Rule Definition
In PHP when a string variable is given as a string value parameter, the string will be evaluated to the value of the variable. The result will be a string that holds the string representation of the value. This practice could provoke unexpected results to be used as a given parameter. Usually the intention would be to pass the raw value of the variable instead of the string-representation. The same type of unexpected results are also obtained when the strings are created as follows: - "".$variable - "{$variable}" - $variable."" - "".$variable.""

Remediation
Modify the source code and pass the variables to a specific function/construct, possibly with a string cast.

Violation Code Sample

<?php
  
    $param = 'someValue';

    test("$param");
    
    if("$param"){
       //do something
    }
    
    $array["$param"];
  ?>

Fixed Code Sample

<?php
  
    $param = 'someValue';

    test((string)$param);
    
    if((string)$param){
       //do something
    }
    
    $array[(string)$param];
  ?>