See <https://datatracker.ietf.org/doc/html/rfc8259#section-2>:

| A JSON text is a serialized value.  Note that certain previous
| specifications of JSON constrained a JSON text to be an object or
| an array.

So the actual behavior of json_decode() looks good to me.

On the same web link that was shared previously:

https://datatracker.ietf.org/doc/html/rfc8259#section-2

A JSON text is a sequence of tokens.  The set of tokens includes six
structural characters, strings, numbers, and three literal names.

----

Wikipedia definition

https://en.wikipedia.org/wiki/JSON

JSON [...] is an open standard file format and data interchange format that uses human-readable text to store and transmit data objects consisting of attribute–value pairs and arrays (or other serializable values) [...]

----

JSON

https://www.json.org/json-en.html

(similar description and detailed chart to explain in detail)

====

To me, passing an integer or a non-formatted JSON string means there's a bug here...

RFC 8259 is a standards document; neither that Wikipedia page nor
that json.org page are.  And besides, adhering Postel's law is
almost never a bad idea.

I am not aiming to start an argument, so I won't post more messages. But I believe some clarification might help. Thanks for your understanding,

----

Won't this behaviour cause, then, a potential error when processing external requests (like API calls) as we won't be able to retrieve a "valid JSON object" that can be converted to an object via json_decode($payload, false) or to an array via json_code($payload, true)?

Even the official PHP website does not have an example for any input payload that is not a JSON-parsed string format, including {} and / or [] and bearing in mind the "key":"value" format.

https://www.php.net/json_decode

If the RFC 8259 is implemented as expected, then it looks like there's a lack of documentation on the PHP website (that leads to confusion) to cover these cases.

Also, the PHP website points that the implemented logic is for RFC 7159 - which is being adjusted by the RFC 8259, so it's unfair point to "another RFC" than the one mentioned on the website.

Extra reading would be appreciated here. Would be possible getting directions on where other examples can be found, please, so it's possible to contrast this specific case?

Isn't this just bog-standard type juggling? Passed an integer argument to a string parameter, it recast the integer as a string?


declare(strict_types=1);

$v = json_decode(123, true);
var_dump($v);
var_dump(json_last_error_msg());

Oh:

"The JSON Data Interchange Syntax"
https://www.ecma-international.org/publications-and-standards/standards/ecma-404/

'Also, the PHP website points that the implemented logic is for RFC 7159 - which is being adjusted by the RFC 8259, so it's unfair point to "another RFC" than the one mentioned on the website.'

The differences between the two are documented in Appendix A of RFC 8259; none of them affect the grammar, and the only one that has any impact on implementation is that JSON must be UTF-8 encoded to be valid. I don't know if this has any impact on PHP's parsing, but I doubt it, as the only legitimate non-ASCII characters would be inside JSON string values.

For further examples of JSON values, see either RFC (they have the same examples). The ECMA published standard describes the grammar in terms of railroad diagrams basically copied from JSON.org. Note that all of them allow a plain number or string as a "JSON value" (as well as objects, arrays, null, true, and false).

'A JSON text is a sequence of tokens.  The set of tokens includes six
structural characters, strings, numbers, and three literal names.'

Yes, and '123' is a number. The next paragraph after the one you quoted says: 

' A JSON text is a serialized value. Note that certain previous
   specifications of JSON constrained a JSON text to be an object or an
   array.  Implementations that generate only objects or arrays where a
   JSON text is called for will be interoperable in the sense that all
   implementations will accept these as conforming JSON texts.'

As noted above, this is just a type juggling. If you want to be sure that passing number fails, declare strict types.

Without that declared, the example

var_dump(json_decode(123, true)); 

is basically just

var_dump(json_decode('123', true));