Add method to ReflectionClass to instantiate with the same semantics as `PDOStatement::fetchObject()` #19401

mattdinthehouse · 2025-08-07T11:16:51Z

I've been using PDOStatement::fetchObject() and mysqli_result::fetch_object() for a couple years as a very rudimentary ORM, and I've extended that "design pattern" to create class objects from arbitrary data (eg JSON or $_POST payloads) using a custom method.

That custom approach uses ReflectionClass::newInstanceWithoutConstructor() and ReflectionProperty::setValue() plus some additional validation and type massaging logic to emulate the behaviour of the PDO and MySQLi methods.

This PR adds a newInstanceFromData(array $data, array $args = []) method to ReflectionClass that behaves the same as the PDO and MySQLi methods but is actually baked into PHP properly, ie: it instantiates the class and assigns the properties to the corresponding values in $data before calling the constructor. The second parameter $args is passed to the class constructor the same as ReflectionClass::newInstanceArgs().

The primary use-case for this would be non-database ORM models and DTOs.

Other things I want to look at:

The implementation of this method, ReflectionClass::newInstanceArgs(), and ReflectionClass::newInstance() are all very similar so for the sake of not having duplicate code and therefore duplicate tests I want to refactor the "call the constructor with the given args" code into a common function.
~~PDOStatement::fetch() with PDO::FETCH_CLASS also supports PDO::FETCH_PROPS_LATE flag to call the constructor before setting properties which makes sense here too.~~ actually no this doesn't make sense here because users would just call new MyClass and pass data to the constructor like normal.

mattdinthehouse · 2025-08-07T22:37:19Z

Hey @DanielEScherzer happy friday :)

Not sure if this one needs an RFC - I'll take your guidance on that!

But let me know your thoughts on -

The implementation of this method, ReflectionClass::newInstanceArgs(), and ReflectionClass::newInstance() are all very similar so for the sake of not having duplicate code and therefore duplicate tests I want to refactor the "call the constructor with the given args" code into a common function.

and can you confirm that https://github.com/php/doc-base is the right repo to clone for documenting this new method?

Girgias

I don't really like the semantics exposed by PDO, and didn't know that mysqli also exposed them, as they are very dubious IMHO, as creating an object without running the constructor can lead to it being in an unexpected state.

In any case you are going to need way more tests to cover readonly, asymmetric visibility, property hooks, and internal classes that prevent instantiation via new.

Girgias · 2025-08-07T23:13:06Z

ext/reflection/php_reflection.c

+
+	const zend_class_entry *old_scope = EG(fake_scope);
+	EG(fake_scope) = ce;
+	constructor = Z_OBJ_HT_P(return_value)->get_constructor(Z_OBJ_P(return_value));


This may throw for internal classes.

It's the same code used by newInstance and newInstanceArgs which I'm thinking of refactoring into a shared function to cut the duplication, so would make sense to handle instantiating internal classes there but could be considered a breaking change?

Not sure whether that's really a BC break? It would be throwing an exception either way?

We had a discussion a while ago with @DanielEScherzer and I think @nielsdos that it would probably be better to do something to fix the semantics regarding failing get_constructor, as various other places assume that you can even just check the constructor pointer on the CE.

Probably the best solution is that if the constructor field on the CE is NULL it means that it is not instantiable, and to set that field for classes that do not have a constructor to the zend_pass_function (which is what get's "called" anyway in those cases) but the downside of this approach is that you stop getting useful errors telling you how to get such an object (e.g. curl_init() for CurlHandle objects)

Oh I see what you mean - because this method sets properties before calling constructors that can have weird (and potentially vulnerable) behaviour.

I've added a check for ce->type == ZEND_INTERNAL_CLASS similar to newInstanceWithoutConstructor() to prevent using newInstanceFromData() for internal classes entirely.

