From 061f9571d7b0a3a60e0f07f311d44589fe8f65d1 Mon Sep 17 00:00:00 2001
From: staabm <120441+staabm@users.noreply.github.com>
Date: Sat, 30 May 2026 15:17:27 +0000
Subject: [PATCH 01/20] Add `ExprUsedAsStringNode` virtual node emitted for
 expressions used as a string

- Add `PHPStan\Node\ExprUsedAsStringNode` virtual node wrapping the `Expr` whose value is used as a string.
- Add `ExprUsedAsStringVisitor` (rich parser visitor) that marks expressions used in a string context via the `isExprUsedAsString` attribute: echo/print arguments, `(string)` cast operands, string concatenation (`.` and `.=`), string interpolation/heredoc, and dynamic-name expressions (`$foo->{$s}`, `$foo->{$s}()`, `Foo::${$s}`, `Foo::{$s}()`, `Foo::{$s}`, `$$s`).
- Concatenation chains and interpolated strings are reported once for the whole expression instead of once per nested operand, by "claiming" nested concats/interpolation parts, so a rule can interpret the built string as a single unit.
- `NodeScopeResolver::processExprNode()` emits the node for any marked expression; inline HTML emits the node wrapping a synthetic `String_`.
---
 src/Analyser/NodeScopeResolver.php            |   8 ++
 src/Node/ExprUsedAsStringNode.php             |  48 +++++++++
 src/Parser/ExprUsedAsStringVisitor.php        |  92 ++++++++++++++++
 tests/PHPStan/Node/ExprUsedAsStringRule.php   |  44 ++++++++
 .../PHPStan/Node/ExprUsedAsStringRuleTest.php | 101 ++++++++++++++++++
 .../PHPStan/Node/data/expr-used-as-string.php |  52 +++++++++
 6 files changed, 345 insertions(+)
 create mode 100644 src/Node/ExprUsedAsStringNode.php
 create mode 100644 src/Parser/ExprUsedAsStringVisitor.php
 create mode 100644 tests/PHPStan/Node/ExprUsedAsStringRule.php
 create mode 100644 tests/PHPStan/Node/ExprUsedAsStringRuleTest.php
 create mode 100644 tests/PHPStan/Node/data/expr-used-as-string.php

diff --git a/src/Analyser/NodeScopeResolver.php b/src/Analyser/NodeScopeResolver.php
index 41fdf890721..0dd3da7f508 100644
--- a/src/Analyser/NodeScopeResolver.php
+++ b/src/Analyser/NodeScopeResolver.php
@@ -85,6 +85,7 @@
 use PHPStan\Node\Expr\PropertyInitializationExpr;
 use PHPStan\Node\Expr\TypeExpr;
 use PHPStan\Node\Expr\UnsetOffsetExpr;
+use PHPStan\Node\ExprUsedAsStringNode;
 use PHPStan\Node\FinallyExitPointsNode;
 use PHPStan\Node\FunctionCallableNode;
 use PHPStan\Node\FunctionReturnStatementsNode;
@@ -111,6 +112,7 @@
 use PHPStan\Node\VarTagChangedExpressionTypeNode;
 use PHPStan\Parser\ArrowFunctionArgVisitor;
 use PHPStan\Parser\ClosureArgVisitor;
+use PHPStan\Parser\ExprUsedAsStringVisitor;
 use PHPStan\Parser\GotoLabelVisitor;
 use PHPStan\Parser\ImmediatelyInvokedClosureVisitor;
 use PHPStan\Parser\LineAttributesVisitor;
@@ -2471,6 +2473,7 @@ public function leaveNode(Node $node): ?ExistingArrayDimFetch
 			$impurePoints = [
 				new ImpurePoint($scope, $stmt, 'betweenPhpTags', 'output between PHP opening and closing tags', true),
 			];
+			$this->callNodeCallback($nodeCallback, new ExprUsedAsStringNode(new Node\Scalar\String_($stmt->value, $stmt->getAttributes())), $scope, $storage);
 		} elseif ($stmt instanceof Node\Stmt\Block) {
 			$result = $this->processStmtNodesInternal($stmt, $stmt->stmts, $scope, $storage, $nodeCallback, $context);
 			if ($this->polluteScopeWithBlock) {
@@ -2754,6 +2757,11 @@ public function processExprNode(
 
 		$this->callNodeCallbackWithExpression($nodeCallback, $expr, $scope, $storage, $context);
 
