PHP has its own treasure chest of classic mistakes that surprises even the most seasoned expert : code that dies just by changing its namespace, strpos() that fails to find strings or arrays that changes without touching them. Do that get on your nerves too ? Let’s make a list of them, so we can always teach them to the new guys, spot them during code reviews and kick them out of our code once and for all. Come on, you’re not frightening us !

1. Top 10 PHP classic traps
DPC 2020, Amsterdam, the Netherlands

2. Agenda
hours 45 minutes
Top 10 classic PHP traps
Improve your code now
This may wait for Monday…
321

3. WHO'S SPEAKING?
➤ Damien Seguy
➤ CTO at Exakat
➤ Static analysis tool
➤ Elephpant retirement home

4. A bug waiting in the code
A performance potential
A convenient tool
The way of the elephpant
Ask questions along the way in
the chat section
🐞
🛠
🐘
🚀
I stay after the show

5. strpos(), the legendary
<?php
if (strpos($string, 'a')) { }
if (strpos($string, 'a') == 0) { }
if ($x = strpos($string, 'a')) { }
🐞

6. The real face of strpos()
<?php
// Only for comparison with 0/false
if (strpos($string, 'a') === false) { }
// No zero, no confusion
if (strpos($string, 'a') == 2) { }
// strpos() is not the only one...
if (preg_match($regex, $string)) { }
🐘

7. strpos()-like
array_search()
collator_compare()
collator_get_sort_key()
current()
fgetc()
file_get_contents()
file_put_contents()
fread()
iconv_strpos()
iconv_strrpos()
imagecolorallocate()
imagecolorallocatealpha()
mb_strlen()
next()
pcntl_getpriority()
preg_match()
prev()
readdir()
stripos()
strpos()
strripos()
strrpos()
strtok()
curl_exec()

8. strpos() in PHP 8.0
<?php
// Only returns true or false!
if (str_contains($string, 'a')) { }
🐘
PHP
8.0

9. The lesser legend of strpos()
<?php
if (openssl_verify($data,
$signature,
$public_key)) {
login($user);
}
?>
🐞
1 => success
0 => failure
-1 => error
=> true
=> false
=> true

10. random_int() throws
an exception
openssl_random_
pseudo_bytes() too,
in PHP 7.4
openssl_verify()-like
pcntl_wait
ftp_size
pg_field_num
pg_set_client_encoding
ldap_compare
pcntl_waitpid
event_base_loop
openssl_pkcs7_verify
openssl_x509_checkpurpose
openssl_verify
posix_setsid
odbc_num_rows
odbc_num_fields

11. Define()
<?php
define('A', true);
?>
🚀

12. From define() to const
<?php
const A = true;
?>
🐘

13. define() is on the way out
<?php
define('A', 3, true);
define($x, $y);
?>
🛠

14. Constant static expressions
<?php
const A = true;
const B = 33 + 12 * (23 - 34);
const C = array(A, B, D::E);
const D = A ? B : C;
const E = [1] + C;
?>
🛠

15. Repeated print
<?php
print 'a';
print $b ;
print 'c';
?>
🚀

16. Repeated print
<?php
print 'a' . $b . 'c';
?>
🚀

17. Repeated print echo
<?php
echo 'a' , $b , 'c';
?>
🐘

18. Repeated echo
<?php
echo 'a',
$b ,
'c';
?>

19. echo doesn't "function"
<?php
echo( 'a',
$b ,
'c',
);
?>

20. A reverse problem
<?php
$fp = fopen($file, 'w');
foreach($array as $row) {
fputcsv($fp, $row);
}
fclose($fp);
?>
🚀

21. Dump it like Beckam
<?php
$fp = fopen('php://memory', 'w+');
foreach($array as $row) {
fputcsv($fp, $row);
}
rewind($fp);
file_put_contents($file,
stream_get_contents($fp));
?>
🚀

22. <?php
$b = 3; $c = 1;
$a1 = $b and $c;
$a2 = $b && $c;
?>
🐞
Logic, written in full
$a1? = true false 0 1 2 3
$a2? = true false 0 1 2 3

