Code auditing

Adoption of PHP 8 attributes in 2022

Posted on by dams

Adoption of PHP 8 attributes in 2022

PHP 8 introduced the attributes, in lieu of the phpdoc comments. They may be added to classes, methods, functions, parameters, properties and class constants and provide a PHP-way to write custom configurations. This is a great addition for the static analysis tools, and PHP in general.

18 months later, how are the attributes doing? Let’s take a look in the open source world, where the code may be publicly audited.

Code penetration

Out of 535 open source project tested, 83 were sporting one or more attributes. This makes about project a project out of six. This is a good start, and not tidal wave. For comparison, the spaceship operator <=> is currently adopted by 6%, and started many years ago.

Popular attributes

Here are the most popular attributes, in order of usage occurrences :

  1. ReturnTypeWillChange
  2. Pure
  3. Attribute
  4. ArrayShape
  5. ExpectedValues
  6. Deprecated
  7. Route
  8. SensitiveParameter
  9. Dependency
  10. Immutable

Note : twelve more attributes that were found once only were skipped here. Also, actual numbers are not providing any significant meaning. Only the relative order is useful.

PHP attributes

In PHP 8.1, there is only one attribute (besides the Attribute attribute, used to design classes as attributes) : ReturnTypeWillChange.

This attribute mutes some warning during inheritance validation. To keep code compatible with PHP 8.1, it is compulsory. That explains the first place of this attribute in the ranking.

PHP 8.2 attributes

One interesting pick in the list is SensitiveParameter. It is in fact a PHP attribute, but a PHP 8.2 one. It is in the current code, along with SensitiveParameterValue. It is part of an adopted RFC, by Tim Düsterhus : PHP RFC: Redacting parameters in back traces.

Their goal is to hide the content of the variable when displaying information with the debug function of PHP, such as debug_print_backtrace().

Another upcoming attribute is AllowDynamicProperties, which, as its name states, will be used to allow dynamic properties in chosen classes. That will make five native PHP attributes in PHP 8.2.

PHPstorm attributes

JetBrains published a corpus of 8 attributes to put in the code and help their static analysis tool provide better results. This is the case for Immutable, Deprecated, ArrayShape, ExpectedValues and Pure. Those attributes are used with the PHPStorm IDE, with the direct effect to make false positives go away.

It shows the importance of publishing attributes : as those attributes are being adopted in the codes, they should be adopted by static analysis tools, and reduce the number of options in the code.

Symfony attributes

Route is a Symfony attribute. It allows the configuration of a route, directly in the controller.

Navarr Attributes

Dependency is an attribute, defined in the Navarr/Attribute-dependency package, to handle dependencies.

Future of the Attributes

Attributes are definitely in the adoption phase. The main publishers of attributes are PHP itself, for its own usage, static analysis editors and frameworks editors. Even at that, they are rather courageous pionneers and innovators.

This quick survey collected ten attributes with significant usage. As this list grows, the need for a common dictionary with the attributes and their usage will emerge. There are quite a lot of options to decorate classes and methods, and it will be nice to keep this population under control.