[php-src] Issue #21703: Numeric-string array keys are silently converted to integers, which breaks string identifier semantics
[email protected] (Tudsday)
| Newsgroups | php.bugs |
|---|---|
| Message-ID | <mCpOYu2ZUqHHRSz1Ukq18TglDN1uh6Sx36JMezfH6sA@main.internal.php.net> |
Issue: https://github.com/php/php-src/issues/21703
Author: Tudsday
### Description
### Summary
PHP silently converts numeric-string array keys to integers.
This behavior is longstanding, but in modern PHP 8 code it is surprising and dangerous for business data, because string identifiers can silently change type when they are used as array keys.
This is especially problematic when data originally comes from external systems as strings, for example:
- database names
- user IDs
- file field names
- external identifiers
Even with `declare(strict_types=1);`, a string such as `"5326"` becomes the integer key `5326` when used as an array key.
At minimum, this behavior should be more prominently documented and warned about.
Ideally, it should be reconsidered for modern PHP semantics.
### Reproduction
```php
<?php declare(strict_types=1);
$arr = [];
$arr["5326"] = "x";
var_dump($arr);
var_dump(array_key_first($arr));
var_dump(gettype(array_key_first($arr)));
array(1) {
[5326]=>
string(1) "x"
}
int(5326)
string(7) "integer"
The original string key "5326" is silently normalized to integer key 5326.
Expected result
I would expect string identifiers to remain strings, especially in modern PHP 8 code with strict_types=1.
At minimum, I would expect this behavior to be much more explicitly documented as a dangerous edge case, because it can silently alter application semantics.
### PHP Version
```plain
PHP 8.5.4 (cli) (built: Mar 10 2026 23:30:42) (ZTS Visual C++ 2022 x64)
Zend Engine v4.5.4
Zend OPcache v8.5.4
```
### Operating System
windows 11