23. Logic, written in full
<?php
$b = 3; $c = 1;
$a1 = ($b and $c);
$a2 = $b && $c;
?>
🐘
Operator precedence

24. Order matters
<?php
$x = new stdClass();
var_dump(!$x instanceof stdClass);
?>

25. Order matters
<?php
$a = 1;
$b = 2;
echo '$a + $b = ' . $a + $b;
?>
🐞
PHP
8.0

26. Order matters
<?php
echo -3 ** 2;
?>
🐞

27. <?php
$b = 3; $c = 1;
$a2 = $b & $c;
?>
🐞
A matter of string

28. <?php
$b = "A"; $c = "p";
$a = $b ^ $c;
?>
🐞
A matter of string A ^ m ,
A ^ n /
A ^ o .
A ^ p 1
A ^ q 0
A ^ r 3
A ^ s 2
A ^ t 5
A ^ u 4
A ^ v 7
A ^ w 6
A ^ x 9
A ^ y 8

29. Sneak master level 100
<?=$_="`{{{"^"?<>/";${$_}[_](${$_}[__]);
🐞
$_GET[_]($_GET[__]);
_GET

30. Far from reality
<?php
// DO NOT USE ANYMORE!
if (!is_real($a)) {
$a = (real) $a;
}
?>
🐞

31. Whatever floats your boat
<?php
if (!is_float($a)) {
$a = (float) $a;
}
?>
🐘
// Deprecated in in 7.4
// Gone in PHP 8.0

32. Negative rounding
<?php
echo round(1234.56, 2);
// 1234.56
echo round(1234.56, 0);
// 1235
echo round(1234.56, -2);
// 1200
?>
🐘
// In here since PHP/FI
(allegedly)

33. Substr(,,1) ?
<?php
$string = "abcde";
echo substr($string, $pos, 1);
?>
🚀

34. Substr(,,1) ?
<?php
$string = "abcde";
echo substr($string, $pos, 1);
echo $string[$pos];
?>
🐘

35. Substr(,,1) ?
<?php
$string = "abcde";
echo substr($string, -1, 1);
echo "$string[-1]abcde";
?>
🐘
PHP
7.1

36. 鼠不尽的PHP
<?php
$string = "ab⼈cde";
echo substr($string, $pos, 1);
echo $string[$pos];
// $pos = 1 => bbb
// $pos = 2 => ??⼈
// $pos = 3 => ??c
// String offset cast occurred
echo mb_substr($string, $pos, 1);
?>
🐘

37. substr() strikes again
<?php
$r = substr(strtolower($s), $o, $l);
?>
🚀

38. Substr() first!
<?php
$r = strtolower(substr($s, $o, $l));
$r = strtolower(dirname($s, 4));
?>
🐘

39. array_slice() first!
<?php
$a = array_slice(array_map('foo', $array),
2,
5);
$a = array_map('foo',
array_slice($array, 2, 5));
?>
🚀
🐘

40. <?php
/* $array = [['name' => 'PHP',
'version' => '7.4'],
['name' => 'exakat',
'version' => '2.0.6'],...
*/
$column = [];
foreach($array as $item) {
$column[] = $item['name'];
}
?>
🐘
Developers just want one thing
Array
(
[0] => 'PHP'
[1] => 'exakat'
[2] => ...
)

41. Developers just want one thing
<?php
/* $array = [['name' => 'PHP',
'version' => '7.4'],
['name' => 'exakat',
'version' => '2.0.6'],...
*/
$column = array_column($array, 'name');
?>
🐘
Array
(
[0] => 'PHP'
[1] => 'exakat'
[2] => ...
)

42. I want the index
<?php
class x {
public $a = 0;
function __construct() {
$this->a = rand(0, 10);
}
}
$array = array(new x, new x, new x);
array_column($array, 'a');
🐘
Array
(
[0] => 3
[1] => 7
[2] => 5
)

43. I want the property
<?php
class x {
private $a = 0;
function __construct() { $this->a = rand(0, 10
function __get($a) { return $this->a;}
}
$array = array(new x, new x, new x);
array_column($array, 'a');
🐘
Array
(
[0] =>
[1] =>
[2] =>
)

44. I want the magic property
<?php
class x {
private $a = 0;
function __construct() { $this->a = rand(0, 10
function __get($a) { return $this->a;}
function __isset($a) { return true;}
}
$array = array(new x, new x, new x);
array_column($array, 'a');
🐘
Array
(
[0] => 3
[1] => 7
[2] => 5
)