+		if ($expr->getAttribute(ExprUsedAsStringVisitor::ATTRIBUTE_NAME) === true) {
+			$usedAsStringScope = $context->isDeep() ? $scope->exitFirstLevelStatements() : $scope;
+			$this->callNodeCallback($nodeCallback, new ExprUsedAsStringNode($expr), $usedAsStringScope, $storage);
+		}
+
 		/** @var ExprHandler<Expr> $exprHandler */
 		foreach ($this->container->getServicesByTag(ExprHandler::EXTENSION_TAG) as $exprHandler) {
 			if (!$exprHandler->supports($expr)) {
diff --git a/src/Node/ExprUsedAsStringNode.php b/src/Node/ExprUsedAsStringNode.php
new file mode 100644
index 00000000000..e2c59bd8c4c
--- /dev/null
+++ b/src/Node/ExprUsedAsStringNode.php
@@ -0,0 +1,48 @@
+<?php declare(strict_types = 1);
+
+namespace PHPStan\Node;
+
+use Override;
+use PhpParser\Node\Expr;
+use PhpParser\NodeAbstract;
+
+/**
+ * Fired for every expression whose value is used as a string: echo and print
+ * arguments, the operand of a (string) cast, string concatenation (`.` and
+ * `.=`), string interpolation/heredoc and inline HTML.
+ *
+ * Concatenations and interpolated strings are reported once for the whole
+ * expression instead of once per nested operand, so a rule can interpret the
+ * built string as a single unit.
+ *
+ * @api
+ */
+final class ExprUsedAsStringNode extends NodeAbstract implements VirtualNode
+{
+
+	public function __construct(private Expr $expr)
+	{
+		parent::__construct($expr->getAttributes());
+	}
+
+	public function getExpr(): Expr
+	{
+		return $this->expr;
+	}
+
+	#[Override]
+	public function getType(): string
+	{
+		return 'PHPStan_Node_ExprUsedAsStringNode';
+	}
+
+	/**
+	 * @return string[]
+	 */
+	#[Override]
+	public function getSubNodeNames(): array
+	{
+		return [];
+	}
+
+}
diff --git a/src/Parser/ExprUsedAsStringVisitor.php b/src/Parser/ExprUsedAsStringVisitor.php
new file mode 100644
index 00000000000..8f077e2e99b
--- /dev/null
+++ b/src/Parser/ExprUsedAsStringVisitor.php
@@ -0,0 +1,92 @@
+<?php declare(strict_types = 1);
+
+namespace PHPStan\Parser;
+
+use Override;
+use PhpParser\Node;
+use PhpParser\Node\Expr;
+use PhpParser\Node\Expr\AssignOp;
+use PhpParser\Node\Expr\BinaryOp\Concat;
+use PhpParser\Node\Expr\Cast;
+use PhpParser\Node\Expr\ClassConstFetch;
+use PhpParser\Node\Expr\MethodCall;
+use PhpParser\Node\Expr\NullsafeMethodCall;
+use PhpParser\Node\Expr\NullsafePropertyFetch;
+use PhpParser\Node\Expr\Print_;
+use PhpParser\Node\Expr\PropertyFetch;
+use PhpParser\Node\Expr\StaticCall;
+use PhpParser\Node\Expr\StaticPropertyFetch;
+use PhpParser\Node\Expr\Variable;
+use PhpParser\Node\Scalar\InterpolatedString;
+use PhpParser\Node\Stmt\Echo_;
+use PhpParser\NodeVisitorAbstract;
+use PHPStan\DependencyInjection\AutowiredService;
+
+/**
+ * Marks expressions whose value is used as a string so that NodeScopeResolver
+ * can emit an {@see \PHPStan\Node\ExprUsedAsStringNode} for them.
+ *
+ * Nested concatenations and interpolation parts are "claimed" by the enclosing
+ * concatenation so that a concatenation chain is reported once for the whole
+ * expression instead of once per operand.
+ */
+#[AutowiredService]
+final class ExprUsedAsStringVisitor extends NodeVisitorAbstract
+{
+
+	public const ATTRIBUTE_NAME = 'isExprUsedAsString';
+
+	private const CLAIMED_ATTRIBUTE_NAME = 'claimedByStringConcat';
+
+	#[Override]
+	public function enterNode(Node $node): ?Node
+	{
+		if ($node instanceof Echo_) {
+			foreach ($node->exprs as $expr) {
+				$expr->setAttribute(self::ATTRIBUTE_NAME, true);
+			}
+		} elseif ($node instanceof Print_) {
+			$node->expr->setAttribute(self::ATTRIBUTE_NAME, true);
+		} elseif ($node instanceof Cast\String_) {
+			$node->expr->setAttribute(self::ATTRIBUTE_NAME, true);
+		} elseif ($node instanceof AssignOp\Concat) {
+			$node->setAttribute(self::ATTRIBUTE_NAME, true);
+			$node->expr->setAttribute(self::CLAIMED_ATTRIBUTE_NAME, true);
+		} elseif ($node instanceof Concat) {
+			if ($node->getAttribute(self::CLAIMED_ATTRIBUTE_NAME) !== true) {
+				$node->setAttribute(self::ATTRIBUTE_NAME, true);
+			}
+			$node->left->setAttribute(self::CLAIMED_ATTRIBUTE_NAME, true);
+			$node->right->setAttribute(self::CLAIMED_ATTRIBUTE_NAME, true);
+		} elseif ($node instanceof InterpolatedString) {
+			if ($node->getAttribute(self::CLAIMED_ATTRIBUTE_NAME) !== true) {
+				$node->setAttribute(self::ATTRIBUTE_NAME, true);
+			}
+			foreach ($node->parts as $part) {
+				if (!$part instanceof Expr) {
+					continue;
+				}
+				$part->setAttribute(self::CLAIMED_ATTRIBUTE_NAME, true);
+			}
+		} elseif (
+			$node instanceof PropertyFetch
+			|| $node instanceof NullsafePropertyFetch
+			|| $node instanceof MethodCall
+			|| $node instanceof NullsafeMethodCall
+			|| $node instanceof StaticPropertyFetch
+			|| $node instanceof StaticCall
+			|| $node instanceof ClassConstFetch
+		) {
+			if ($node->name instanceof Expr) {
+				$node->name->setAttribute(self::ATTRIBUTE_NAME, true);
+			}
+		} elseif ($node instanceof Variable) {
+			if ($node->name instanceof Expr) {
+				$node->name->setAttribute(self::ATTRIBUTE_NAME, true);
+			}
+		}
+
+		return null;
+	}
+
+}
diff --git a/tests/PHPStan/Node/ExprUsedAsStringRule.php b/tests/PHPStan/Node/ExprUsedAsStringRule.php
new file mode 100644
index 00000000000..f58fac8bbcc
--- /dev/null
+++ b/tests/PHPStan/Node/ExprUsedAsStringRule.php
@@ -0,0 +1,44 @@
+<?php declare(strict_types = 1);
+
+namespace PHPStan\Node;
+
+use PhpParser\Node;
+use PhpParser\PrettyPrinter\Standard;
+use PHPStan\Analyser\Scope;
+use PHPStan\Rules\Rule;
+use PHPStan\Rules\RuleErrorBuilder;
+use PHPStan\Type\VerbosityLevel;
+use function sprintf;
+
+/**
+ * @implements Rule<ExprUsedAsStringNode>
+ */
+class ExprUsedAsStringRule implements Rule
+{
+
+	private Standard $printer;
+
+	public function __construct()
+	{
+		$this->printer = new Standard();
+	}
+
+	public function getNodeType(): string
+	{
+		return ExprUsedAsStringNode::class;
+	}
+
+	public function processNode(Node $node, Scope $scope): array
+	{
+		$expr = $node->getExpr();
+
+		return [
+			RuleErrorBuilder::message(sprintf(
+				'Used as string: %s (%s)',
+				$this->printer->prettyPrintExpr($expr),
+				$scope->getType($expr)->describe(VerbosityLevel::precise()),
+			))->identifier('tests.exprUsedAsString')->build(),
+		];
+	}
+
+}
diff --git a/tests/PHPStan/Node/ExprUsedAsStringRuleTest.php b/tests/PHPStan/Node/ExprUsedAsStringRuleTest.php
new file mode 100644
index 00000000000..bbd6b5454ba
--- /dev/null
+++ b/tests/PHPStan/Node/ExprUsedAsStringRuleTest.php
@@ -0,0 +1,101 @@
+<?php declare(strict_types = 1);
+
+namespace PHPStan\Node;
+
+use PHPStan\Rules\Rule;
+use PHPStan\Testing\RuleTestCase;
+
+/**
+ * @extends RuleTestCase<ExprUsedAsStringRule>
+ */
+class ExprUsedAsStringRuleTest extends RuleTestCase
+{
+
+	protected function getRule(): Rule
+	{
+		return new ExprUsedAsStringRule();
+	}
+
+	public function testRule(): void
+	{
+		$this->analyse([__DIR__ . '/data/expr-used-as-string.php'], [
+			[
+				"Used as string: 'plain' ('plain')",
+				7,
+			],
+			[
+				'Used as string: \'<script src="\' . $s . \'" nonce=123></script>\' (non-falsy-string)',
+				8,
+			],
+			[
+				'Used as string: "<script src=\"{$s}\" nonce=123></script>" (non-falsy-string)',
+				9,
+			],
+			[
+				"Used as string: 'printed' ('printed')",
+				10,
+			],
+			[
+				"Used as string: 'a' . \$s . 'b' (non-falsy-string)",
+				11,
+			],
+			[
+				'Used as string: $s (string)',
+				12,
+			],
+			[
+				'Used as string: $s .= "appended" (non-falsy-string)',
+				13,
+			],
+			[
+				'Used as string: $s .= \' src="\' . $s . \'"\' (non-falsy-string)',
+				14,
+			],
+			[
+				"Used as string: \$s . 'plain' (non-falsy-string)",
+				15,
+			],
+			[
+				'Used as string: "interp {$s} end" (non-falsy-string)',
+				16,
+			],
+			[
+				"Used as string: '<script src=\"my.js\" nonce=123></script>\n' (\"<script src=\\\"my.js\\\" nonce=123></script>\\n\")",
+				18,
+			],
+			[
+				"Used as string: \$html .= <<<EOS\n<script nonce=\"{\$nonce}\" type=\"module\">\nEOS ('<script nonce=\"123\" type=\"module\">')",
+				26,
+			],
+			[
+				'Used as string: $h->{$name} (mixed)',
+				46,
+			],
+			[
+				'Used as string: $name (string)',
+				46,
+			],
+			[
+				'Used as string: $name (string)',
+				47,
+			],
+			[
+				'Used as string: $name (string)',
+				48,
+			],
+			[
+				'Used as string: $name (string)',
+				49,
+			],
+			[
+				'Used as string: $name (string)',
+				50,
+			],
+			[
+				'Used as string: $name (string)',
+				51,
+			],
+		]);
+	}
+
+}
diff --git a/tests/PHPStan/Node/data/expr-used-as-string.php b/tests/PHPStan/Node/data/expr-used-as-string.php
new file mode 100644
index 00000000000..6684d11b81b
--- /dev/null
+++ b/tests/PHPStan/Node/data/expr-used-as-string.php
@@ -0,0 +1,52 @@
+<?php declare(strict_types = 1);
+
+namespace ExprUsedAsString;
+
+function doFoo(string $s)
+{
+	echo 'plain';
+	echo '<script src="' . $s . '" nonce=123></script>';
+	echo "<script src=\"$s\" nonce=123></script>";
+	print 'printed';
+	print 'a' . $s . 'b';
+	$x = (string) $s;
+	$s .= "appended";
+	$s .= ' src="' . $s . '"';
+	$t = $s . 'plain';
+	$u = "interp $s end";
+	?>
+<script src="my.js" nonce=123></script>
+<?php
+}
+
+function doMore(): void
+{
+	$nonce = '123';
+	$html = '';
+	$html .= <<<EOS
+<script nonce="{$nonce}" type="module">
+EOS;
+}
+
+class Holder
+{
+
+	public string $prop = '';
+
+	public function method(): void
+	{
+	}
+
+	public const CONST_NAME = 1;
+
+}
+
+function dynamicNames(Holder $h, string $name): void
+{
+	echo $h->{$name};
+	$h->{$name}();
+	$$name = 1;
+	$x = Holder::${$name};
+	Holder::{$name}();
+	$y = $h::{$name};
+}

From 2d6c39e32d87278025c222d2e98dd3e131910b07 Mon Sep 17 00:00:00 2001
From: Markus Staab <maggus.staab@googlemail.com>
Date: Sat, 30 May 2026 18:02:02 +0200
Subject: [PATCH 02/20] Update expr-used-as-string.php

---
 tests/PHPStan/Node/data/expr-used-as-string.php | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/tests/PHPStan/Node/data/expr-used-as-string.php b/tests/PHPStan/Node/data/expr-used-as-string.php
index 6684d11b81b..d4a13968513 100644
--- a/tests/PHPStan/Node/data/expr-used-as-string.php
+++ b/tests/PHPStan/Node/data/expr-used-as-string.php
@@ -1,4 +1,6 @@
-<?php declare(strict_types = 1);
+<?php // lint >= 8.3
+
+declare(strict_types = 1);
 
 namespace ExprUsedAsString;
 

From d4266ee0a830c6f80d8bf524a5dd36632e795076 Mon Sep 17 00:00:00 2001
From: phpstan-bot <ondrej+phpstanbot@mirtes.cz>
Date: Sun, 31 May 2026 07:17:05 +0000
Subject: [PATCH 03/20] Preserve original InlineHTML statement in
 ExprUsedAsStringNode

Allow the node to wrap any NodeAbstract (not just Expr) so the original
InlineHTML statement is preserved instead of being replaced by a synthetic
String_. Also fix the test expectation line numbers that drifted after the
data file gained a `// lint >= 8.3` header.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 src/Analyser/NodeScopeResolver.php            |  2 +-
 src/Node/ExprUsedAsStringNode.php             | 12 +++---
 tests/PHPStan/Node/ExprUsedAsStringRule.php   | 21 ++++++++--
 .../PHPStan/Node/ExprUsedAsStringRuleTest.php | 38 +++++++++----------
 4 files changed, 45 insertions(+), 28 deletions(-)

diff --git a/src/Analyser/NodeScopeResolver.php b/src/Analyser/NodeScopeResolver.php
index 0dd3da7f508..b134dbf34de 100644
--- a/src/Analyser/NodeScopeResolver.php
+++ b/src/Analyser/NodeScopeResolver.php
@@ -2473,7 +2473,7 @@ public function leaveNode(Node $node): ?ExistingArrayDimFetch
 			$impurePoints = [
 				new ImpurePoint($scope, $stmt, 'betweenPhpTags', 'output between PHP opening and closing tags', true),
 			];
-			$this->callNodeCallback($nodeCallback, new ExprUsedAsStringNode(new Node\Scalar\String_($stmt->value, $stmt->getAttributes())), $scope, $storage);
+			$this->callNodeCallback($nodeCallback, new ExprUsedAsStringNode($stmt), $scope, $storage);
 		} elseif ($stmt instanceof Node\Stmt\Block) {
 			$result = $this->processStmtNodesInternal($stmt, $stmt->stmts, $scope, $storage, $nodeCallback, $context);
 			if ($this->polluteScopeWithBlock) {
diff --git a/src/Node/ExprUsedAsStringNode.php b/src/Node/ExprUsedAsStringNode.php
index e2c59bd8c4c..f04ce537220 100644
--- a/src/Node/ExprUsedAsStringNode.php
+++ b/src/Node/ExprUsedAsStringNode.php
@@ -3,7 +3,6 @@
 namespace PHPStan\Node;
 
 use Override;
-use PhpParser\Node\Expr;
 use PhpParser\NodeAbstract;
 
