--- title: "PHP Native Attributes quick reference" url: https://www.exakat.io/php-native-attributes-quick-reference/ date: 2022-08-01 modified: 2026-04-01 author: "dams" description: "PHP native attributes In PHP 8.0, PHP added native attributes to its vast arsenal of features. Later, the first native attribute, aka, available in the core of PHP, appeared. Here..." categories: - "Code auditing" tags: - "attribute" image: https://www.exakat.io/wp-content/uploads/2022/08/across-pond.320.jpg word_count: 825 --- # PHP Native Attributes quick reference # PHP native attributes In PHP 8.0, PHP added [native attributes](https://www.php.net/manual/en/language.attributes.overview.php) to its vast arsenal of features. Later, the first native attribute, aka, available in the core of PHP, appeared. Here they are, for quick reference. In PHP 8.5, there are 8 native attributes. - PHP 8.0 Attribute - PHP 8.1 ReturnTypeWillChange - SensitiveParameter - PHP 8.2 AllowDynamicProperties - PHP 8.3 Override - PHP 8.4 Deprecated - PHP 8.5 NoDiscard - DelayedTargetValidation - PHP 8.6 No new attribute yet (Apr. 2026) ## PHP Native Attributes [`Attribute`](https://www.php.net/manual/en/class.attribute.php) is the attribute to make a class a valid `Attribute` class. This definition sound pretty meta, but it is quite simple : there must be a first class that defines what an attribute is. It is not compulsory, although, as a gesture of courtesy to the next developer : just add it to every attribute class, and all will be fine. Available since PHP 8.0. ## ReturnTypeWillChange [`ReturnTypeWillChange`](https://www.php.net/manual/en/class.returntypewillchange.php) characterize a method, whose returntype will change in child classes. This prevents PHP from emitting an error about a possible type mismatch. It was created when the native PHP method `JsonSerializable::jsonSerialize()`received the `mixed` returntype. Although that type is the universal type, as it accepts everything, PHP reports a type mismatch with any method which doesn't use that type. Adding this attribute relax that constraint. It only works with PHP native methods, and has no effect on custom methods. Here is a list of PHP native interfaces and methods, which may require their usage : - JsonSerializable::jsonSerialize() - SessionHandlerInterface::open() - SessionHandlerInterface::close() - SessionHandlerInterface::read() - SessionHandlerInterface::write() - SessionHandlerInterface::destroy() - SessionHandlerInterface::gc() - Iterator::current() - Iterator::next() - Iterator::key() - Iterator::valid() - Iterator::rewind() - Countable::count() - IteratorAggregate::getIterator() - php_user_filter::filter() - ArrayAccess::offsetGet() - ArrayAccess::offsetSet() - ArrayAccess::offsetUnset() - ArrayAccess::offsetExists() - RecursiveIterator::getChildren() - FilterIterator::accept() - Exception::__wakeup() Available since PHP 8.1. ## SensitiveParameter [`SensitiveParameter`](https://www.php.net/manual/en/class.sensitiveparameter.php) mark arguments as security sensitive, so that they will be automatically masked when a debug backtrace is displayed. Here is an example : With PHP 8.2, the result is the following : Array ( [0] => Array ( [file] => /Users/famille/Desktop/analyzeG3/test.php [line] => 7 [function] => foo [args] => Array ( [0] => my [1] => SensitiveParameterValue Object ) ) ) Properties are not covered by this parameter. For them, there is already the [__debugInfo()](https://www.php.net/manual/en/language.oop5.magic.php#object.debuginfo), which may be used to hide any sensitive value, instead of displaying it. Available in PHP 8.2. ## AllowDynamicProperties [`AllowDynamicProperties`](https://www.php.net/manual/en/class.allowdynamicproperties.php) relaxes the compulsory property definition that starts with PHP 8.2. The default behavior is now to declare explicitely all properties. Yet, since dynamic properties are a valid use case, albeit a rare one, it is possible to relax this constraint by using this attribute. Another option is to use the `Stdclass` or extend it. This class is built-in with that attribute. Available in PHP 8.2. ## Override The [`Override`](https://www.php.net/manual/en/class.override.php) attribute is used to explicitly indicate that a method in a subclass is overriding a method in the parent class. This attribute has no special effect, unlike other PHP native attribute. It simply state the intention to override a parent method. It is mainly used for documentation and be used by static code analysers. Available in PHP 8.3. ## Deprecated The [`Deprecated`](https://www.php.net/manual/en/class.deprecated.php) attribute is used to explicitly indicate that a method, a function or a class constrant is obsolete, and will be removed in the future. This means the current version is supporting the associated feature, so it is good to use it. It is also recommended to read the documentation, and replace this structure with a modern version, so as to be ready when the change is applied. [`Deprecated`](https://www.php.net/manual/en/class.deprecated.php) does not work for classes, interfaces, enumerations nor traits. Available in PHP 8.4. ## NoDiscard The [NoDiscard](https://www.php.net/manual/en/class.nodiscard.php) attribute is used to explicitly indicate that a method or a function is returning a value that should be processed, and not be ignored. This might be the case of a list of error, or an empty value that means error. `NoDiscard` works on methods and functions. Available in PHP 8.5. ## DelayedTargetValidation The DelayedTargetValidation attribute is meant to make other PHP engine attributes optional. It will shut down complains from the PHP engine for attributes, allowing for future compatibility. Check the RFC : [https://wiki.php.net/rfc/delayedtargetvalidation_attribute](https://wiki.php.net/rfc/delayedtargetvalidation_attribute) Available in PHP 8.5