That discussion is at #17796

Just so that I understand the semantics correctly, is there any difference between the proposed function and something like (class is given as an argument but would be from $this)

function newInstanceFromData(string $class, array $data, array $args = []) { $ref = new ReflectionClass($class); $instance = $ref->newInstanceWithoutConstructor(); foreach ($data as $propName => $val) { $propAccess = $ref->getProperty($propName); $propAccess->setValue($instance, $val); } $instance->__construct(...$args); return $instance; }

ext/reflection/php_reflection.stub.php

mattdinthehouse · 2025-08-08T00:04:39Z

Thanks @Girgias :) I'll add more test coverage based on how @DanielEScherzer feels about refactoring newInstance and newInstanceArgs because they're currently untested for those newer constructs.

I don't really like the semantics exposed by PDO, and didn't know that mysqli also exposed them, as they are very dubious IMHO, as creating an object without running the constructor can lead to it being in an unexpected state.

Yeah it's definitely unexpected to set properties before calling the constructor (do you think this needs an RFC then?) but I've found it to be powerful for ORM and DTO use-cases, for example if I've got a JSON column in my DB then with the PDO and MySQLi functions I can do something like this:

<?php

final class MyClass
{
	private string $json;
	public array $data;

	public function __construct()
	{
		$this->data = json_decode( $this->json, true );
	}
}


$result = $pdo->query("SELECT `json` FROM `my_table`");

$record = $result->fetchObject(MyClass::class);

// ... do stuff with $record->data['whatever']

For a DTO use-case I can put validation logic into my constructor like so:

<?php

final class MyPayload
{
   public int $id;
   public string $name;

   public function __construct()
   {
   	if($this->id < 1) throw new InvalidArgumentException('Invalid ID');

   	if(!trim($this->name)) throw new InvalidArgumentException('Name cannot be blank');
   }
}


$schema = new ReflectionClass('MyPayload');

$dto = $schema->newInstanceFromData($_POST);

// ... do work on DTO knowing it's got fully valid data

…e same as `PDOStatement::fetchObject()`

Co-authored-by: Gina Peter Banyard <[email protected]>

…t sets arbitrary properties before calling the constructor which can have weird consequences

DanielEScherzer · 2025-08-11T16:55:19Z

ext/reflection/php_reflection.c

+
+	const zend_class_entry *old_scope = EG(fake_scope);
+	EG(fake_scope) = ce;
+	constructor = Z_OBJ_HT_P(return_value)->get_constructor(Z_OBJ_P(return_value));


That discussion is at #17796

Just so that I understand the semantics correctly, is there any difference between the proposed function and something like (class is given as an argument but would be from $this)

function newInstanceFromData(string $class, array $data, array $args = []) { $ref = new ReflectionClass($class); $instance = $ref->newInstanceWithoutConstructor(); foreach ($data as $propName => $val) { $propAccess = $ref->getProperty($propName); $propAccess->setValue($instance, $val); } $instance->__construct(...$args); return $instance; }

DanielEScherzer · 2025-08-11T16:55:54Z

ext/reflection/php_reflection.c

+		argc = zend_hash_num_elements(args);
+	}
+
+	if (UNEXPECTED(object_init_ex(return_value, ce) != SUCCESS)) {


if the initialization isn't successful, we should confirm that there is an exception, and then RETURN_THROWS()

DanielEScherzer · 2025-08-11T16:56:38Z

ext/reflection/php_reflection.stub.php

@@ -370,6 +370,8 @@ public function newInstanceWithoutConstructor(): object {}
    /** @tentative-return-type */
    public function newInstanceArgs(array $args = []): ?object {}

+    public function newInstanceFromData(array $data, array $args = []): ?object {}


Should always return an object, no nullable type needed

DanielEScherzer · 2025-08-11T16:56:54Z

ext/reflection/php_reflection.c

+			constructor, Z_OBJ_P(return_value), Z_OBJCE_P(return_value), NULL, 0, NULL, args);
+
+		if (EG(exception)) {
+			zend_object_store_ctor_failed(Z_OBJ_P(return_value));


and also RETURN_THROWS()

DanielEScherzer · 2025-08-11T16:57:03Z

ext/reflection/php_reflection.c

+		if (!(constructor->common.fn_flags & ZEND_ACC_PUBLIC)) {
+			zend_throw_exception_ex(reflection_exception_ptr, 0, "Access to non-public constructor of class %s", ZSTR_VAL(ce->name));
+			zval_ptr_dtor(return_value);
+			RETURN_NULL();


should be RETURN_THROWS()