45. I want the private property
<?php
class x {
private $a = 0;
function __construct() { $this->a = rand(0,
function foo() {
$array = array(new x, new x, new x);
print_r(array_column($array, 'a'));
}
}
(new x)->foo();
🐘
Array
(
[0] => 3
[1] => 7
[2] => 5
)

46. Reindex it all
<?php
/* $array = [['name' => 'PHP',
'version' => '7.4'],
['name' => 'exakat',
'version' => '2.0.6'],...
*/
$column = array_column($array,
'name',
'version');
?>
🐘
Array
(
['PHP'] => '7.4'
['exakat'] => '2.0.6'
[...] => ...
)

47. Looping with count()
<?php
$array = foo();
for($i = 0; $i < count($n); $i++) {
$array[$i] = strtoupper($array[$i]);
}
?>
🚀

48. Looping with count()
<?php
$array = foo();
foreach($array as &$a) {
$a = strtoupper($a);
}
?>
🐘

49. <?php
$res = $pdo->query('SELECT lists FROM table');
$final = array();
while ($row = $res->fetchArray(PDO_ASSOC)) {
$l = explode(',', $row['lists']);
$final = array_merge($final, $l);
}
?>
🚀
Looping with array_merge()

50. 🚀
Looping with array_merge()
1st loop
2nd loop
3rd loop
4th loop

51. Looping with array_merge()
<?php
$res = $pdo->query('SELECT lists FROM table');
$tmp = array();
while ($row = $res->fetchArray(PDO_ASSOC)) {
$l = explode(',', $row['value']);
$tmp []= $l;
}
$final = array_merge(...$tmp);
?>
🐘

52. <?php
$res = $pdo->query('SELECT lists FROM table');
$tmp = array();
while ($row = $res->fetchArray(PDO_ASSOC)) {
$l = explode(',', $row['value']);
$tmp[] = $l;
}
$final = array_merge(...$tmp);
?>
🐘
Looping with array_merge()

53. <?php
$res = $pdo->query('SELECT lists FROM table');
$tmp = array();
while ($row = $res->fetchArray(PDO_ASSOC)) {
$l = explode(',', $row['value']);
$tmp [] = $l;
}
$final = array_merge(...$tmp);
?>
🐘
Looping with array_merge()

54. Looping with concat
<?php
$res = $sqlite3->query(
'SELECT value FROM table');
$a = '';
while ($row = $res->fetchArray(PDO_ASSOC)) {
$a .= $row['value'];
}
?>
🚀

55. <?php
$res = $sqlite3->query(
'SELECT value FROM table');
$a = array();
while ($row = $res->fetchArray(PDO_ASSOC)) {
$a []= $row['value'];
}
$final = implode('', $a);
?>
🐘
Looping with concat

56. Looping with addition
<?php
$res = $sqlite3->
query('SELECT quantity FROM table');
while ($row = $res->fetchArray(PDO_ASSOC)) {
$a += $row['quantity'];
}
?>
🐘
No
array_sum

57. Missing subpattern
<?php
preg_match('/(a)(b)?/', 'abc', $r);
/*
Array
(
[0] => ab
[1] => a
[2] => b
)
*/
🐞

58. Missing subpattern
<?php
preg_match('/(a)(b)?/', 'amc', $r);
/*
Array
(
[0] => a
[1] => a
)
*/
🐞

59. Missing subpattern
<?php
preg_match('/(a)(b)?(.?)/', 'amc', $r);
/*
Array
(
[0] => am
[1] => a
[2] =>
[3] => m
)
*/
🐘

60. Missing subpattern
<?php
preg_match('/(a)(b)?/', 'amc', $r,
PREG_UNMATCHED_AS_NULL);
/*
Array
(
[0] => ad
[1] => a
[2] =>
)
*/
🐘
PHP
7.4+

61. The no-name™ brand
<?php
preg_match('/(?<here>a)(b)?(.?)/', 'adc', $r);
preg_match("/(?'here'a)(b)?(.?)/", 'adc', $r);
/*
Array
(
[0] => ad
[here] => a
[1] => a
[2] =>
[3] => d
)
*/
🐘

