PHP 8.2 security support ends December 31, 2026

Upgrade your CodeIgniter 3 app to PHP 8.4 without rewriting it

CodeIgniter 3 still runs plenty of booking systems, customer portals and internal tools. On PHP 8.2 and newer, it fills your logs with warnings, and those warnings can break logins and whole admin areas. I upgrade CI3 apps to PHP 8.4 for a fixed price, keep them on CodeIgniter 3, and prove the upgrade works by clicking through your real app before and after.

Book a $300 Upgrade Check-up See a CI3 case study

Fixed prices. Work happens on a copy of your system, never on your live site.

Where CodeIgniter 3 stands

The official CodeIgniter site calls version 3 the legacy version of the framework, "in maintenance, receiving mostly just security updates." It lists 3.1.13 as the current CI3 release and says CI3 is intended for PHP 5.6 and newer.

Fixes for PHP 8.2's new rules have been proposed for CodeIgniter 3, but they sit on its development branch and have not shipped in an official release. Community forks carry them instead. So if your app stays on CodeIgniter 3, the PHP 8 fixes have to be made in your own copy of the framework. That's the work I do.

Sources: codeigniter.com download page and the bcit-ci/CodeIgniter repository on GitHub, checked October 31, 2026.

What breaks when a CodeIgniter 3 app moves to PHP 8

These are the problems I look for in every CI3 upgrade. Most of them showed up in my own practice upgrade of a CI3 booking app, described below.

What you see	Why it happens	From PHP
"Creation of dynamic property … is deprecated", from `CI_Controller`, `CI_Loader`, `CI_URI`, `CI_Router`, models and the database driver	CodeIgniter 3 attaches libraries and settings to objects on the fly, which PHP 8.2 deprecates. Even 3.1.13 does this.	8.2
Logins stop sticking, the admin area won't load, "headers already sent"	When warnings are displayed (often on staging, and on some hosts), they are printed before the session cookie is sent, so the session is lost. One warning causes a chain of failures.	8.1 / 8.2
"Passing null to parameter … is deprecated", including inside the framework	PHP 8.1 deprecates passing `null` to built-in string functions. On PHP 8.1, CI 3.1.13's `URI.php` triggers this with `ltrim()`.	8.1
Fatal errors in bundled libraries, such as old PHPMailer	PHPMailer 5's `__autoload()` and string offsets written as `$str{0}` were removed in PHP 8.0 and stop the whole request.	8.0
A feature crashes with a TypeError, such as a CAPTCHA image or an API search	Built-in functions now throw a TypeError on the wrong argument type, like `count(null)` or `stripos()` given an array. Scanners usually miss these because they depend on the data.	8.0
Database or encryption fails outright on older apps	A `database.php` still set to the `mysql` driver needs the `mysql_*` functions, removed in PHP 7.0. The old Encrypt library needs mcrypt, removed in PHP 7.2.	7.0 / 7.2
New deprecation warnings on PHP 8.4	PHP 8.4 deprecates implicitly nullable parameter types and moves a few extensions, such as IMAP, out of core. The Check-up looks for both.	8.4

Scanners are noisy on CI3, and they still miss things

Run PHPCompatibility on a CodeIgniter 3 app and the framework folder alone can report hundreds of errors. In my practice run it reported 257, mostly from database drivers and libraries the app never loads (old MySQL, MSSQL, Interbase, mcrypt). Meanwhile the failures that actually took pages down, the session chain, the CAPTCHA crash and the API search error, only appeared when the app was running. That's why every upgrade ends with a click-through test, not a scan.

How I upgrade a CodeIgniter 3 app

Check the bundled framework first. Many CI3 apps ship a system/ folder frozen at whatever version was current when the app was built. I compare it with the official release of the same version. If nobody edited it, I replace it with 3.1.13 as a whole instead of patching files one by one. If someone did, I carry their changes over.
Patch the framework for PHP 8.2+, as a documented patch set. The core classes that need it get #[\AllowDynamicProperties]. Your own classes get declared properties instead. You get the list of patched files so they can be re-applied later.
Upgrade bundled libraries before fixing them. Mailers, CAPTCHA and calendar libraries usually have newer versions that already fix the PHP 8 problems. Upgrading is cheaper and safer than patching old code.
Fix your own code. Automated rewrites (Rector) where they are safe, hand-written fixes where tools fail on older code.
Run the app and click through it. With error reporting at maximum, I walk through your key flows, record every error, and fix them until the tested flows show zero PHP errors.
Keep your tests working. If the app has a test suite, I move it to PHPUnit 9 and add a regression test for each runtime bug I fix where practical.

Stay on CI3, switch to a fork, or move to CodeIgniter 4?

Stay on CodeIgniter 3.1.13

My default. The official last release plus a small, documented patch set. The smallest change to your app, and the easiest to review.

A community fork

Forks maintained for newer PHP versions exist. They are built from CI3's unreleased development branch, which differs from 3.1.13, so switching is a decision we make together after the Check-up, not a default.

CodeIgniter 4

CodeIgniter 4 is not backward compatible with version 3, so moving to it means rewriting large parts of the app. It is not part of the fixed upgrade price. If you want it, it's quoted as its own project.

Case study: a CodeIgniter 3 booking system

A practice upgrade I did on public open-source code to test my process. It is not a client project, and the original author was not involved. This run targeted PHP 8.3; new projects default to PHP 8.4.

Online booking system

Easy!Appointments 1.3.2, a 2018 release · CodeIgniter 3.1.6 bundled · about 20,000 lines of app code, plus the framework and libraries · GPL-3.0

Before289 distinct PHP errors in one click-through on PHP 8.3. Sessions broke, the admin area wouldn't load, the CAPTCHA image and API search failed, and three files wouldn't even compile.

