PHP uses zval structure to manage variables. The answer is: 1. zval contains values, types and metadata, with a size of 16 bytes; 2. Only the union and type information need to be updated when the type changes; 3. Complex types refer to structures with reference counts through pointers; 4. Write-on-write copy is used to optimize memory when assigning; 5. References make variables share the same zval; 6. Recycling references are processed by a special garbage collector. This explains the underlying mechanism of PHP variable behavior.

When you write PHP code like:

 $foo = 42;
$foo = "hello";
$foo = [];

It feels natural — after all, PHP is a dynamically typed language. But under the hood, PHP has to manage a lot more complexity than it lets on. Every variable you create isn't just a simple value; it's a sophisticated structure managed by the Zend Engine. That structure is called a zval .

Understanding the zval is key to understanding how PHP handles variables, memory, and type juggling internally.

What Is a zval ?

A zval (short for "Zend value") is the fundamental data structure PHP uses to represent a variable. It doesn't just store the value — it stores the value , the type , memory management info , and other metadata .

As of PHP 7 (and continuing in PHP 8), the zval structure was overhauled for performance and memory efficiency. Here's a simplified version of what it looks like internally:

 struct _zval_struct {
    zend_value value; // The actual value (long, double, string, etc.)
    union {
        uint32_t type_info; // Combined type and flags
    } u1;
    union {
        uint32_t next; // Used in arrays (bucket index)
    } u2;
};

The zend_value union can hold different types:

 typedef union _zend_value {
    zend_long lval; // integer
    double dval; // float
    zend_refcounted *counted; // strings, arrays, objects
    zend_string *str; // string
    zend_array *arr; // array
    zend_object *obj; // object
    zend_resource *res; // resource
    zend_reference *ref; // reference
} zend_value;

So a zval doesn't directly contain a string or array — it contains a pointer to a more complex structure that holds the actual data and metadata like reference counts.

How PHP Handles Type Changes

Let's go back to our example:

 $foo = 42;
$foo = "hello";

In PHP 5, each variable was a separate structure ( zval refcount is_ref ), and changing types required careful cleanup and reallocation.

In PHP 7 , the zval is small (16 bytes on 64-bit systems) and is often allocated inline. When you assign an integer:

 $foo = 42;

The zval stores:

• value.lval = 42
• type_info = IS_LONG

Then you reassign:

 $foo = "hello";

PHP simply:

1. Clears the old type
2. Sets value.str = pointer to zend_string("hello")
3. Updates type_info = IS_STRING

No need to free the entire zval — just update its union and type. This makes variable reuse fast.

Reference Counting and Copy-on-Write

PHP uses reference counting and copy-on-write to save memory.

Example:

 $a = [1, 2, 3];
$b = $a; // Not copied yet — just referenced
$b[] = 4; // Now it's copied!

Here's what happens:

1. $a points to a zend_array with refcount = 1.
2. $b = $a → refcount becomes 2. No data is duplicated.
3. When you modify $b , PHP sees refcount > 1, so it copies the array before changing it (copy-on-write).
4. Refcount for original drops, new array gets refcount = 1.

This is all tracked inside the zend_refcounted header, which is embedded in strings, arrays, objects, etc.

 struct _zend_refcounted_h {
    uint32_t refcount;
    union {
        struct {
            uint32_t type_info;
        } v;
    } u;
};

So when a zval holds a string or array, its value.counted points to a structure that includes this header.

References vs. Variables

You might think & means "make a reference," but internally, it changes how the zval is treated.

 $a = 42;
$b = &$a;
$b = 100;

Now both $a and $b point to the same zval . This is different from normal assignment, which would create a new zval .

Internally, the engine marks the zval as being under reference (via ZEND_TYPE_REFCOUNTED and flags), and disables copy-on-write. Any change affects all referencing variables.

Garbage Collection and Circular References

Reference counting works well — until you have cycles:

 $a = [];
$b = [];
$a['b'] = $b;
$b['a'] = $a;

Now $a and $b reference each other. Even if you unset both, their internal refcounts don't hit zero.

PHP uses a separate garbage collector to detect and clean such cycles. It kicks in when:

• A refcounted variable is unset
• But its refcount doesn't drop to zero
• And it might be part of a cycle

The GC periodically scans for such "possible root cycles" and frees them if confirmed.

Summary of Key Points

• A zval is the core structure representing a PHP variable.
• It stores a union ( zend_value ) and type info in 16 bytes.
• Types can change efficiently — just update the union and type.
• Complex types (string, array) are stored separately with reference counting.
• Copy-on-write delays duplication until necessary.
• References ( & ) make variables share the same zval .
• Circular references are handled by a dedicated garbage collector.

Understanding zval doesn't just satisfy curiosity — it helps explain why certain PHP behaviors exist, like why assigning large arrays isn't expensive until you modify them, or why circular references can cause memory leaks if not handled.

It's the quiet engine behind PHP's ease of use.

Basically, every time you write $var = ... , you're working with a zval — even if you never see it.

The above is the detailed content of The Life of a Variable: PHP's Internal `zval` Structure Explained. For more information, please follow other related articles on the PHP Chinese website!