← Home ← Codex ← DEBT
Browse by Category
+ added · updated 7d
← Back to glossary

Undefined Array Key / Offset Errors

PHP PHP 4.0+ Beginner
debt(d5/e1/b2/t5)
d5 Detectability Operational debt — how invisible misuse is to your safety net

Closest to 'specialist tool catches' (d5), phpstan/psalm detect undefined offset access in static analysis; PHP itself only emits a warning at runtime that's easy to miss in production logs.

e1 Effort Remediation debt — work required to fix once spotted

Closest to 'one-line patch' (e1), quick_fix is to swap $arr['key'] for $arr['key'] ?? $default — a single-call replacement at each site.

b2 Burden Structural debt — long-term weight of choosing wrong

Closest to 'minimal commitment' (b1), slightly above because the pattern recurs across web/cli/queue contexts but each occurrence is local and imposes no structural commitment.

t5 Trap Cognitive debt — how counter-intuitive correct behaviour is

Closest to 'notable trap' (t5), the misconception that isset() and array_key_exists() are equivalent is a documented gotcha most PHP devs eventually learn; silent null propagation also surprises beginners.

About DEBT scoring →

TL;DR

Accessing a non-existent array key triggers E_WARNING (PHP 7) or is silently null (PHP 8 with nullsafe) — use isset(), array_key_exists(), or ?? to guard access.

Explanation

PHP 7 emits E_NOTICE for undefined offset. PHP 8 emits E_WARNING. Neither throws — the expression evaluates to null. Undefined index means string key missing, undefined offset means integer key missing. Best practices: use isset($arr['key']) to check existence, $arr['key'] ?? 'default' for null-coalescing default, array_key_exists() when null is a valid value (isset() returns false for null values). In typed contexts (PHP 8), use dedicated data structures or value objects instead of raw arrays to prevent key access errors.

Common Misconception

isset() and array_key_exists() are equivalent — isset() returns false for null values while array_key_exists() returns true. Use the right one.

Why It Matters

Silent null from undefined key propagates through calculations causing type errors or data corruption much later than the actual bug.

Common Mistakes

  • Using $arr['key'] without isset() check — produces warning and null.
  • Confusing isset() with array_key_exists() when null is a valid array value.
  • Not enabling E_WARNING in development — errors become invisible.

Code Examples

✗ Vulnerable
$config = ['debug' => true];
echo $config['database']; // Warning: Undefined array key 'database'
✓ Fixed
// Null coalescing:
$db = $config['database'] ?? 'mysql://localhost/app';

// When null is a valid value:
if (array_key_exists('database', $config)) {
    $db = $config['database']; // could be null
}

// PHP 8.1+ — first-class enums/value objects are better than raw arrays

Added 22 Mar 2026
Views 284
Rate this term
No ratings yet
🤖 AI Guestbook educational data only
| |
Last 30 days
0 pings T 0 pings W 0 pings T 0 pings F 15 pings S 6 pings S 16 pings M 2 pings T 1 ping W 2 pings T 1 ping F 1 ping S 1 ping S 0 pings M 2 pings T 0 pings W 2 pings T 2 pings F 1 ping S 0 pings S 0 pings M 1 ping T 1 ping W 0 pings T 1 ping F 1 ping S 1 ping S 0 pings M 1 ping T 0 pings W
No pings yet today
Perplexity 1
ChatGPT 197 Perplexity 32 Google 8 Amazonbot 6 Scrapy 5 SEMrush 4 Unknown AI 3 Ahrefs 3 Claude 2 Meta AI 1 Common Crawl 1
crawler 256 crawler_json 5 pre-tracking 1
DEV INTEL Tools & Severity
🟡 Medium ⚙ Fix effort: Low
⚡ Quick Fix
Use $arr['key'] ?? $default for simple defaults. Use array_key_exists() when null is valid. Enable E_ALL in dev to surface all undefined key warnings.
📦 Applies To
PHP 4.0+ web cli queue-worker
🔗 Prerequisites
🔍 Detection Hints
\$[a-z_]+\[
Auto-detectable: ✓ Yes phpstan psalm
⚠ Related Problems
🤖 AI Agent
Confidence: Medium False Positives: Medium ✓ Auto-fixable Fix: Low Context: Line
CWE-476


✓ schema.org compliant