@SignpostMarv Hi, I don't see what effect should this have for analysis. Also see: phpstan/phpstan#1157

@ondrejmirtes one of the intended effects would be to let an analyser flag particular methods as "MUST have no side effects prior to calling", in the above example this would be $anticsrf->removeToken($token);, with the idea being an analyser could throw an error in the if ($request->files->has('thing')) { block when the submitted file gets written to disk, and $db->query('UPDATE tableSETfoo= ? WHEREid= ?', ['bar', $id]); throws an error because it's ambiguous as to whether it has a side effect.

additionally, if the $db->query('UPDATE tableSETfoo= ? WHEREid = ?', ['bar', $id]); example was wrapped inside a transaction, the ambiguous warning could be dropped so long as there's an exception being thrown in // check token somewhere around here, halting if token not valid

since the tl:dr; is regarding operation safety, there's a few patterns in PHP that shouldn't have side effects, and some patterns that should-

• a logger whose AST has no write operations (i.e. to file, to database etc.) can be flagged as "this logger should have side effects but no write operations were detected".
• a psr-7 or symfony/http-foundation request/response filter might be required to have no side effects

for catching developer errors:

• the use of otherwise-valid file write operations that were used for debugging purposes being inadvertently left in place
• a class expecting write side effects being accidentally configured to use a mock class as a dependency that doesn't have side effects (in the logger example, this would be if your app requires a PSR-3 logger, but you've accidentally left it using NullLogger
• an http handler that checks Symfony's Request::$files->has() method or does an Request::$files->get() instanceof \SplFileInfo check but does nothing with the file could be a signal for intent to do something with a file, but draw the developer's attention back to the code if they forgot to do something with the file.