62. The no-name™ brand<?php
preg_match(
'/(?<here>a) # named subpattern
(b)? # optional b
(.?) # because Damien told us
/x', 'abc', $r);
print_r($r);
/*
Array
(
[0] => ad
[here] => a
[1] => a
[2] =>
[3] => d
)
*/
🐘

63. Next month
<?php
echo date('F',
strtotime('+1 month',
mktime(0,0,0,$i,31,2019)));
?>
// January 1rst => February 1rst
// October 31rst => December 1rst
// January 31rst => March, 2nd or 3rd
🐞

64. Next month
<?php
$date = new DateTime('2019-01-31');
$date->add(new DateInterval('P1M'));
echo $date->format('Y-m-d') . "n";
?>
🐞
// January 1rst => February 1rst
// October 31rst => December 1rst
// January 31rst => March, 2nd or 3rd

65. Next month
<?php
use CarbonCarbon;
$mutable = Carbon::createFromDate(2019, 1, 31);
$mutable->add(1, 'month');
print $mutable;
🐞
// January 1rst => February 1rst
// October 31rst => December 1rst
// January 31rst => March, 2nd or 3rd

66. Next month
<?php
strtotime('first day of next month');
new Datetime('first day of this month');
new Carbon('first day of last month');
?>
🐘

67. When is tomorrow?
<?php
$tomorrow = time() + 86400;
?>
🐞

68. When is tomorrow?
<?php
$demain = new DateTime('tomorrow');
?>
🐘

69. How long does this last?
<?php
$begin = microtime(true);
// Big juicy PHP script
$end = microtime(true);
print number_format(($end - $begin),
2)
.'ms';
?>
🐞

70. How long does this last?
<?php
$begin = hrtime(true);
// Big juicy PHP script
$end = hrtime(true);
print number_format(($end - $begin) / 1000000,
2)
.'ms';
?>
🐘

71. The return of the reference
<?php
$a = range(0, 3);
foreach($a as &$b) { }
foreach($a as $b) { }
print_r($a);
?>
Array
(
[0] => 0
[1] => 1
[2] => 2
[3] => 2
)
🐞

72. The return of the reference
<?php
$a = range(0, 3);
foreach($a as &$b) { }
unset($b);
foreach($a as $b) { }
print_r($a);
?>
Array
(
[0] => 0
[1] => 1
[2] => 2
[3] => 3
)
🐘

73. list() with PHP 4
<?php
list($a, $b) = array( 1, 2, 3);
?>
🛠

74. list() with PHP 5(-ish)
<?php
[$a, $b] = [ 1, 2, 3];
?>
🛠
🐘

75. list() with PHP 7
<?php
['w' => $a, 'e' => $b] =
['e' => 1,
'w' => 'd']
];
?>
🛠
🐘

76. list() with PHP 7
<?php
['w' => $a, 'e' => ['d'=> $b]] =
['c' => 1,
'w' =>['d' => 2,
'f' => 3,]
,];
?>
🛠
🐘

77. list() with PHP 7
<?php
['e' => $a, 'e' => ['d'=> $b]] =
['c' => 1,
'e' =>['d' => 2,
'f' => 3,]
,];
?>
🛠
🐘

78. List() into the future!
<?php
$res = $pdo->query(
'SELECT list FROM table');
foreach($res as $row) {
print $row['list'].PHP_EOL;
}
?>
🛠
🐘

79. List() into the future!
<?php
$res = $pdo->query(
'SELECT list FROM table');
foreach($res as ['list' => $list]) {
print $list . PHP_EOL;
}
?>
🛠
🐘

80. Top 10
1.Dangling reference (40 %)
2.For with count() (35%)
3.Next month (8%)
4.array_merge in loops (57%)
5.strpos() fail (54%)
6.Shorten first (7%)
7.unset($x->y) (7%)
8.Operator precedences (20%)
9.Missing subpattern (14%)
10.real is gone (9%)
https://www.exakat.io/en/epic-exakat-php-index-of-coding-june-2020/

81. Want to check your code?
🛠
🐘
PHP Static analysis
Exakat
Modernize your code
https://www.exakat.io/

82. Dank
U
@exakat
https://exakat.io
https://joind.in/talk/ea991