 /**
@@ -15,19 +14,22 @@
  * expression instead of once per nested operand, so a rule can interpret the
  * built string as a single unit.
  *
+ * The wrapped node is usually an expression, but for inline HTML it is the
+ * original {@see \PhpParser\Node\Stmt\InlineHTML} statement.
+ *
  * @api
  */
 final class ExprUsedAsStringNode extends NodeAbstract implements VirtualNode
 {
 
-	public function __construct(private Expr $expr)
+	public function __construct(private NodeAbstract $node)
 	{
-		parent::__construct($expr->getAttributes());
+		parent::__construct($node->getAttributes());
 	}
 
-	public function getExpr(): Expr
+	public function getNode(): NodeAbstract
 	{
-		return $this->expr;
+		return $this->node;
 	}
 
 	#[Override]
diff --git a/tests/PHPStan/Node/ExprUsedAsStringRule.php b/tests/PHPStan/Node/ExprUsedAsStringRule.php
index f58fac8bbcc..cd974fb53e2 100644
--- a/tests/PHPStan/Node/ExprUsedAsStringRule.php
+++ b/tests/PHPStan/Node/ExprUsedAsStringRule.php
@@ -3,10 +3,15 @@
 namespace PHPStan\Node;
 
 use PhpParser\Node;
+use PhpParser\Node\Expr;
+use PhpParser\Node\Scalar\String_;
+use PhpParser\Node\Stmt\InlineHTML;
 use PhpParser\PrettyPrinter\Standard;
 use PHPStan\Analyser\Scope;
 use PHPStan\Rules\Rule;
 use PHPStan\Rules\RuleErrorBuilder;
+use PHPStan\ShouldNotHappenException;
+use PHPStan\Type\Constant\ConstantStringType;
 use PHPStan\Type\VerbosityLevel;
 use function sprintf;
 
@@ -30,13 +35,23 @@ public function getNodeType(): string
 
 	public function processNode(Node $node, Scope $scope): array
 	{
-		$expr = $node->getExpr();
+		$inner = $node->getNode();
+
+		if ($inner instanceof Expr) {
+			$printed = $this->printer->prettyPrintExpr($inner);
+			$type = $scope->getType($inner)->describe(VerbosityLevel::precise());
+		} elseif ($inner instanceof InlineHTML) {
+			$printed = $this->printer->prettyPrintExpr(new String_($inner->value, $inner->getAttributes()));
+			$type = (new ConstantStringType($inner->value))->describe(VerbosityLevel::precise());
+		} else {
+			throw new ShouldNotHappenException();
+		}
 
 		return [
 			RuleErrorBuilder::message(sprintf(
 				'Used as string: %s (%s)',
-				$this->printer->prettyPrintExpr($expr),
-				$scope->getType($expr)->describe(VerbosityLevel::precise()),
+				$printed,
+				$type,
 			))->identifier('tests.exprUsedAsString')->build(),
 		];
 	}
diff --git a/tests/PHPStan/Node/ExprUsedAsStringRuleTest.php b/tests/PHPStan/Node/ExprUsedAsStringRuleTest.php
index bbd6b5454ba..120c62d6fb0 100644
--- a/tests/PHPStan/Node/ExprUsedAsStringRuleTest.php
+++ b/tests/PHPStan/Node/ExprUsedAsStringRuleTest.php
@@ -21,79 +21,79 @@ public function testRule(): void
 		$this->analyse([__DIR__ . '/data/expr-used-as-string.php'], [
 			[
 				"Used as string: 'plain' ('plain')",
-				7,
+				9,
 			],
 			[
 				'Used as string: \'<script src="\' . $s . \'" nonce=123></script>\' (non-falsy-string)',
-				8,
+				10,
 			],
 			[
 				'Used as string: "<script src=\"{$s}\" nonce=123></script>" (non-falsy-string)',
-				9,
+				11,
 			],
 			[
 				"Used as string: 'printed' ('printed')",
-				10,
+				12,
 			],
 			[
 				"Used as string: 'a' . \$s . 'b' (non-falsy-string)",
-				11,
+				13,
 			],
 			[
 				'Used as string: $s (string)',
-				12,
+				14,
 			],
 			[
 				'Used as string: $s .= "appended" (non-falsy-string)',
-				13,
+				15,
 			],
 			[
 				'Used as string: $s .= \' src="\' . $s . \'"\' (non-falsy-string)',
-				14,
+				16,
 			],
 			[
 				"Used as string: \$s . 'plain' (non-falsy-string)",
-				15,
+				17,
 			],
 			[
 				'Used as string: "interp {$s} end" (non-falsy-string)',
-				16,
+				18,
 			],
 			[
 				"Used as string: '<script src=\"my.js\" nonce=123></script>\n' (\"<script src=\\\"my.js\\\" nonce=123></script>\\n\")",
-				18,
+				20,
 			],
 			[
 				"Used as string: \$html .= <<<EOS\n<script nonce=\"{\$nonce}\" type=\"module\">\nEOS ('<script nonce=\"123\" type=\"module\">')",
-				26,
+				28,
 			],
 			[
 				'Used as string: $h->{$name} (mixed)',
-				46,
+				48,
 			],
 			[
 				'Used as string: $name (string)',
-				46,
+				48,
 			],
 			[
 				'Used as string: $name (string)',
-				47,
+				49,
 			],
 			[
 				'Used as string: $name (string)',
-				48,
+				50,
 			],
 			[
 				'Used as string: $name (string)',
-				49,
+				51,
 			],
 			[
 				'Used as string: $name (string)',
-				50,
+				52,
 			],
 			[
 				'Used as string: $name (string)',
-				51,
+				53,
 			],
 		]);
 	}

From 2bd9c598f1b2a28fb78729312b884cc82a0212c4 Mon Sep 17 00:00:00 2001
From: phpstan-bot <ondrej+phpstanbot@mirtes.cz>
Date: Sun, 31 May 2026 07:18:35 +0000
Subject: [PATCH 04/20] Rename ExprUsedAsStringNode to UsedAsStringNode

The node can now wrap an InlineHTML statement in addition to expressions,
so the "Expr" prefix is no longer accurate. Rename the node and its test
artifacts accordingly.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 src/Analyser/NodeScopeResolver.php                        | 6 +++---
 .../{ExprUsedAsStringNode.php => UsedAsStringNode.php}    | 4 ++--
 src/Parser/ExprUsedAsStringVisitor.php                    | 2 +-
 .../{ExprUsedAsStringRule.php => UsedAsStringRule.php}    | 8 ++++----
 ...rUsedAsStringRuleTest.php => UsedAsStringRuleTest.php} | 8 ++++----
 .../data/{expr-used-as-string.php => used-as-string.php}  | 0
 6 files changed, 14 insertions(+), 14 deletions(-)
 rename src/Node/{ExprUsedAsStringNode.php => UsedAsStringNode.php} (89%)
 rename tests/PHPStan/Node/{ExprUsedAsStringRule.php => UsedAsStringRule.php} (87%)
 rename tests/PHPStan/Node/{ExprUsedAsStringRuleTest.php => UsedAsStringRuleTest.php} (89%)
 rename tests/PHPStan/Node/data/{expr-used-as-string.php => used-as-string.php} (100%)

diff --git a/src/Analyser/NodeScopeResolver.php b/src/Analyser/NodeScopeResolver.php
index b134dbf34de..1483fd5b7c9 100644
--- a/src/Analyser/NodeScopeResolver.php
+++ b/src/Analyser/NodeScopeResolver.php
@@ -85,7 +85,6 @@
 use PHPStan\Node\Expr\PropertyInitializationExpr;
 use PHPStan\Node\Expr\TypeExpr;
 use PHPStan\Node\Expr\UnsetOffsetExpr;
-use PHPStan\Node\ExprUsedAsStringNode;
 use PHPStan\Node\FinallyExitPointsNode;
 use PHPStan\Node\FunctionCallableNode;
 use PHPStan\Node\FunctionReturnStatementsNode;
@@ -108,6 +107,7 @@
 use PHPStan\Node\ReturnStatement;
 use PHPStan\Node\StaticMethodCallableNode;
 use PHPStan\Node\UnreachableStatementNode;
+use PHPStan\Node\UsedAsStringNode;
 use PHPStan\Node\VariableAssignNode;
 use PHPStan\Node\VarTagChangedExpressionTypeNode;
 use PHPStan\Parser\ArrowFunctionArgVisitor;
@@ -2473,7 +2473,7 @@ public function leaveNode(Node $node): ?ExistingArrayDimFetch
 			$impurePoints = [
 				new ImpurePoint($scope, $stmt, 'betweenPhpTags', 'output between PHP opening and closing tags', true),
 			];
-			$this->callNodeCallback($nodeCallback, new ExprUsedAsStringNode($stmt), $scope, $storage);
+			$this->callNodeCallback($nodeCallback, new UsedAsStringNode($stmt), $scope, $storage);
 		} elseif ($stmt instanceof Node\Stmt\Block) {
 			$result = $this->processStmtNodesInternal($stmt, $stmt->stmts, $scope, $storage, $nodeCallback, $context);
 			if ($this->polluteScopeWithBlock) {
@@ -2759,7 +2759,7 @@ public function processExprNode(
 
 		if ($expr->getAttribute(ExprUsedAsStringVisitor::ATTRIBUTE_NAME) === true) {
 			$usedAsStringScope = $context->isDeep() ? $scope->exitFirstLevelStatements() : $scope;
-			$this->callNodeCallback($nodeCallback, new ExprUsedAsStringNode($expr), $usedAsStringScope, $storage);
+			$this->callNodeCallback($nodeCallback, new UsedAsStringNode($expr), $usedAsStringScope, $storage);
 		}
 
