StreamOutputReturnUsedAsContent

warning native on by default quick-fix

Group: Probable bugs

Output the stream without printing its byte count.

Example

Finding:

<?php
echo readfile("ledger.txt");

Reported:

• line 2: Output the stream without printing its byte count.

Detection

• Report a direct readfile or fpassthru return used as the sole operand of echo or print. These functions already output stream bytes; their numeric successful return is output again. Grouping parentheses around the call, as in echo(readfile($f)); or print (fpassthru($h));, are looked through: they are not call syntax and the operand is still the stream call alone.
• Emit one finding per violating operation. Flow facts require a reachable path with no intervening mutation, escaped alias, unknown call involving the tracked value or analysis-budget exhaustion. Uncertain facts cannot prove a violation.

Exceptions (no report)

Remove only the output keyword and its separating whitespace. Preserve suffix comments between the stream call and the statement terminator.

• Storing or testing the byte count, calls to file_get_contents, shadowed builtin names and multioperand echo are excluded.
• Exclude shadowed builtin symbols, unresolved required types, incomplete syntax and unsupported PHP versions.

Fix

Replace a standalone echo/print statement whose only operand is the resolved call with that call as an expression statement. Retain the complete original call bytes, arguments and trailing semicolon. When the operand is parenthesised, remove only the keyword and the whitespace before the opening parenthesis, leaving the parenthesised call as the statement. Offer no fix when wrapper removal would drop comments or when print is used within a larger expression.

All edits use exact byte ranges, preserve comments and evaluation order, and require syntax supported by the target PHP version. A fix must never add an evaluation or silently change unrelated arguments.

PHP versions

Available throughout PHP 5.3–8.5.

Configure

In custos.json:

{
  "rules": {
    "StreamOutputReturnUsedAsContent": {
      "enabled": false
    }
  }
}

Suppress

Before the statement or declaration (or the first statement of the file):

// @custos-ignore StreamOutputReturnUsedAsContent