phanalist

E0052: Unchecked json_decode Result

In plain English: json_decode() returns null when the JSON is invalid. If you immediately read a property or array key from that result, PHP tries to read from null and can fail.

Why it matters: A malformed response or request body can cause a warning, an exception, or a confusing “property on null” error instead of a clear validation message.

Bad

return json_decode($json)->name;
return json_decode($json, true)[0];

Good

$data = json_decode($json, true, flags: JSON_THROW_ON_ERROR);

return $data['name'];

JSON_THROW_ON_ERROR makes invalid JSON throw a JsonException that you can catch. If you do not want exceptions, check the result first:

$data = json_decode($json, true);
if (!is_array($data)) {
    return null;
}

return $data['name'] ?? null;

What the rule checks

• json_decode($json)->property
• json_decode($json)->method()
• json_decode($json)[$key]

It also accepts direct accesses guarded by ??, isset(), or empty(), and calls that use JSON_THROW_ON_ERROR in a positional or named flags argument.

When it does not report

• The access is guarded by ??, isset(), or empty().
• The call uses JSON_THROW_ON_ERROR.
• The decoded value is assigned to a variable first. The rule only checks direct access, so it does not report this even when the variable is not checked.
• The null check happens inside a helper function or custom wrapper.

How to fix

• Use JSON_THROW_ON_ERROR and catch JsonException.
• Check is_array() or is_object() before reading the result.
• Use ?? or isset() for optional keys.
• Prefer decoding into a typed DTO instead of reading raw arrays everywhere.

Configuration

E0052 has no configuration options and is enabled by default.

This site is open source. Improve this page.