 		/** @var ExprHandler<Expr> $exprHandler */
diff --git a/src/Node/ExprUsedAsStringNode.php b/src/Node/UsedAsStringNode.php
similarity index 89%
rename from src/Node/ExprUsedAsStringNode.php
rename to src/Node/UsedAsStringNode.php
index f04ce537220..bbc6be98e3c 100644
--- a/src/Node/ExprUsedAsStringNode.php
+++ b/src/Node/UsedAsStringNode.php
@@ -19,7 +19,7 @@
  *
  * @api
  */
-final class ExprUsedAsStringNode extends NodeAbstract implements VirtualNode
+final class UsedAsStringNode extends NodeAbstract implements VirtualNode
 {
 
 	public function __construct(private NodeAbstract $node)
@@ -35,7 +35,7 @@ public function getNode(): NodeAbstract
 	#[Override]
 	public function getType(): string
 	{
-		return 'PHPStan_Node_ExprUsedAsStringNode';
+		return 'PHPStan_Node_UsedAsStringNode';
 	}
 
 	/**
diff --git a/src/Parser/ExprUsedAsStringVisitor.php b/src/Parser/ExprUsedAsStringVisitor.php
index 8f077e2e99b..66866dbb3b3 100644
--- a/src/Parser/ExprUsedAsStringVisitor.php
+++ b/src/Parser/ExprUsedAsStringVisitor.php
@@ -24,7 +24,7 @@
 
 /**
  * Marks expressions whose value is used as a string so that NodeScopeResolver
- * can emit an {@see \PHPStan\Node\ExprUsedAsStringNode} for them.
+ * can emit an {@see \PHPStan\Node\UsedAsStringNode} for them.
  *
  * Nested concatenations and interpolation parts are "claimed" by the enclosing
  * concatenation so that a concatenation chain is reported once for the whole
diff --git a/tests/PHPStan/Node/ExprUsedAsStringRule.php b/tests/PHPStan/Node/UsedAsStringRule.php
similarity index 87%
rename from tests/PHPStan/Node/ExprUsedAsStringRule.php
rename to tests/PHPStan/Node/UsedAsStringRule.php
index cd974fb53e2..c491e709676 100644
--- a/tests/PHPStan/Node/ExprUsedAsStringRule.php
+++ b/tests/PHPStan/Node/UsedAsStringRule.php
@@ -16,9 +16,9 @@
 use function sprintf;
 
 /**
- * @implements Rule<ExprUsedAsStringNode>
+ * @implements Rule<UsedAsStringNode>
  */
-class ExprUsedAsStringRule implements Rule
+class UsedAsStringRule implements Rule
 {
 
 	private Standard $printer;
@@ -30,7 +30,7 @@ public function __construct()
 
 	public function getNodeType(): string
 	{
-		return ExprUsedAsStringNode::class;
+		return UsedAsStringNode::class;
 	}
 
 	public function processNode(Node $node, Scope $scope): array
@@ -52,7 +52,7 @@ public function processNode(Node $node, Scope $scope): array
 				'Used as string: %s (%s)',
 				$printed,
 				$type,
-			))->identifier('tests.exprUsedAsString')->build(),
+			))->identifier('tests.usedAsString')->build(),
 		];
 	}
 
diff --git a/tests/PHPStan/Node/ExprUsedAsStringRuleTest.php b/tests/PHPStan/Node/UsedAsStringRuleTest.php
similarity index 89%
rename from tests/PHPStan/Node/ExprUsedAsStringRuleTest.php
rename to tests/PHPStan/Node/UsedAsStringRuleTest.php
index 120c62d6fb0..74491b7f7fd 100644
--- a/tests/PHPStan/Node/ExprUsedAsStringRuleTest.php
+++ b/tests/PHPStan/Node/UsedAsStringRuleTest.php
@@ -6,19 +6,19 @@
 use PHPStan\Testing\RuleTestCase;
 
 /**
- * @extends RuleTestCase<ExprUsedAsStringRule>
+ * @extends RuleTestCase<UsedAsStringRule>
  */
-class ExprUsedAsStringRuleTest extends RuleTestCase
+class UsedAsStringRuleTest extends RuleTestCase
 {
 
 	protected function getRule(): Rule
 	{
-		return new ExprUsedAsStringRule();
+		return new UsedAsStringRule();
 	}
 
 	public function testRule(): void
 	{
-		$this->analyse([__DIR__ . '/data/expr-used-as-string.php'], [
+		$this->analyse([__DIR__ . '/data/used-as-string.php'], [
 			[
 				"Used as string: 'plain' ('plain')",
 				9,
diff --git a/tests/PHPStan/Node/data/expr-used-as-string.php b/tests/PHPStan/Node/data/used-as-string.php
similarity index 100%
rename from tests/PHPStan/Node/data/expr-used-as-string.php
rename to tests/PHPStan/Node/data/used-as-string.php

From f3273cf4673cb7f81b4a053558e961e6bad0e169 Mon Sep 17 00:00:00 2001
From: phpstan-bot <ondrej+phpstanbot@mirtes.cz>
Date: Sun, 31 May 2026 07:38:46 +0000
Subject: [PATCH 05/20] Update UsedAsStringNode doc to reflect NodeAbstract
 wrapping

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 src/Node/UsedAsStringNode.php | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/src/Node/UsedAsStringNode.php b/src/Node/UsedAsStringNode.php
index bbc6be98e3c..0c698ca4f54 100644
--- a/src/Node/UsedAsStringNode.php
+++ b/src/Node/UsedAsStringNode.php
@@ -6,16 +6,20 @@
 use PhpParser\NodeAbstract;
 
 /**
- * Fired for every expression whose value is used as a string: echo and print
+ * Fired for every node whose value is used as a string: echo and print
  * arguments, the operand of a (string) cast, string concatenation (`.` and
- * `.=`), string interpolation/heredoc and inline HTML.
+ * `.=`), string interpolation/heredoc, inline HTML and the dynamic name of a
+ * property/method/constant access or a variable variable (`$foo->{$s}`, `$$s`,
+ * etc.).
  *
  * Concatenations and interpolated strings are reported once for the whole
  * expression instead of once per nested operand, so a rule can interpret the
  * built string as a single unit.
  *
  * The wrapped node is usually an expression, but for inline HTML it is the
- * original {@see \PhpParser\Node\Stmt\InlineHTML} statement.
+ * original {@see \PhpParser\Node\Stmt\InlineHTML} statement, hence
+ * {@see getNode()} returns a {@see NodeAbstract} rather than an
+ * {@see \PhpParser\Node\Expr}.
  *
  * @api
  */

From 8cabc7bd2c1b48029bda8ef05178d1d3be1e1e8d Mon Sep 17 00:00:00 2001
From: phpstan-bot <ondrej+phpstanbot@mirtes.cz>
Date: Sun, 31 May 2026 08:05:56 +0000
Subject: [PATCH 06/20] Emit UsedAsStringNode for values stored into a string
 slot

Extend the node beyond coercion contexts to cover values that flow into a
string slot, as requested in the review and the original issue:

- a value assigned to a variable when that value is a string,
- a value assigned to a native `string`-typed property (instance or static),
- the default value of a native `string`-typed property.

The slot type is resolved from reflection for properties, so assigning to a
non-`string` property does not fire. When the assigned value already produces
its own node (concatenation, interpolation or `(string)` cast) the enclosing
assignment does not report it a second time.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 src/Analyser/ExprHandler/AssignHandler.php  | 72 +++++++++++++++++++++
 src/Analyser/NodeScopeResolver.php          |  8 +++
 src/Node/UsedAsStringNode.php               | 19 ++++--
 src/Parser/ExprUsedAsStringVisitor.php      | 16 +++++
 tests/PHPStan/Node/UsedAsStringRuleTest.php | 38 +++++++++--
 tests/PHPStan/Node/data/used-as-string.php  | 11 ++++
 6 files changed, 151 insertions(+), 13 deletions(-)

diff --git a/src/Analyser/ExprHandler/AssignHandler.php b/src/Analyser/ExprHandler/AssignHandler.php
index 5a9ec882334..ee907a192cb 100644
--- a/src/Analyser/ExprHandler/AssignHandler.php
+++ b/src/Analyser/ExprHandler/AssignHandler.php
@@ -47,8 +47,10 @@
 use PHPStan\Node\IssetExpr;
 use PHPStan\Node\Printer\ExprPrinter;
 use PHPStan\Node\PropertyAssignNode;
+use PHPStan\Node\UsedAsStringNode;
 use PHPStan\Node\VariableAssignNode;
 use PHPStan\Node\VirtualNode;
+use PHPStan\Parser\ExprUsedAsStringVisitor;
 use PHPStan\Php\PhpVersion;
 use PHPStan\ShouldNotHappenException;
 use PHPStan\TrinaryLogic;
@@ -162,6 +164,10 @@ static function (MutatingScope $scope) use ($stmt, $expr, $nodeCallback, $contex
 		);
 		$scope = $result->getScope();
 
+		if ($expr instanceof Assign) {
+			$this->emitUsedAsStringNode($nodeScopeResolver, $scope, $storage, $expr, $nodeCallback);
+		}
+
 		if (
 			$expr instanceof AssignRef
 			&& $expr->var instanceof Variable
@@ -209,6 +215,72 @@ static function (MutatingScope $scope) use ($stmt, $expr, $nodeCallback, $contex
 		);
 	}
 
