PHP isset and array_key_exists: Missing Keys Versus Null

A profile update API receives a null nickname, yet the old value remains. An isset condition may be treating an explicit null like an omitted field. Partial updates often require different behavior for these two states.

1. Two different questions

The PHP isset reference defines a check for a declared, non-null variable. For array entries, a missing key and a null value both return false. array_key_exists checks presence even when the associated value is null.

$input = ['nickname' => null];

var_dump(isset($input['nickname']));
var_dump(array_key_exists('nickname', $input));
// bool(false)
// bool(true)

Neither is universally better. Decide whether the application needs field presence or a non-null value.

2. Define the update contract

Suppose omission preserves a nickname, null clears it, and a valid string replaces it. This is the example's contract, not a universal API default.

If the frontend strips all null fields, the backend loses the clearing instruction. Align the contract across forms, payload construction, validation and persistence.

3. Separate presence from validation

function applyNickname(array $profile, array $input): array
{
    if (!array_key_exists('nickname', $input)) {
        return $profile;
    }

    $value = $input['nickname'];
    if ($value !== null && !is_string($value)) {
        throw new InvalidArgumentException('nickname must be string or null');
    }
    if (is_string($value) && trim($value) === '') {
        throw new InvalidArgumentException('nickname must not be blank');
    }

    $profile['nickname'] = $value;
    return $profile;
}

This function returns an array without writing to a database. It accepts null or a string that passes the trim-based nonblank check, but does not trim the stored value. Production applications also need length limits, character rules, authentication and permission checks.

The array parameters make the input assumption explicit. After decoding JSON, validate its structure rather than assuming every valid JSON document represents a valid profile update.

4. Presence does not establish validity

array_key_exists does not validate types, authorization or safety. Do not pass a complete payload to persistence merely because keys exist. This example handles only nickname; an extra role key must not automatically update permissions.

For nested structures, check each level and its parent's type. A key named 'profile.nickname' does not automatically address a nested array entry.

5. Test cases to include

• Missing nickname preserves the existing value.
• Null produces a present nickname key with a null value.
• The string 'Lan' replaces the old value.
• An empty string or ordinary spaces are rejected.
• Numeric zero, false and arrays are rejected under this contract.
• An unauthorized key such as role does not change permissions.

These are expectations to test in your application. Distinguishing omission from explicit null makes partial updates reflect the user's intent instead of silently ignoring it.