After0 PHP errors in development and production mode on PHP 8.3.6. Booking, confirmation email with calendar invite, admin and the full REST API all pass.

Fix: replaced the bundled framework with CodeIgniter 3.1.13, upgraded PHPMailer (5.2 to 6), the CAPTCHA library and the calendar export library, patched framework classes for PHP 8.2's dynamic property rules, fixed two runtime bugs by hand, and moved the test suite from PHPUnit 5 to 9.

Flagged separately: the bundled Google Calendar client is old and was only patched, not tested with real credentials. Replacing it is quoted as its own job.

287 / 289

errors cleared by the framework upgrade, library upgrades and the dynamic property patch. The other 2 needed real debugging.

PHP errors after the upgrade, in development and production mode, on every tested flow.

unit tests passing on PHPUnit 9, including a new regression test for the API search crash.

What was tested, and what wasn't

Tested: installer, booking page, available times, submitting a booking, the confirmation email with a valid calendar attachment, five admin pages and their background requests, every REST API v1 resource, and logout.

Not tested: Google Calendar sync with real credentials, rarely used language packs, and notification channels other than email. Code paths outside the tested flows can still hold PHP 8 problems, which is why every report lists both.

At about 20,000 lines, an app like this is above the Framework app tier's 15,000-line limit, so it would get a fixed quote after the Check-up.

Pricing for CodeIgniter 3 apps

Upgrade Check-up

$300

One-time · 5-day delivery

Static scan, including the bundled framework and libraries
Comparison of your system/ folder with the official release
Dynamic property check (PHP 8.2+)
One runtime smoke test of your key flows on PHP 8.4
Written issue list and fixed-price upgrade quote
Full $300 credited if you order the upgrade within 30 days

Requires a working copy you provide. No working copy? Add environment setup for $150 (adds 3 days).

Book the Check-up

Framework app

$3,500

Fixed price · 21-day delivery

A CodeIgniter 3 app up to about 15,000 lines
Bundled framework and up to 3 bundled libraries upgraded first
Upgrade to PHP 8.4, existing test suite moved to PHPUnit 9 if there is one
Before-and-after smoke test report
Deployment and rollback plan
14 days of free fixes on tested flows

Larger apps, or apps with more libraries, get a fixed quote after the Check-up.

Start with a Check-up

Maintenance

$200

Per month · cancel any time

Monthly security update check for PHP and your dependencies
Smoke test re-run after your host changes PHP versions
Up to 2 hours of small fixes per month (unused hours don't roll over)

Ask about it

Quoted separately

These often come up during a CI3 upgrade but are separate jobs, so they never hide inside a fixed price:

Moving to CodeIgniter 4
Replacing abandoned third-party SDKs (for example an old Google API client)
Migrating data encrypted with the old mcrypt-based Encrypt library
Writing new automated tests
Hands-on deployment and go-live support

Delivery times count from the day I receive your working copy and answers to the intake questions. Full details on the main pricing page.

Want a first look yourself?

Refit is my free, open-source command-line scanner. It runs a compile check, PHPCompatibility and a dynamic property check on a PHP project and tells you, in plain language, what will fail on PHP 8.4. It doesn't send your code anywhere.

It is static analysis, so it can't see the runtime failures described above. If the report looks bigger than you want to handle, the Check-up takes it from there.

Install it into your project with Composer. Refit itself needs PHP 8.1 or newer to run, even when the code it checks is older. PHPCompatibility 10 is still tagged alpha, so it has to be named once in the command:

composer require --dev qiyuanlabs/refit "phpcompatibility/php-compatibility:^10.0@alpha"
vendor/bin/refit scan --php=8.4

Get Refit on GitHub

Questions

Do I have to move to CodeIgniter 4?

No. The fixed-price upgrade keeps your app on CodeIgniter 3 and gets it running cleanly on PHP 8.4. Moving to CodeIgniter 4 is a rewrite, and it's quoted separately if you want it.

Which PHP version will my app run on?

PHP 8.4 by default, which gets security fixes until December 31, 2028. My case study above targeted PHP 8.3. If your host already supports PHP 8.5, I can target it instead; the Check-up tells you whether that's realistic.

What do you need from me for the Check-up?

A working copy: a staging site, or your code plus a database export that runs. It helps to tell me your current PHP version, your CodeIgniter version (the CI_VERSION line in system/core/CodeIgniter.php), and the flows your business depends on, such as logging in, booking, checkout or reports.

Someone edited our CodeIgniter system folder years ago. Is that a problem?

No, but it changes the approach. The Check-up compares your system/ folder with the official release, so we know exactly what was changed, and those changes are carried over to 3.1.13.

Do you need access to my live site?

No. All work happens on a copy, and by default I don't deploy, so I never need production access. You get the upgraded code and a step-by-step deployment and rollback plan.

My database has customer data. How do you handle it?

Where possible, send a copy with personal data removed or replaced. Any copy I receive stays private and is deleted when the project ends. If your system holds health or payment card data, tell me before sending anything so we can agree on a safe approach.

Will the upgrade catch every bug?

No one can promise that. The smoke test covers the flows we agree on in the Check-up. I list what was tested and what wasn't, so you know exactly where the coverage stops.

Who are you?

I'm Bo Zeng, a PHP developer with 18 years of experience. I run QiYuan Labs LLC, a US company registered in Wyoming, and work remotely. Email hello@qiyuanlabs.ai with any question before you book.

Find out what your CI3 app needs before your host decides for you

The Check-up costs $300 and tells you exactly what an upgrade involves and what it will cost.

Book a $300 Upgrade Check-up