+	/**
+	 * Emits a {@see UsedAsStringNode} for the assigned value when it lands in a
+	 * string slot: a string-valued variable assignment or an assignment to a
+	 * native `string`-typed property.
+	 *
+	 * @param callable(Node $node, Scope $scope): void $nodeCallback
+	 */
+	private function emitUsedAsStringNode(
+		NodeScopeResolver $nodeScopeResolver,
+		MutatingScope $scope,
+		ExpressionResultStorage $storage,
+		Assign $expr,
+		callable $nodeCallback,
+	): void
+	{
+		if (ExprUsedAsStringVisitor::isAlreadyUsedAsStringSite($expr->expr)) {
+			return;
+		}
+
+		$slotType = $this->getAssignTargetStringSlotType($scope, $expr->var, $expr->expr);
+		if ($slotType === null || !$slotType->isString()->yes()) {
+			return;
+		}
+
+		$nodeScopeResolver->callNodeCallback($nodeCallback, new UsedAsStringNode($expr->expr), $scope, $storage);
+	}
+
+	private function getAssignTargetStringSlotType(MutatingScope $scope, Expr $var, Expr $assignedExpr): ?Type
+	{
+		if ($var instanceof Variable) {
+			return $scope->getType($assignedExpr);
+		}
+
+		if ($var instanceof PropertyFetch) {
+			if (!$var->name instanceof Node\Identifier) {
+				return null;
+			}
+			$propertyName = $var->name->toString();
+			$holderType = $scope->getType($var->var);
+			if (!$holderType->hasInstanceProperty($propertyName)->yes()) {
+				return null;
+			}
+			$property = $holderType->getInstanceProperty($propertyName, $scope);
+
+			return $property->hasNativeType() ? $property->getNativeType() : null;
+		}
+
+		if ($var instanceof StaticPropertyFetch) {
+			if (!$var->name instanceof Node\VarLikeIdentifier) {
+				return null;
+			}
+			$propertyName = $var->name->toString();
+			$holderType = $var->class instanceof Name
+				? $scope->resolveTypeByName($var->class)
+				: $scope->getType($var->class);
+			$property = $scope->getStaticPropertyReflection($holderType, $propertyName);
+			if ($property === null || !$property->hasNativeType()) {
+				return null;
+			}
+
+			return $property->getNativeType();
+		}
+
+		return null;
+	}
+
 	/**
 	 * @param callable(Node $node, Scope $scope): void $nodeCallback
 	 * @param Closure(MutatingScope $scope): ExpressionResult $processExprCallback
diff --git a/src/Analyser/NodeScopeResolver.php b/src/Analyser/NodeScopeResolver.php
index 1483fd5b7c9..87552386bd2 100644
--- a/src/Analyser/NodeScopeResolver.php
+++ b/src/Analyser/NodeScopeResolver.php
@@ -1244,6 +1244,14 @@ public function processStmtNode(
 				$this->callNodeCallback($nodeCallback, $prop, $scope, $storage);
 				if ($prop->default !== null) {
 					$this->processExprNode($stmt, $prop->default, $scope, $storage, $nodeCallback, ExpressionContext::createDeep());
+
+					if (
+						$nativePropertyType !== null
+						&& $nativePropertyType->isString()->yes()
+						&& !ExprUsedAsStringVisitor::isAlreadyUsedAsStringSite($prop->default)
+					) {
+						$this->callNodeCallback($nodeCallback, new UsedAsStringNode($prop->default), $scope, $storage);
+					}
 				}
 
 				if (!$scope->isInClass()) {
diff --git a/src/Node/UsedAsStringNode.php b/src/Node/UsedAsStringNode.php
index 0c698ca4f54..dcd5a5ca349 100644
--- a/src/Node/UsedAsStringNode.php
+++ b/src/Node/UsedAsStringNode.php
@@ -6,15 +6,22 @@
 use PhpParser\NodeAbstract;
 
 /**
- * Fired for every node whose value is used as a string: echo and print
- * arguments, the operand of a (string) cast, string concatenation (`.` and
- * `.=`), string interpolation/heredoc, inline HTML and the dynamic name of a
- * property/method/constant access or a variable variable (`$foo->{$s}`, `$$s`,
- * etc.).
+ * Fired for every node whose value is used as a string. This covers both
+ * values coerced to string and values stored into a string slot:
+ *
+ * - echo and print arguments, the operand of a (string) cast,
+ * - string concatenation (`.` and `.=`), string interpolation/heredoc,
+ * - inline HTML,
+ * - the dynamic name of a property/method/constant access or a variable
+ *   variable (`$foo->{$s}`, `$$s`, etc.),
+ * - the value assigned to a variable when that value is a string,
+ * - the value assigned to (or the default of) a native `string`-typed property.
  *
  * Concatenations and interpolated strings are reported once for the whole
  * expression instead of once per nested operand, so a rule can interpret the
- * built string as a single unit.
+ * built string as a single unit. When the assigned value already produces its
+ * own node (a concatenation, interpolation or `(string)` cast), the enclosing
+ * assignment does not report it a second time.
  *
  * The wrapped node is usually an expression, but for inline HTML it is the
  * original {@see \PhpParser\Node\Stmt\InlineHTML} statement, hence
diff --git a/src/Parser/ExprUsedAsStringVisitor.php b/src/Parser/ExprUsedAsStringVisitor.php
index 66866dbb3b3..1d68223d25f 100644
--- a/src/Parser/ExprUsedAsStringVisitor.php
+++ b/src/Parser/ExprUsedAsStringVisitor.php
@@ -5,7 +5,9 @@
 use Override;
 use PhpParser\Node;
 use PhpParser\Node\Expr;
+use PhpParser\Node\Expr\Assign;
 use PhpParser\Node\Expr\AssignOp;
+use PhpParser\Node\Expr\AssignRef;
 use PhpParser\Node\Expr\BinaryOp\Concat;
 use PhpParser\Node\Expr\Cast;
 use PhpParser\Node\Expr\ClassConstFetch;
@@ -89,4 +91,18 @@ public function enterNode(Node $node): ?Node
 		return null;
 	}
 
+	/**
+	 * Whether the expression already produces its own UsedAsStringNode, so that an
+	 * enclosing context (e.g. a string-typed assignment target) must not report it a
+	 * second time. True for marked nodes (concatenation, interpolation, echo/print
+	 * argument, …), the operand-emitting `(string)` cast and nested assignments.
+	 */
+	public static function isAlreadyUsedAsStringSite(Expr $expr): bool
+	{
+		return $expr->getAttribute(self::ATTRIBUTE_NAME) === true
+			|| $expr instanceof Cast\String_
+			|| $expr instanceof Assign
+			|| $expr instanceof AssignRef;
+	}
+
 }
diff --git a/tests/PHPStan/Node/UsedAsStringRuleTest.php b/tests/PHPStan/Node/UsedAsStringRuleTest.php
index 74491b7f7fd..cb36dc47a0e 100644
--- a/tests/PHPStan/Node/UsedAsStringRuleTest.php
+++ b/tests/PHPStan/Node/UsedAsStringRuleTest.php
@@ -63,37 +63,61 @@ public function testRule(): void
 				"Used as string: '<script src=\"my.js\" nonce=123></script>\n' (\"<script src=\\\"my.js\\\" nonce=123></script>\\n\")",
 				20,
 			],
+			[
+				"Used as string: '123' ('123')",
+				26,
+			],
+			[
+				"Used as string: '' ('')",
+				27,
+			],
 			[
 				"Used as string: \$html .= <<<EOS\n<script nonce=\"{\$nonce}\" type=\"module\">\nEOS ('<script nonce=\"123\" type=\"module\">')",
 				28,
 			],
+			[
+				"Used as string: '' ('')",
+				36,
+			],
+			[
+				"Used as string: '' ('')",
+				40,
+			],
+			[
+				"Used as string: 'assigned to string property' ('assigned to string property')",
+				50,
+			],
+			[
+				"Used as string: 'assigned to static string property' ('assigned to static string property')",
+				52,
+			],
 			[
 				'Used as string: $h->{$name} (mixed)',
-				48,
+				59,
 			],
 			[
 				'Used as string: $name (string)',
-				48,
+				59,
 			],
 			[
 				'Used as string: $name (string)',
-				49,
+				60,
 			],
 			[
 				'Used as string: $name (string)',
-				50,
+				61,
 			],
 			[
 				'Used as string: $name (string)',
-				51,
+				62,
 			],
 			[
 				'Used as string: $name (string)',
-				52,
+				63,
 			],
 			[
 				'Used as string: $name (string)',
-				53,
+				64,
 			],
 		]);
 	}
diff --git a/tests/PHPStan/Node/data/used-as-string.php b/tests/PHPStan/Node/data/used-as-string.php
index d4a13968513..2d237eadfa0 100644
--- a/tests/PHPStan/Node/data/used-as-string.php
+++ b/tests/PHPStan/Node/data/used-as-string.php
@@ -35,12 +35,23 @@ class Holder
 
 	public string $prop = '';
 
+	public int $num = 1;
+
+	public static string $staticProp = '';
+
 	public function method(): void
 	{
 	}
 
 	public const CONST_NAME = 1;
 
+	public function assignProperties(): void
+	{
+		$this->prop = 'assigned to string property';
+		$this->num = 5;
+		self::$staticProp = 'assigned to static string property';
+	}
+
 }
 
 function dynamicNames(Holder $h, string $name): void

From 4c579198a0a9bcd6eabf288fbbb5ad14fa2ef0dd Mon Sep 17 00:00:00 2001
From: phpstan-bot <ondrej+phpstanbot@mirtes.cz>
Date: Sun, 31 May 2026 08:09:08 +0000
Subject: [PATCH 07/20] Revert UsedAsStringNode to wrap Expr instead of
 NodeAbstract

The wrapped node is always an Expr again; inline HTML is emitted by
wrapping a synthetic Scalar\String_ as before.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 src/Analyser/NodeScopeResolver.php      |  2 +-
 src/Node/UsedAsStringNode.php           | 14 +++++---------
 tests/PHPStan/Node/UsedAsStringRule.php | 21 +++------------------
 3 files changed, 9 insertions(+), 28 deletions(-)

diff --git a/src/Analyser/NodeScopeResolver.php b/src/Analyser/NodeScopeResolver.php
index 87552386bd2..e931666c84e 100644
--- a/src/Analyser/NodeScopeResolver.php
+++ b/src/Analyser/NodeScopeResolver.php
@@ -2481,7 +2481,7 @@ public function leaveNode(Node $node): ?ExistingArrayDimFetch
 			$impurePoints = [
 				new ImpurePoint($scope, $stmt, 'betweenPhpTags', 'output between PHP opening and closing tags', true),
 			];
-			$this->callNodeCallback($nodeCallback, new UsedAsStringNode($stmt), $scope, $storage);
+			$this->callNodeCallback($nodeCallback, new UsedAsStringNode(new Node\Scalar\String_($stmt->value, $stmt->getAttributes())), $scope, $storage);
 		} elseif ($stmt instanceof Node\Stmt\Block) {
 			$result = $this->processStmtNodesInternal($stmt, $stmt->stmts, $scope, $storage, $nodeCallback, $context);
 			if ($this->polluteScopeWithBlock) {
diff --git a/src/Node/UsedAsStringNode.php b/src/Node/UsedAsStringNode.php
index dcd5a5ca349..da879a367cf 100644
--- a/src/Node/UsedAsStringNode.php
+++ b/src/Node/UsedAsStringNode.php
@@ -3,6 +3,7 @@
 namespace PHPStan\Node;
 
 use Override;
+use PhpParser\Node\Expr;
 use PhpParser\NodeAbstract;
 
