JsonNumericCheckChangesIdentifiers

warning native off by default

Group: Probable bugs

Numeric JSON conversion can remove leading zeros or a leading plus sign from identifier strings. Keep those values as strings when their formatting matters. This inspection is disabled by default because the intended policy or use can vary.

Example

<?php
json_encode(["phone"=>"+331234"],JSON_NUMERIC_CHECK);

Reported:

• line 2: Preserve identifier strings during JSON encoding.

Detection

• Resolved json_encode uses JSON_NUMERIC_CHECK and a literal structure contains a string with a leading plus or leading zero followed by digits; classify formatting loss, not field-name intent. Highlight flag.
• Evaluate the effective array after PHP key normalization and duplicate-key overwrites, recursively where nested values supply evidence. Only surviving entries establish row collisions, nested arrays, non-stringable objects, formatted numeric strings or nested list shapes. Earlier entries overwritten by a later occurrence of the same normalized key are not evidence; unknown keys or unsupported effective-array evaluation discard proof.
• Resolve builtin functions, classes, constants and methods; user-defined lookalikes are excluded. Follow only bounded local proof in one lexical scope.
• Emit one finding per violating operation, not per supporting evidence statement. When the proof is inconclusive, nothing is reported.

Exceptions (no report)

• Do not report unresolved or shadowed builtin names, unknown values, or incomplete receiver/type provenance. Unknown calls, aliases escaping, and intervening writes invalidate local proof. Similar code outside the stated detection contract is not a finding.
• Both standard suppression forms suppress this native ID.

Fix

None. Choosing a repair requires intent or additional runtime information.

PHP versions

Available throughout supported PHP 5.3–8.5 where the referenced builtin/extension is available. Respect syntax/version-specific receiver contracts; unavailable APIs are not this rule’s concern.

Effective array-key behavior follows the PHP array contract.

Configure

In custos.json:

{
  "rules": {
    "JsonNumericCheckChangesIdentifiers": {
      "enabled": true
    }
  }
}

Suppress

Before the statement or declaration (or the first statement of the file):

// @custos-ignore JsonNumericCheckChangesIdentifiers