ValidatedIntegerZeroRejected

warning native on by default quick-fix

Group: Probable bugs

Detect FILTER_VALIDATE_INT result tested for falsiness when zero is permitted by configured min/max bounds.

Example

Before

<?php
if (!filter_var($input, FILTER_VALIDATE_INT)) { return false; }

After fix

<?php
if ((filter_var($input, FILTER_VALIDATE_INT) === false)) { return false; }

Reported:

• line 2: Compare integer validation failure strictly with false.

Detection

• Report FILTER_VALIDATE_INT result tested for falsiness when zero is permitted by configured min/max bounds.
• Resolve builtin calls and named arguments before checking the contract. Project-local callees are considered only when their bodies or immutable summaries establish the required facts. The default is enabled, with positive proof required.
• For flow-dependent conditions, require a reachable source-to-use path with no intervening invalidation. Unknown calls, ambiguous aliases, recursion or analysis-budget exhaustion cannot establish definite facts.

Exceptions (no report)

• FILTER_NULL_ON_FAILURE, bounds excluding zero, strict false checks, and explicit intended nonzero constraints are excluded.
• An options array whose options entry carries a default key: a rejected value then yields that default instead of false, so a strict false comparison could never observe the failure. No report and no fix.
• Flags containing FILTER_REQUIRE_ARRAY or FILTER_FORCE_ARRAY, given either as the integer third argument or as the flags entry of the options array: the call returns an array, negation is an emptiness test and the zero reasoning does not apply. No report and no fix.
• Flags, options or bounds that are not statically known (variables, spreads, non-literal keys or values) leave the failure value unproven and produce no report.
• Unresolved targets, incomplete required facts, suppressed findings and PHP versions lacking the referenced API or language feature produce no report. User declarations shadowing builtin names are not builtin contracts.

Fix

Replace only the negation token and append the strict false comparison. Retain existing parentheses and comments between the negation and validation call.

Replace direct negation with a strict false comparison, preserving one evaluation; the rule stays silent, and so offers no fix, whenever flags or options make the failure value something other than false (null on failure, a configured default) or make the result an array.

A fix is offered only when the concrete prerequisites above are proven. Edits use exact source byte ranges, preserve comments and argument evaluation order, and introduce syntax supported by the configured PHP version. Never invent error-handling policy.

PHP versions

Apply only on PHP versions supporting the referenced APIs and syntax (within PHP 5.3–8.5). Builtin behavior and argument contracts follow the configured PHP version. Extension-specific calls require resolved extension API symbols; do not treat same-named application functions as extension calls.

Options

None. Enable or disable this rule through normal rule configuration.

Configure

In custos.json:

{
  "rules": {
    "ValidatedIntegerZeroRejected": {
      "enabled": false
    }
  }
}

Suppress

Before the statement or declaration (or the first statement of the file):

// @custos-ignore ValidatedIntegerZeroRejected