 /**
@@ -23,24 +24,19 @@
  * own node (a concatenation, interpolation or `(string)` cast), the enclosing
  * assignment does not report it a second time.
  *
- * The wrapped node is usually an expression, but for inline HTML it is the
- * original {@see \PhpParser\Node\Stmt\InlineHTML} statement, hence
- * {@see getNode()} returns a {@see NodeAbstract} rather than an
- * {@see \PhpParser\Node\Expr}.
- *
  * @api
  */
 final class UsedAsStringNode extends NodeAbstract implements VirtualNode
 {
 
-	public function __construct(private NodeAbstract $node)
+	public function __construct(private Expr $expr)
 	{
-		parent::__construct($node->getAttributes());
+		parent::__construct($expr->getAttributes());
 	}
 
-	public function getNode(): NodeAbstract
+	public function getExpr(): Expr
 	{
-		return $this->node;
+		return $this->expr;
 	}
 
 	#[Override]
diff --git a/tests/PHPStan/Node/UsedAsStringRule.php b/tests/PHPStan/Node/UsedAsStringRule.php
index c491e709676..f28db94231c 100644
--- a/tests/PHPStan/Node/UsedAsStringRule.php
+++ b/tests/PHPStan/Node/UsedAsStringRule.php
@@ -3,15 +3,10 @@
 namespace PHPStan\Node;
 
 use PhpParser\Node;
-use PhpParser\Node\Expr;
-use PhpParser\Node\Scalar\String_;
-use PhpParser\Node\Stmt\InlineHTML;
 use PhpParser\PrettyPrinter\Standard;
 use PHPStan\Analyser\Scope;
 use PHPStan\Rules\Rule;
 use PHPStan\Rules\RuleErrorBuilder;
-use PHPStan\ShouldNotHappenException;
-use PHPStan\Type\Constant\ConstantStringType;
 use PHPStan\Type\VerbosityLevel;
 use function sprintf;
 
@@ -35,23 +30,13 @@ public function getNodeType(): string
 
 	public function processNode(Node $node, Scope $scope): array
 	{
-		$inner = $node->getNode();
-
-		if ($inner instanceof Expr) {
-			$printed = $this->printer->prettyPrintExpr($inner);
-			$type = $scope->getType($inner)->describe(VerbosityLevel::precise());
-		} elseif ($inner instanceof InlineHTML) {
-			$printed = $this->printer->prettyPrintExpr(new String_($inner->value, $inner->getAttributes()));
-			$type = (new ConstantStringType($inner->value))->describe(VerbosityLevel::precise());
-		} else {
-			throw new ShouldNotHappenException();
-		}
+		$expr = $node->getExpr();
 
 		return [
 			RuleErrorBuilder::message(sprintf(
 				'Used as string: %s (%s)',
-				$printed,
-				$type,
+				$this->printer->prettyPrintExpr($expr),
+				$scope->getType($expr)->describe(VerbosityLevel::precise()),
 			))->identifier('tests.usedAsString')->build(),
 		];
 	}

From 868fa7a473daea93c357ff95d5d92d18efd7d519 Mon Sep 17 00:00:00 2001
From: phpstan-bot <ondrej+phpstanbot@mirtes.cz>
Date: Sun, 31 May 2026 08:15:28 +0000
Subject: [PATCH 08/20] Emit UsedAsStringNode for arguments passed to a string
 parameter

Extend the string-slot coverage to call arguments: an argument passed to a
native `string` parameter now produces a UsedAsStringNode for the argument
value. Consistent with the property slots, the parameter's native type is the
discriminator, so passing to a non-`string` parameter does not fire, and a
value that already produces its own node (concatenation, interpolation,
`(string)` cast or a nested assignment) is not reported a second time.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 src/Analyser/NodeScopeResolver.php          |  7 +++++++
 src/Node/UsedAsStringNode.php               |  3 ++-
 tests/PHPStan/Node/UsedAsStringRuleTest.php |  8 ++++++++
 tests/PHPStan/Node/data/used-as-string.php  | 16 ++++++++++++++++
 4 files changed, 33 insertions(+), 1 deletion(-)

diff --git a/src/Analyser/NodeScopeResolver.php b/src/Analyser/NodeScopeResolver.php
index e931666c84e..0673695eb03 100644
--- a/src/Analyser/NodeScopeResolver.php
+++ b/src/Analyser/NodeScopeResolver.php
@@ -3724,6 +3724,13 @@ public function processArgs(
 					$scopeToPass = $scopeToPass->enterExpressionAssign($arg->value);
 				}
 				$exprResult = $this->processExprNode($stmt, $arg->value, $scopeToPass, $storage, $nodeCallback, $context->enterDeep());
+				if (
+					$parameterNativeType !== null
+					&& $parameterNativeType->isString()->yes()
+					&& !ExprUsedAsStringVisitor::isAlreadyUsedAsStringSite($arg->value)
+				) {
+					$this->callNodeCallback($nodeCallback, new UsedAsStringNode($arg->value), $scopeToPass, $storage);
+				}
 				$throwPoints = array_merge($throwPoints, $exprResult->getThrowPoints());
 				$impurePoints = array_merge($impurePoints, $exprResult->getImpurePoints());
 				$isAlwaysTerminating = $isAlwaysTerminating || $exprResult->isAlwaysTerminating();
diff --git a/src/Node/UsedAsStringNode.php b/src/Node/UsedAsStringNode.php
index da879a367cf..1b304c87ffc 100644
--- a/src/Node/UsedAsStringNode.php
+++ b/src/Node/UsedAsStringNode.php
@@ -16,7 +16,8 @@
  * - the dynamic name of a property/method/constant access or a variable
  *   variable (`$foo->{$s}`, `$$s`, etc.),
  * - the value assigned to a variable when that value is a string,
- * - the value assigned to (or the default of) a native `string`-typed property.
+ * - the value assigned to (or the default of) a native `string`-typed property,
+ * - an argument passed to a native `string` parameter.
  *
  * Concatenations and interpolated strings are reported once for the whole
  * expression instead of once per nested operand, so a rule can interpret the
diff --git a/tests/PHPStan/Node/UsedAsStringRuleTest.php b/tests/PHPStan/Node/UsedAsStringRuleTest.php
index cb36dc47a0e..85ecec5d94c 100644
--- a/tests/PHPStan/Node/UsedAsStringRuleTest.php
+++ b/tests/PHPStan/Node/UsedAsStringRuleTest.php
@@ -119,6 +119,14 @@ public function testRule(): void
 				'Used as string: $name (string)',
 				64,
 			],
+			[
+				'Used as string: $s (string)',
+				77,
+			],
+			[
+				"Used as string: 'passed as string argument' ('passed as string argument')",
+				78,
+			],
 		]);
 	}
 
diff --git a/tests/PHPStan/Node/data/used-as-string.php b/tests/PHPStan/Node/data/used-as-string.php
index 2d237eadfa0..4f734d726b8 100644
--- a/tests/PHPStan/Node/data/used-as-string.php
+++ b/tests/PHPStan/Node/data/used-as-string.php
@@ -63,3 +63,19 @@ function dynamicNames(Holder $h, string $name): void
 	Holder::{$name}();
 	$y = $h::{$name};
 }
+
+function takesString(string $s): void
+{
+}
+
+function takesInt(int $i): void
+{
+}
+
+function passArguments(Holder $h, string $s): void
+{
+	takesString($s);
+	takesString('passed as string argument');
+	takesInt(5);
+	takesInt($h->num);
+}

From 7550786aa2087054f4042ee7c0d30c97db59f882 Mon Sep 17 00:00:00 2001
From: phpstan-bot <ondrej+phpstanbot@mirtes.cz>
Date: Sun, 31 May 2026 08:34:16 +0000
Subject: [PATCH 09/20] Emit UsedAsStringNode for native string parameter
 defaults

A native `string`-typed parameter default lands in a string slot, so emit
UsedAsStringNode for it, mirroring how property defaults are handled. Other
parameter defaults (e.g. int, ?string) do not fire.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 src/Analyser/NodeScopeResolver.php          | 13 +++++++++++++
 src/Node/UsedAsStringNode.php               |  3 ++-
 tests/PHPStan/Node/UsedAsStringRuleTest.php |  4 ++++
 tests/PHPStan/Node/data/used-as-string.php  |  4 ++++
 4 files changed, 23 insertions(+), 1 deletion(-)

diff --git a/src/Analyser/NodeScopeResolver.php b/src/Analyser/NodeScopeResolver.php
index 0673695eb03..eb203a124ee 100644
--- a/src/Analyser/NodeScopeResolver.php
+++ b/src/Analyser/NodeScopeResolver.php
@@ -3285,6 +3285,19 @@ private function processParamNode(
 		}
 
 		$this->processExprNode($stmt, $param->default, $scope, $storage, $nodeCallback, ExpressionContext::createDeep());
+
+		$nativeParameterType = $param->type !== null
+			? ParserNodeTypeToPHPStanType::resolve($param->type, $scope->isInClass() ? $scope->getClassReflection() : null)
+			: null;
+		if (
+			$nativeParameterType === null
+			|| !$nativeParameterType->isString()->yes()
+			|| ExprUsedAsStringVisitor::isAlreadyUsedAsStringSite($param->default)
+		) {
+			return;
+		}
+
+		$this->callNodeCallback($nodeCallback, new UsedAsStringNode($param->default), $scope, $storage);
 	}
 
