sprintf() — Format Strings in PHP
debt(d7/e3/b2/t5)
Closest to 'only careful code review or runtime testing' (d7). No detection_hints.tools provided; misuse of sprintf format specifiers (e.g. %.0f vs %d, missing __toString) generally isn't caught by default linters. PHPStan/Psalm at higher levels can catch some format/type mismatches but most issues surface only at runtime or code review.
Closest to 'simple parameterised fix' (e3). Per quick_fix, replacing str_pad or number_format with sprintf('%05d', $n) or sprintf('%.2f', $amount) is a localized pattern replacement — slightly more than a one-line swap when multiple sites exist, but mechanically simple.
Closest to 'minimal commitment' (b1) edging toward 'localised tax' (b3). sprintf is a stdlib function call; using it imposes essentially no architectural weight on future maintainers — it's a per-call-site choice.
Closest to 'notable trap' (t5). Per misconception and common_mistakes: %.0f rounds rather than truncates, %s requires __toString (fatal in PHP 8), and argument swapping for i18n is non-obvious. These are documented gotchas most PHP devs eventually learn.
Also Known As
TL;DR
Explanation
sprintf() accepts a format string with conversion specifiers: %s (string), %d (integer), %f (float), %b (binary), %x (hex), %o (octal), %e (scientific notation). Each specifier can include a sign flag, padding character, alignment flag, width, and precision: '%-10s' left-aligns in a 10-character field; '%05d' zero-pads to 5 digits; '%.2f' rounds to 2 decimal places. Argument swapping ('%1$s has %2$d items') reorders values without rewriting the format string — useful for internationalisation. printf() is the print version; fprintf() writes to a file handle; vprintf() and vsprintf() accept an array of arguments.
Common Misconception
Why It Matters
Common Mistakes
- Using sprintf() for SQL queries with user input — sprintf() does not escape values; use prepared statements with PDO or MySQLi for any SQL with external data.
- Forgetting that %s casts objects to string — if the object has no __toString(), this throws a fatal error in PHP 8.
- Using %.0f to format integers — it rounds floats, producing unexpected results near .5; use %d for integers.
- Not using argument swapping for translatable strings — position-dependent format strings require translators to rewrite the whole string to reorder arguments.
Code Examples
<?php
// ❌ Fragile manual formatting
$orderId = '00' . $id; // Only works for ids < 1000
$price = round($amount, 2); // 10.5 not 10.50 — missing trailing zero
$hex = dechex($color); // No padding — 'f' instead of '0f'
// Locale-dependent decimal separator
setlocale(LC_NUMERIC, 'de_DE');
$formatted = (string) 10.5; // '10,5' in German locale — breaks JSON<?php
// ✅ sprintf() — explicit, locale-independent
$orderId = sprintf('%05d', $id); // '00042'
$price = sprintf('%.2f', $amount); // '10.50' always
$hex = sprintf('%02x', $color); // '0f' with padding
// Argument swapping for i18n
// English: 'Order #42 has 3 items'
// French: '3 articles dans la commande #42'
$msg = sprintf(__('Order #%1$d has %2$d items'), $orderId, $itemCount);
// Named argument equivalent in newer code
$sql = sprintf(
'SELECT * FROM %s WHERE id = %d LIMIT %d',
$table, $id, $limit
// Note: still use prepared statements for user input — not sprintf