Too Many Params In Call

ID

php.too_many_params_in_call

Severity

high

Remediation Complexity

trivial

Remediation Risk

low

Remediation Effort

low

Resource

Reliability

Language

Php

Tags

reliability, suspicious-call

Description

Reports calls to a free function declared in the same file that pass more arguments than the function declares. The extra arguments are silently discarded at runtime, so the value the caller meant to pass never reaches the function body.

Rationale

PHP does not raise an error when a non-variadic function is given too many arguments — it simply ignores the surplus. This makes such calls a quiet source of bugs: a refactor that removes a parameter, or a copy-paste that adds one argument too many, compiles and runs while quietly dropping data. Surfacing the arity mismatch turns a silent defect into a fixable warning. Functions that declare a variadic parameter (…​$args) or read their arguments through func_get_args() legitimately accept any number of arguments and are not reported.

<?php
function greet($name)
{
    return 'hi ' . $name;
}

function many(...$args)
{
    return count($args);
}

greet('bob', 'extra');   // FLAW — greet declares 1 parameter, called with 2
greet('bob');            // OK — exact arity
many(1, 2, 3, 4);        // OK — variadic accepts any number of arguments

Remediation

Remove the surplus arguments so the call matches the function’s signature. If the function is genuinely meant to accept extra arguments, declare a variadic parameter (…​$args) or read them via func_get_args().

References