 	/**
diff --git a/src/Node/UsedAsStringNode.php b/src/Node/UsedAsStringNode.php
index 1b304c87ffc..8bd2f83e09f 100644
--- a/src/Node/UsedAsStringNode.php
+++ b/src/Node/UsedAsStringNode.php
@@ -17,7 +17,8 @@
  *   variable (`$foo->{$s}`, `$$s`, etc.),
  * - the value assigned to a variable when that value is a string,
  * - the value assigned to (or the default of) a native `string`-typed property,
- * - an argument passed to a native `string` parameter.
+ * - an argument passed to a native `string` parameter and the default of a
+ *   native `string`-typed parameter.
  *
  * Concatenations and interpolated strings are reported once for the whole
  * expression instead of once per nested operand, so a rule can interpret the
diff --git a/tests/PHPStan/Node/UsedAsStringRuleTest.php b/tests/PHPStan/Node/UsedAsStringRuleTest.php
index 85ecec5d94c..dbd786140a4 100644
--- a/tests/PHPStan/Node/UsedAsStringRuleTest.php
+++ b/tests/PHPStan/Node/UsedAsStringRuleTest.php
@@ -127,6 +127,10 @@ public function testRule(): void
 				"Used as string: 'passed as string argument' ('passed as string argument')",
 				78,
 			],
+			[
+				"Used as string: 'string default' ('string default')",
+				83,
+			],
 		]);
 	}
 
diff --git a/tests/PHPStan/Node/data/used-as-string.php b/tests/PHPStan/Node/data/used-as-string.php
index 4f734d726b8..32e04859e27 100644
--- a/tests/PHPStan/Node/data/used-as-string.php
+++ b/tests/PHPStan/Node/data/used-as-string.php
@@ -79,3 +79,7 @@ function passArguments(Holder $h, string $s): void
 	takesInt(5);
 	takesInt($h->num);
 }
+
+function withDefaults(string $s = 'string default', int $i = 5, ?string $n = null): void
+{
+}

From bbdb5be06fa861115ffc5aec6ecefe3000be4127 Mon Sep 17 00:00:00 2001
From: phpstan-bot <ondrej+phpstanbot@mirtes.cz>
Date: Sun, 31 May 2026 08:34:56 +0000
Subject: [PATCH 10/20] Emit UsedAsStringNode for string arguments of closures
 and arrow functions

Closures and arrow functions expose their parameters as NativeParameterReflection
rather than ExtendedParameterReflection, so $parameterNativeType was null for them
and string arguments passed to a closure/arrow-function string parameter did not
fire UsedAsStringNode. Fall back to the parameter's declared type, which for these
is already the native type.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 src/Analyser/NodeScopeResolver.php          |  8 +++++--
 src/Node/UsedAsStringNode.php               |  4 ++--
 tests/PHPStan/Node/UsedAsStringRuleTest.php | 24 +++++++++++++++++++++
 tests/PHPStan/Node/data/used-as-string.php  | 12 +++++++++++
 4 files changed, 44 insertions(+), 4 deletions(-)

diff --git a/src/Analyser/NodeScopeResolver.php b/src/Analyser/NodeScopeResolver.php
index eb203a124ee..e0997af72bc 100644
--- a/src/Analyser/NodeScopeResolver.php
+++ b/src/Analyser/NodeScopeResolver.php
@@ -3737,9 +3737,13 @@ public function processArgs(
 					$scopeToPass = $scopeToPass->enterExpressionAssign($arg->value);
 				}
 				$exprResult = $this->processExprNode($stmt, $arg->value, $scopeToPass, $storage, $nodeCallback, $context->enterDeep());
+				// Closures and arrow functions expose their parameters as NativeParameterReflection
+				// (not ExtendedParameterReflection), so $parameterNativeType is null for them - their
+				// declared type already is the native type.
+				$argStringSlotType = $parameterNativeType ?? ($parameter instanceof NativeParameterReflection ? $parameter->getType() : null);
 				if (
-					$parameterNativeType !== null
-					&& $parameterNativeType->isString()->yes()
+					$argStringSlotType !== null
+					&& $argStringSlotType->isString()->yes()
 					&& !ExprUsedAsStringVisitor::isAlreadyUsedAsStringSite($arg->value)
 				) {
 					$this->callNodeCallback($nodeCallback, new UsedAsStringNode($arg->value), $scopeToPass, $storage);
diff --git a/src/Node/UsedAsStringNode.php b/src/Node/UsedAsStringNode.php
index 8bd2f83e09f..ae1202552bc 100644
--- a/src/Node/UsedAsStringNode.php
+++ b/src/Node/UsedAsStringNode.php
@@ -17,8 +17,8 @@
  *   variable (`$foo->{$s}`, `$$s`, etc.),
  * - the value assigned to a variable when that value is a string,
  * - the value assigned to (or the default of) a native `string`-typed property,
- * - an argument passed to a native `string` parameter and the default of a
- *   native `string`-typed parameter.
+ * - an argument passed to a native `string` parameter (including closures and
+ *   arrow functions) and the default of a native `string`-typed parameter.
  *
  * Concatenations and interpolated strings are reported once for the whole
  * expression instead of once per nested operand, so a rule can interpret the
diff --git a/tests/PHPStan/Node/UsedAsStringRuleTest.php b/tests/PHPStan/Node/UsedAsStringRuleTest.php
index dbd786140a4..9f791968153 100644
--- a/tests/PHPStan/Node/UsedAsStringRuleTest.php
+++ b/tests/PHPStan/Node/UsedAsStringRuleTest.php
@@ -131,6 +131,30 @@ public function testRule(): void
 				"Used as string: 'string default' ('string default')",
 				83,
 			],
+			[
+				"Used as string: 'closure string default' ('closure string default')",
+				89,
+			],
+			[
+				'Used as string: $s (string)',
+				91,
+			],
+			[
+				"Used as string: 'closure string argument' ('closure string argument')",
+				92,
+			],
+			[
+				"Used as string: 'arrow string default' ('arrow string default')",
+				94,
+			],
+			[
+				'Used as string: $s (string)',
+				95,
+			],
+			[
+				"Used as string: 'arrow string argument' ('arrow string argument')",
+				96,
+			],
 		]);
 	}
 
diff --git a/tests/PHPStan/Node/data/used-as-string.php b/tests/PHPStan/Node/data/used-as-string.php
index 32e04859e27..3daf8cf1069 100644
--- a/tests/PHPStan/Node/data/used-as-string.php
+++ b/tests/PHPStan/Node/data/used-as-string.php
@@ -83,3 +83,15 @@ function passArguments(Holder $h, string $s): void
 function withDefaults(string $s = 'string default', int $i = 5, ?string $n = null): void
 {
 }
+
+function closuresAndArrowFunctions(string $s): void
+{
+	$closure = function (string $cs = 'closure string default', int $ci = 5): void {
+	};
+	$closure($s);
+	$closure('closure string argument');
+
+	$arrow = fn (string $as = 'arrow string default', int $ai = 5): string => $as;
+	$arrow($s);
+	$arrow('arrow string argument');
+}

From e9c041af94b81ea9fcde25de1892acbfd670d9f7 Mon Sep 17 00:00:00 2001
From: phpstan-bot <ondrej+phpstanbot@mirtes.cz>
Date: Sun, 31 May 2026 09:11:14 +0000
Subject: [PATCH 11/20] Treat string-containing union properties as a string
 slot for UsedAsStringNode

Assigning to a native property whose type is a union containing string (e.g.
string|int) now emits UsedAsStringNode, while a union without any string member
(e.g. int|float) does not. Also adds test coverage for arguments passed to a
method and a static-method string parameter.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 src/Analyser/ExprHandler/AssignHandler.php  | 31 ++++++++++---
 src/Node/UsedAsStringNode.php               |  4 +-
 tests/PHPStan/Node/UsedAsStringRuleTest.php | 48 +++++++++++++--------
 tests/PHPStan/Node/data/used-as-string.php  | 20 +++++++++
 4 files changed, 79 insertions(+), 24 deletions(-)

diff --git a/src/Analyser/ExprHandler/AssignHandler.php b/src/Analyser/ExprHandler/AssignHandler.php
index ee907a192cb..dc9c187840d 100644
--- a/src/Analyser/ExprHandler/AssignHandler.php
+++ b/src/Analyser/ExprHandler/AssignHandler.php
@@ -218,7 +218,7 @@ static function (MutatingScope $scope) use ($stmt, $expr, $nodeCallback, $contex
 	/**
 	 * Emits a {@see UsedAsStringNode} for the assigned value when it lands in a
 	 * string slot: a string-valued variable assignment or an assignment to a
-	 * native `string`-typed property.
+	 * native property whose type allows a string.
 	 *
 	 * @param callable(Node $node, Scope $scope): void $nodeCallback
 	 */
@@ -234,20 +234,41 @@ private function emitUsedAsStringNode(
 			return;
 		}
 
-		$slotType = $this->getAssignTargetStringSlotType($scope, $expr->var, $expr->expr);
-		if ($slotType === null || !$slotType->isString()->yes()) {
+		if (!$this->isAssignToStringSlot($scope, $expr->var, $expr->expr)) {
 			return;
 		}
 
 		$nodeScopeResolver->callNodeCallback($nodeCallback, new UsedAsStringNode($expr->expr), $scope, $storage);
 	}
 
-	private function getAssignTargetStringSlotType(MutatingScope $scope, Expr $var, Expr $assignedExpr): ?Type
+	/**
+	 * Whether the assigned value lands in a string slot: a string-valued variable
+	 * assignment, or an assignment to a native property whose declared type allows a
+	 * string (a plain `string` or a union that contains `string`, e.g. `string|int`).
+	 * A union without any `string` member (e.g. `int|float`) is not a string slot.
+	 */
+	private function isAssignToStringSlot(MutatingScope $scope, Expr $var, Expr $assignedExpr): bool
 	{
 		if ($var instanceof Variable) {
-			return $scope->getType($assignedExpr);
+			return $scope->getType($assignedExpr)->isString()->yes();
 		}
 
