phanalist

E0054: Dynamic Variable Creation

In plain English: extract() and variable variables such as $$name create local variable names from data. The code becomes hard to follow, and user input can overwrite variables you did not expect.

Why it matters: A request key can replace a local variable, including a security-sensitive one. It also makes it difficult to see which variables a function reads or writes.

Bad

extract($_POST);

$$name = 'value';
${$key} = 'value';

Good

$name = $input['name'] ?? '';
$email = $input['email'] ?? '';

return compact('name', 'email');

What the rule checks

• extract($data) calls
• Indirect variables such as ${$name}
• Nested variables such as $$name and $$$name

When it does not report

• Variables are assigned explicitly.
• Values are read from an array with a key, such as $input['name'].
• compact() is used.
• Dynamic property and method names are used; this rule only checks local variable creation.

How to fix

• Read the keys you expect explicitly.
• Use an array or a small DTO instead of creating variables dynamically.
• Avoid extract(), especially with request data.
• If you need a map, use an explicit allowlist of keys.

Model limits

• The rule reports the construct, not whether the input is untrusted.
• extract() is reported even with EXTR_SKIP or EXTR_PREFIX_ALL.

Configuration

E0054 has no configuration options and is enabled by default.

This site is open source. Improve this page.