← CodeClarityLab Home
Browse by Category
+ added · updated 7d
← Back to glossary

Reflection API

php PHP 5.0+ Advanced

Also Known As

PHP Reflection ReflectionClass introspection PHP

TL;DR

PHP's built-in introspection system for examining classes, methods, properties, and parameters at runtime.

Explanation

The PHP Reflection API (ReflectionClass, ReflectionMethod, ReflectionProperty, ReflectionFunction, ReflectionParameter) enables runtime inspection of code structure — reading type declarations, attributes, docblocks, visibility, and default values without invoking the code. It underpins dependency injection containers (resolving constructor parameters), ORM hydration, serialisation libraries, and testing frameworks. Reflection is powerful but has a performance cost — production DI containers cache reflection results. PHP 8.0 Attributes provide a structured, performant alternative to docblock-parsed metadata.

Common Misconception

The Reflection API is only useful for framework developers. Reflection enables runtime code generation, attribute processing, dependency injection containers, test mocking, and documentation generation — it is the backbone of most modern PHP frameworks.

Why It Matters

The Reflection API gives runtime access to class structure, docblocks, and attributes — it powers dependency injection containers, ORMs, and testing frameworks, but has non-trivial performance cost.

Common Mistakes

  • Using Reflection in hot code paths without caching results — ReflectionClass instantiation is expensive.
  • Not caching reflected class metadata in a DI container — reflecting the same class on every request adds measurable overhead.
  • Using Reflection to access private members of other classes in production code — breaks encapsulation.
  • Not using PHP 8 Attributes instead of docblock parsing when possible — native attributes are faster and type-safe.

Code Examples

✗ Vulnerable
// Uncached reflection in a hot path:
function resolve(string $class): object {
    $ref = new ReflectionClass($class); // Expensive — not cached
    $params = $ref->getConstructor()->getParameters();
    // ... inject dependencies
}
✓ Fixed
// Inspect class structure at runtime
\$ref = new ReflectionClass(OrderService::class);
echo \$ref->getName();       // 'App\Domain\OrderService'
echo \$ref->getShortName();  // 'OrderService'

\$methods    = \$ref->getMethods(ReflectionMethod::IS_PUBLIC);
\$constructor = \$ref->getConstructor();

// Read PHP 8.0+ attributes:
foreach (\$ref->getMethods() as \$method) {
    foreach (\$method->getAttributes(Route::class) as \$attr) {
        \$route = \$attr->newInstance();
        echo \$route->path;
    }
}

// Instantiate without constructor (DI containers, test fixtures):
\$instance = \$ref->newInstanceWithoutConstructor();

Added 15 Mar 2026
Edited 22 Mar 2026
Views 22
Rate this term
No ratings yet
🤖 AI Guestbook educational data only
| |
Last 30 days
0 pings F 3 pings S 0 pings S 1 ping M 1 ping T 0 pings W 0 pings T 0 pings F 1 ping S 0 pings S 0 pings M 0 pings T 0 pings W 0 pings T 0 pings F 2 pings S 0 pings S 0 pings M 0 pings T 0 pings W 0 pings T 0 pings F 1 ping S 0 pings S 0 pings M 1 ping T 0 pings W 0 pings T 0 pings F 0 pings S
No pings yet today
No pings yesterday
Amazonbot 8 Unknown AI 3 Perplexity 2 Ahrefs 2 Google 1
crawler 15 pre-tracking 1
DEV INTEL Tools & Severity
🟢 Low ⚙ Fix effort: High
⚡ Quick Fix
Use PHP's Reflection API for framework-level metaprogramming (DI containers, ORMs, test mocking) — avoid using it in application code as it bypasses encapsulation and is significantly slower
📦 Applies To
PHP 5.0+ web cli queue-worker
🔗 Prerequisites
🔍 Detection Hints
Reflection used in hot path per-request; accessing private methods in tests via reflection when Closure::bind() would be cleaner
Auto-detectable: ✗ No phpstan blackfire
⚠ Related Problems
🤖 AI Agent
Confidence: Medium False Positives: Medium ✗ Manual fix Fix: Medium Context: File Tests: Update
CWE-470

✓ schema.org compliant