Repository navigation
Report str_replace()/str_ireplace()/preg_replace()/preg_filter() calls with fewer replacements than search values - #7007
Open
phpstan-bot wants to merge 1 commit into
Conversation
…()` calls with fewer replacements than search values - New bleeding-edge rule `ReplaceCountMismatchRule` (level 5, feature toggle `replaceCountMismatch`): when both the search/pattern and the replace/replacement arguments are arrays and the replacement array size is definitely smaller than the search array size, report it, because PHP silently replaces the remaining values with an empty string. - Uses `Type::getArraySize()` + `isSmallerThan()` so constant arrays, unions of shapes and non-empty lists are handled; only definite mismatches are reported. - A string replacement and an explicitly empty replacement array (a deliberate "remove all" idiom) are not reported. - Applied to the whole family of replace functions with the same semantics: str_replace, str_ireplace, preg_replace, preg_filter. - Respects treatPhpDocTypesAsCertain and adds the tip when only PHPDoc types prove the mismatch.
This was referenced Nov 8, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
str_replace(['a', 'b', 'c'], ['x', 'y'], $s)is valid PHP: the search values without a matching replacement are replaced with an empty string. This is rarely intended and usually a typo. This PR adds a bleeding-edge rule that reports these calls.Changes
src/Rules/Functions/ReplaceCountMismatchRule.php: new level-5 rule, gated by thereplaceCountMismatchfeature toggle (enabled inconf/bleedingEdge.neon, declared inconf/config.neonandconf/parametersSchema.neon).str_replace,str_ireplace,preg_replaceandpreg_filter. Identifiers arestrReplace.replaceCountandpregReplace.replaceCount.list<string>, or a union of shapes that overlaps)ArgumentsNormalizer, and handlestreatPhpDocTypesAsCertain, adding the tip when only PHPDoc types prove the mismatch.Root cause
PHPStan had no check comparing the sizes of the search and replace arrays. The rule compares
getArraySize()of both arguments withisSmallerThan(). This works for constant arrays, array shapes, unions of shapes and non-empty lists alike.Probed and out of scope:
str_replace('a', ['x'], $s)(string search with an array replace) throws a TypeError on PHP 8 but is not reported today. That comes from the function signature, not a count mismatch, so it is left for a separate change.Test
tests/PHPStan/Rules/Functions/ReplaceCountMismatchRuleTest.phpwithdata/bug-3889.php. It contains the issue's reproducer verbatim, the string-replacement case from the comments (no error), and variants for:str_ireplace,preg_replace,preg_filter, named arguments (separate PHP 8.0+ fixturedata/bug-3889-named-args.php), PHPDoc-only shapes (with the tip), lists, non-empty lists, unions of shapes, and empty/equal/longer replacement arrays.Fixes phpstan/phpstan#3889
🤖 Generated with Claude Code