DanielEScherzer · 2025-08-11T17:05:13Z

ext/reflection/tests/ReflectionClass_newInstanceFromData_002.phpt

@@ -0,0 +1,30 @@
+--TEST--
+ReflectionClass::newInstanceFromData - internal class


please also add tests for

constructor property promotion

constructor property promotion with read-only properties (should trigger errors about reassigning)

normal read-only properties getting set via the data

normal read-only properties getting set via the data and in the constructor (should trigger errors)

hooked properties - with a set hook

hooked properties - virtual properties

using the wrong type of value in the $data values (e.g trying to assign a string to an object property)

github-actions bot added the Extension: reflection label Aug 7, 2025

mattdinthehouse force-pushed the feature/reflectionclass-newinstancefromdata branch 2 times, most recently from d9749d0 to fb97b37 Compare August 7, 2025 11:44

mattdinthehouse marked this pull request as ready for review August 7, 2025 22:34

mattdinthehouse requested review from kocsismate and DanielEScherzer as code owners August 7, 2025 22:34

Girgias requested changes Aug 7, 2025

View reviewed changes

mattdinthehouse and others added 4 commits August 8, 2025 19:17

Add a ReflectionClass::newInstanceFromData() method that behaves th…

4066651

…e same as `PDOStatement::fetchObject()`

Update ext/reflection/php_reflection.stub.php

f33b64e

Co-authored-by: Gina Peter Banyard <[email protected]>

fix build now that we don't have a tentative return type

0380b54

prevent users from instantiating internal classes from data because i…

87572e9

…t sets arbitrary properties before calling the constructor which can have weird consequences

mattdinthehouse force-pushed the feature/reflectionclass-newinstancefromdata branch from 9f8a428 to 87572e9 Compare August 8, 2025 09:26

there we go - now i know how stub files work

16b685d

DanielEScherzer requested changes Aug 11, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Add method to ReflectionClass to instantiate with the same semantics as `PDOStatement::fetchObject()` #19401

Add method to ReflectionClass to instantiate with the same semantics as `PDOStatement::fetchObject()` #19401

mattdinthehouse commented Aug 7, 2025 •

edited

Loading

Uh oh!

mattdinthehouse commented Aug 7, 2025 •

edited

Loading

Uh oh!

Girgias left a comment

Uh oh!

Girgias Aug 7, 2025

Uh oh!

mattdinthehouse Aug 7, 2025

Uh oh!

Girgias Aug 8, 2025

Uh oh!

mattdinthehouse Aug 8, 2025 •

edited

Loading

Uh oh!

DanielEScherzer Aug 11, 2025

Uh oh!

Uh oh!

mattdinthehouse commented Aug 8, 2025 •

edited

Loading

Uh oh!

DanielEScherzer Aug 11, 2025

Uh oh!

DanielEScherzer Aug 11, 2025

Uh oh!

DanielEScherzer Aug 11, 2025

Uh oh!

DanielEScherzer Aug 11, 2025

Uh oh!

DanielEScherzer Aug 11, 2025

Uh oh!

DanielEScherzer Aug 11, 2025

Uh oh!

Uh oh!

		@@ -0,0 +1,30 @@
		--TEST--
		ReflectionClass::newInstanceFromData - internal class

Add method to ReflectionClass to instantiate with the same semantics as PDOStatement::fetchObject() #19401

Are you sure you want to change the base?

Add method to ReflectionClass to instantiate with the same semantics as PDOStatement::fetchObject() #19401

Conversation

mattdinthehouse commented Aug 7, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mattdinthehouse commented Aug 7, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Girgias left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mattdinthehouse Aug 8, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

mattdinthehouse commented Aug 8, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Add method to ReflectionClass to instantiate with the same semantics as `PDOStatement::fetchObject()` #19401

Add method to ReflectionClass to instantiate with the same semantics as `PDOStatement::fetchObject()` #19401

mattdinthehouse commented Aug 7, 2025 •

edited

Loading

mattdinthehouse commented Aug 7, 2025 •

edited

Loading

mattdinthehouse Aug 8, 2025 •

edited

Loading

mattdinthehouse commented Aug 8, 2025 •

edited

Loading