PHP References: What They Are and How to Use Them

In PHP, you can use references to access the same variable content using different variable names.
For example:

$a = 'My nice var';
//Make $b the same as $a.
$b =& $a;

When you use the =& operator, $a and $b become the same variable. If you modify one, the other is modified as well.
(Don't confuse PHP references with C-like pointers, because they are quite different things).

There are two ways you can use references in PHP: passing by reference and returning by reference.
Let's see how they work.

Passing by reference.

If you pass a variable to a function by reference, the variable inside the function will be the global variable, instead of being a copy that exists only in the function scope.
This lets the function modify the global variable, without the need to explicitly declare it as global.
For example:

$lemons = 5;

function eatLemon(&$lemons)
{
$lemons--;
}

echo 'I have ' . $lemons . ' lemons';
eatLemon($lemons);
echo 'Now I have ' . $lemons . ' lemons';

If you try this example, you will see how the global $lemons variable is decremented.
Of course, you cannot pass by reference values that cannot be modified.
For instance, you cannot pass a raw value like this:

eatLemon(10);

This will trigger a Fatal Error.

Returning by reference.

The usefulness of returning by reference is less obvious.
Returning by references only makes sense when the returned reference points to a variable outside of the function.
Such variables can be: global variables, static function variables and class properties.

Now, you are probably wondering: why bother using a reference when you can just access the variable directly?

Well, in most cases you should do just that.
Returning by references makes sense when the function selects which variable to point to.

For example, the following code creates a "rectangle" class and increments the length of the longest side.
To select which side is longest, a reference is used:

class Rectangle
{
public $side1;
public $side2;

public function &longestSide()
{
if ($this->side1 > $this->side2)
{
return $this->side1;
}

return $this->side2;
}
}

$rect = new Rectangle();
$rect->side1 = rand(1, 100);
$rect->side2 = rand(1, 100);

//Make the longest side 2x long.
$longest = &$rect->longestSide();
$longest *= 2;

A few more things about References.

1. When you unset a reference, the variable content is still there as long as there is at least one other reference.
When all references are unset, then the variable is destroyed for good.

2. When you declare a variable as global inside a function, you are actually creating a reference to the global variable.

3, In a foreach loop, you can modify the array elements directly within the loop. To do that, you can use references in the loop header:

$vars = [1, 2, 3];
foreach ($vars as &$value)
{
$value *= 2;
}
unset($value); /* Do this to avoid editing $value by mistake later. */
print_r($vars);

The final print_r() will print 2, 4, 6.

References and performance.

You may be tempted to use references to increase performance, especially when dealing with large variables.
Passing a reference should use less memory than passing a full copy of the variable, right?

However, the PHP documentation clearly states that this is not the case.
So, I did a quick test:

function test($string)
{
/* Do something */
$size = strlen($string);
}

for ($i = 0; $i < 1000; $i++)
{
$longString = str_repeat(rand(), 6000000);
test($longString);
}
$mem = memory_get_peak_usage();
echo round($mem / 1000000);

This script uses about 122MB of memory (if you get a memory error, try reducing the $longString size).
If you change the test() function so it takes a reference instead of a copy, like this:

function test(&$string)

you will see that the memory usage will stay exactly the same.
So, it appears that the documentation is right.

Why do some PHP apps get hacked and others don’t?

Are your apps safe from web attacks?
You are not so sure, are you?
You only hope that your code is secure. And that keeps you constantly worried.
But with the right defense techniques, you can protect your apps from all kinds of attacks.
So you can finally feel safe and stop worrying.

PHP Security Mastery is my personal course that will teach you exactly how to make your code secure.
Click here for the details.

Need help with your PHP code?

If you can't make your PHP code work, you can ask me for a Code Review.
I will verify your code, fix it and make sure it works the way you want.
Click here for the details.