PgFetchedZeroRejected

warning native on by default quick-fix

Group: Probable bugs

Distinguish PostgreSQL fetch failure from a zero value.

Example

<?php
function f($r) { if($v=pg_fetch_result($r,0,0)){echo $v;} }

Reported:

• line 2: Distinguish PostgreSQL fetch failure from a zero value.

Detection

• A pg_fetch_result() call is the whole condition of an if or while, either directly or as the right-hand side of a plain = assignment to a simple variable ($v = pg_fetch_result(...)). The function returns a string, false when the fetch fails, or null for an SQL NULL column; a truthiness test therefore also rejects the fetched strings "0" and "". Explicit comparisons, negations and conditions combining other requirements are not reported.
• Resolve builtin functions, extension classes, constants and method receivers, including aliases and supported named arguments. Inspect reachable operations in one lexical scope with bounded local flow.
• Emit one finding per violating operation. Never infer policy from names or comments. When the proof is inconclusive, nothing is reported.

Exceptions (no report)

• Exclude shadowed or unresolved symbols, incomplete code, unknown required constants, ambiguous receiver identity and unsupported versions. Reassignment, escaping aliases, and unknown calls invalidate dependent flow facts.
• A first-class callable pg_fetch_result(...) creates a closure and fetches nothing.
• Assignments that do not hand the fetched value to the condition unchanged: compound operators (.=, ??=, ...), by-reference assignment, and targets other than a simple variable (property, array element, destructuring list, variable variable), where a typed target may coerce false.
• Both @custos-ignore PgFetchedZeroRejected and @noinspection PgFetchedZeroRejected suppress this native rule.

Fix

Wrap the reported condition in is_string(...): the fetch still runs exactly once, "0" and "" are now accepted, and both false (failed fetch) and null (SQL NULL) stay rejected as they were by the truthiness test. A bare !== false comparison is not offered because it would let SQL NULL into the branch. is_string is written \is_string when the unqualified name would resolve to a namespaced or imported function.

The fix only inserts text before and after the condition, so comments, arguments and their order are preserved byte for byte.

PHP versions

Apply throughout PHP 5.3–8.5 only where the extension API and syntax exist. Do not flag API unavailability through this rule.

Options

None. Use normal rule configuration to enable or disable the inspection.

Configure

In custos.json:

{
  "rules": {
    "PgFetchedZeroRejected": {
      "enabled": false
    }
  }
}

Suppress

Before the statement or declaration (or the first statement of the file):

// @custos-ignore PgFetchedZeroRejected