration roadmap and statistics (70+ built-in functions, 15 PHP runtime modules)
- PERFORMANCE.md - Optimization ideas and VM notes (not a benchmark certificate)
- examples/STREAMS-REGEX-PDO-README.md - Stream wrappers, regex, sessions, PDO
- examples/wordpress/THEME-PLUGIN-README.md - WordPress integration guide
- examples/TEST-GUIDE.md - Comprehensive testing guide
- examples/TESTING-SUMMARY.md - Example and test coverage notes
- examples/ - Curated PHP demos (language features, WordPress, CodeIgniter, Drupal stubs)
- AGENTS.md - Development guidelines
- Cargo.toml - Dependencies and build configuration
- Core PHP engine with 63 opcodes
- 70+ built-in functions
- Regular expressions (PCRE-compatible)
- HTTP/HTTPS stream wrappers
- PDO database abstraction
- Session handling
- WordPress support (hooks, plugins, themes)
- Package manager (Composer-compatible)
- JIT / optimizer scaffolding (see sources; not a complete production JIT story)
- Compiled op arrays (per-run bytecode; caching story is incremental)
- Laravel framework support
- Symfony framework support
- Advanced JIT optimizations
- Debugger and profiler
- REPL (interactive shell)
- Deeper CodeIgniter / Drupal parity (beyond
examples/demos) - Native extensions API
- WebAssembly compilation
- Distributed caching (Redis, Memcached)
- Real database drivers (MySQL, PostgreSQL)
- HTTP/2 and HTTP/3 support
See TODO.md for detailed roadmap.
We welcome contributions! Here's how to get started:
# Fork and clone
git clone https://github.com/YOUR_USERNAME/phprs.git
cd phprs
# Create a branch
git checkout -b feature/my-feature
# Make changes and test
cargo test
cargo run -p phprs-cli -- run examples/test-streams-regex-pdo.php
# Submit PR
git push origin feature/my-feature- π Bug Fixes: Report or fix issues
- β¨ Features: Implement new PHP functions or features
- π Documentation: Improve docs and examples
- π§ͺ Testing: Add test cases
- π¨ Framework Support: Add support for more frameworks
- β‘ Performance: Optimize hot paths
- Follow Rust 2024 edition best practices
- Add tests for new features
- Update documentation
- Keep code DRY and maintainable
- See AGENTS.md for detailed guidelines
- Issues: GitHub Issues
- Discussions: GitHub Discussions
- Documentation: docs/
Apache License 2.0 - See LICENSE for details.
- PHP Team - For the original PHP implementation
- Rust Community - For the amazing language and ecosystem
- Contributors - Everyone who has contributed to phprs
Built with β€οΈ using Rust | Modernizing PHP for the future