Call Time Pass By Reference

ID

php.call_time_pass_by_ref

Severity

low

Remediation Complexity

trivial

Remediation Risk

low

Remediation Effort

low

Resource

Reliability

Language

Php

Tags

deprecated-feature, reliability

Description

Reports arguments that are passed by reference at the call site, for example foo(&$x). The by-reference contract belongs on the function’s parameter declaration, never on the call.

Rationale

Call-time pass-by-reference was deprecated in PHP 5.3, removed in PHP 5.4, and raises a fatal error on every modern PHP runtime. Code that still relies on it will simply stop running after an interpreter upgrade. When a function genuinely needs to mutate an argument, the reference must be declared once on the parameter (function foo(&$x)); every caller then passes the variable normally and the engine binds it by reference automatically.

<?php
function increment(&$value)
{
    $value++;
}

$count = 0;
increment(&$count);   // FLAW — call-time pass-by-reference, fatal in PHP 8
increment($count);    // OK — the parameter already declares the reference

Remediation

Remove the & from the call. Declare the reference on the parameter instead (function increment(&$value)), then pass the argument normally (increment($count)).

References