Global Variable Abuse

Also Known As

TL;DR

Explanation

Global variables create hidden dependencies: any function anywhere can read or modify them, making execution order critical and side effects unpredictable. In PHP, the global keyword imports a variable from the global scope into a function. PHP superglobals ($_GET, $_POST, $_SESSION) are a necessary evil but accessing them deep in business logic is the same problem. The fix is dependency injection — pass state explicitly as parameters or constructor arguments.

Common Misconception

Why It Matters

Common Mistakes

• Using the global keyword in functions instead of passing parameters.
• Storing request state in global variables instead of a request context object.
• Database connection stored in a global variable instead of injected into services.
• Using static class properties as global state — same problem, different syntax.

Code Examples

// Global variable abuse:
$db = new PDO(DSN, USER, PASS); // Global

function getUser(int $id): array {
    global $db; // Hidden dependency — untestable without real DB
    return $db->query('SELECT * FROM users WHERE id = ' . $id)->fetch();
}

function saveUser(array $data): void {
    global $db; // Same hidden dependency everywhere
    $db->query('INSERT INTO users ...');
}

// Dependency injection — explicit, testable:
class UserRepository {
    public function __construct(private PDO $db) {}

    public function find(int $id): array {
        $stmt = $this->db->prepare('SELECT * FROM users WHERE id = ?');
        $stmt->execute([$id]);
        return $stmt->fetch();
    }
}
// In tests: inject a mock PDO — no global state

References

• ↗ https://www.php.net/manual/en/language.variables.scope.php

Tags

Related Terms