SqliteClearWithoutRequiredReset

warning native on by default PHP 5.3–7.1

Group: Probable bugs

Reset the SQLite statement before rebinding cleared parameters.

Example

<?php
function f(SQLite3Stmt $s) { $r=$s->execute(); if($r->fetchArray()){ $s->clear(); $s->bindValue(1,'later'); $s->execute(); } }

Reported:

• line 2: Reset the SQLite statement before rebinding cleared parameters.

Detection

• On PHP 5.3–7.1, a SQLite3Stmt with a successful guarded row fetch from its prior execute result is cleared, then rebound with bindValue/bindParam and executed again without reset between the prior execute and rebinding. Report the second execute. Require same local receiver identity and an unambiguous ordered path.
• Resolve builtin functions, extension classes, constants and method receivers, including aliases and supported named arguments. Inspect reachable operations in one lexical scope with bounded local flow.
• Emit one finding per violating operation. Never infer policy from names or comments. When the proof is inconclusive, nothing is reported.

Exceptions (no report)

• Exclude shadowed or unresolved symbols, incomplete code, unknown required constants, ambiguous receiver identity and unsupported versions. Reassignment, escaping aliases, and unknown calls invalidate dependent flow facts.
• Both @custos-ignore SqliteClearWithoutRequiredReset and @noinspection SqliteClearWithoutRequiredReset suppress this native rule.

Fix

None. A safe repair requires choosing values, error handling, or application behavior.

PHP versions

PHP resets statements before rebinding during execute starting with 7.2.14 and 7.3.0. Custos selects minor-version targets, so it conservatively excludes all PHP 7.2 and later. Earlier targets require a successful guarded fetch to establish an active cursor; execute alone resets its cursor and is insufficient.

Options

None. Use normal rule configuration to enable or disable the inspection.

Configure

In custos.json:

{
  "rules": {
    "SqliteClearWithoutRequiredReset": {
      "enabled": false
    }
  }
}

Suppress

Before the statement or declaration (or the first statement of the file):

// @custos-ignore SqliteClearWithoutRequiredReset