+		$slotType = $this->getAssignTargetPropertyNativeType($scope, $var);
+		if ($slotType === null) {
+			return false;
+		}
+
+		foreach (TypeUtils::flattenTypes($slotType) as $innerType) {
+			if ($innerType->isString()->yes()) {
+				return true;
+			}
+		}
+
+		return false;
+	}
+
+	private function getAssignTargetPropertyNativeType(MutatingScope $scope, Expr $var): ?Type
+	{
 		if ($var instanceof PropertyFetch) {
 			if (!$var->name instanceof Node\Identifier) {
 				return null;
diff --git a/src/Node/UsedAsStringNode.php b/src/Node/UsedAsStringNode.php
index ae1202552bc..1fe4f9629b8 100644
--- a/src/Node/UsedAsStringNode.php
+++ b/src/Node/UsedAsStringNode.php
@@ -16,7 +16,9 @@
  * - the dynamic name of a property/method/constant access or a variable
  *   variable (`$foo->{$s}`, `$$s`, etc.),
  * - the value assigned to a variable when that value is a string,
- * - the value assigned to (or the default of) a native `string`-typed property,
+ * - the value assigned to a native property whose type allows a string (a plain
+ *   `string` or a union containing `string`, e.g. `string|int`) and the default
+ *   of a native `string`-typed property,
  * - an argument passed to a native `string` parameter (including closures and
  *   arrow functions) and the default of a native `string`-typed parameter.
  *
diff --git a/tests/PHPStan/Node/UsedAsStringRuleTest.php b/tests/PHPStan/Node/UsedAsStringRuleTest.php
index 9f791968153..358dd9ccd48 100644
--- a/tests/PHPStan/Node/UsedAsStringRuleTest.php
+++ b/tests/PHPStan/Node/UsedAsStringRuleTest.php
@@ -85,75 +85,87 @@ public function testRule(): void
 			],
 			[
 				"Used as string: 'assigned to string property' ('assigned to string property')",
-				50,
+				62,
 			],
 			[
 				"Used as string: 'assigned to static string property' ('assigned to static string property')",
-				52,
+				64,
+			],
+			[
+				"Used as string: 'assigned to union string property' ('assigned to union string property')",
+				65,
 			],
 			[
 				'Used as string: $h->{$name} (mixed)',
-				59,
+				73,
 			],
 			[
 				'Used as string: $name (string)',
-				59,
+				73,
 			],
 			[
 				'Used as string: $name (string)',
-				60,
+				74,
 			],
 			[
 				'Used as string: $name (string)',
-				61,
+				75,
 			],
 			[
 				'Used as string: $name (string)',
-				62,
+				76,
 			],
 			[
 				'Used as string: $name (string)',
-				63,
+				77,
 			],
 			[
 				'Used as string: $name (string)',
-				64,
+				78,
 			],
 			[
 				'Used as string: $s (string)',
-				77,
+				91,
 			],
 			[
 				"Used as string: 'passed as string argument' ('passed as string argument')",
-				78,
+				92,
+			],
+			[
+				"Used as string: 'method string argument' ('method string argument')",
+				99,
+			],
+			[
+				"Used as string: 'static string argument' ('static string argument')",
+				100,
 			],
 			[
 				"Used as string: 'string default' ('string default')",
-				83,
+				103,
 			],
 			[
 				"Used as string: 'closure string default' ('closure string default')",
-				89,
+				109,
 			],
 			[
 				'Used as string: $s (string)',
-				91,
+				111,
 			],
 			[
 				"Used as string: 'closure string argument' ('closure string argument')",
-				92,
+				112,
 			],
 			[
 				"Used as string: 'arrow string default' ('arrow string default')",
-				94,
+				114,
 			],
 			[
 				'Used as string: $s (string)',
-				95,
+				115,
 			],
 			[
 				"Used as string: 'arrow string argument' ('arrow string argument')",
-				96,
+				116,
 			],
 		]);
 	}
diff --git a/tests/PHPStan/Node/data/used-as-string.php b/tests/PHPStan/Node/data/used-as-string.php
index 3daf8cf1069..c0ca6334882 100644
--- a/tests/PHPStan/Node/data/used-as-string.php
+++ b/tests/PHPStan/Node/data/used-as-string.php
@@ -39,10 +39,22 @@ class Holder
 
 	public static string $staticProp = '';
 
+	public string|int $unionWithString;
+
+	public int|float $unionWithoutString = 1;
+
 	public function method(): void
 	{
 	}
 
+	public function methodWithStringParam(string $arg): void
+	{
+	}
+
+	public static function staticMethodWithStringParam(string $arg): void
+	{
+	}
+
 	public const CONST_NAME = 1;
 
 	public function assignProperties(): void
@@ -50,6 +62,8 @@ public function assignProperties(): void
 		$this->prop = 'assigned to string property';
 		$this->num = 5;
 		self::$staticProp = 'assigned to static string property';
+		$this->unionWithString = 'assigned to union string property';
+		$this->unionWithoutString = 5;
 	}
 
 }
@@ -80,6 +94,12 @@ function passArguments(Holder $h, string $s): void
 	takesInt($h->num);
 }
 
+function passMethodArguments(Holder $h): void
+{
+	$h->methodWithStringParam('method string argument');
+	Holder::staticMethodWithStringParam('static string argument');
+}
+
 function withDefaults(string $s = 'string default', int $i = 5, ?string $n = null): void
 {
 }

From a989ef67abadcb9849adbad67b6d432ee7588687 Mon Sep 17 00:00:00 2001
From: Markus Staab <maggus.staab@googlemail.com>
Date: Sun, 31 May 2026 11:21:41 +0200
Subject: [PATCH 12/20] simplify

---
 src/Analyser/ExprHandler/AssignHandler.php | 8 +-------
 1 file changed, 1 insertion(+), 7 deletions(-)

diff --git a/src/Analyser/ExprHandler/AssignHandler.php b/src/Analyser/ExprHandler/AssignHandler.php
index dc9c187840d..81498e0f384 100644
--- a/src/Analyser/ExprHandler/AssignHandler.php
+++ b/src/Analyser/ExprHandler/AssignHandler.php
@@ -258,13 +258,7 @@ private function isAssignToStringSlot(MutatingScope $scope, Expr $var, Expr $ass
 			return false;
 		}
 
-		foreach (TypeUtils::flattenTypes($slotType) as $innerType) {
-			if ($innerType->isString()->yes()) {
-				return true;
-			}
-		}
-
-		return false;
+		return !$slotType->isString()->no();
 	}
 
 	private function getAssignTargetPropertyNativeType(MutatingScope $scope, Expr $var): ?Type

From 6aff995aa569f8cf5fefd86dde87631a13d8833d Mon Sep 17 00:00:00 2001
From: phpstan-bot <ondrej+phpstanbot@mirtes.cz>
Date: Sun, 31 May 2026 09:37:39 +0000
Subject: [PATCH 13/20] Emit UsedAsStringNode for arguments passed to union
 parameters containing string

A native parameter typed as a union containing a string member (e.g.
`string|int`) is a string slot, just like such a property, so an argument
passed to it is now reported. Plain `mixed` is excluded, so arguments to
untyped parameters do not fire.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 src/Analyser/NodeScopeResolver.php          | 18 +++++++++++++++++-
 src/Node/UsedAsStringNode.php               |  6 ++++--
 tests/PHPStan/Node/UsedAsStringRuleTest.php |  4 ++++
 tests/PHPStan/Node/data/used-as-string.php  | 14 ++++++++++++++
 4 files changed, 39 insertions(+), 3 deletions(-)

diff --git a/src/Analyser/NodeScopeResolver.php b/src/Analyser/NodeScopeResolver.php
index e0997af72bc..2ba3189d1ec 100644
--- a/src/Analyser/NodeScopeResolver.php
+++ b/src/Analyser/NodeScopeResolver.php
@@ -3300,6 +3300,22 @@ private function processParamNode(
 		$this->callNodeCallback($nodeCallback, new UsedAsStringNode($param->default), $scope, $storage);
 	}
 
+	/**
+	 * Whether the native type is a string slot: a plain `string` or a union that
+	 * contains a `string` member (e.g. `string|int`). Plain `mixed` is not a string
+	 * slot, so arguments to untyped parameters do not fire.
+	 */
+	private function isStringSlotType(Type $type): bool
+	{
+		foreach (TypeUtils::flattenTypes($type) as $slotMemberType) {
+			if ($slotMemberType->isString()->yes()) {
+				return true;
+			}
+		}
+
+		return false;
+	}
+
 	/**
 	 * @param AttributeGroup[] $attrGroups
 	 * @param callable(Node $node, Scope $scope): void $nodeCallback
@@ -3743,7 +3759,7 @@ public function processArgs(
 				$argStringSlotType = $parameterNativeType ?? ($parameter instanceof NativeParameterReflection ? $parameter->getType() : null);
 				if (
 					$argStringSlotType !== null
-					&& $argStringSlotType->isString()->yes()
+					&& $this->isStringSlotType($argStringSlotType)
 					&& !ExprUsedAsStringVisitor::isAlreadyUsedAsStringSite($arg->value)
 				) {
 					$this->callNodeCallback($nodeCallback, new UsedAsStringNode($arg->value), $scopeToPass, $storage);
diff --git a/src/Node/UsedAsStringNode.php b/src/Node/UsedAsStringNode.php
index 1fe4f9629b8..49249be976a 100644
--- a/src/Node/UsedAsStringNode.php
+++ b/src/Node/UsedAsStringNode.php
@@ -19,8 +19,10 @@
  * - the value assigned to a native property whose type allows a string (a plain
  *   `string` or a union containing `string`, e.g. `string|int`) and the default
  *   of a native `string`-typed property,
- * - an argument passed to a native `string` parameter (including closures and
- *   arrow functions) and the default of a native `string`-typed parameter.
+ * - an argument passed to a native parameter whose type allows a string (a plain
+ *   `string` or a union containing `string`, e.g. `string|int`), including
+ *   closures and arrow functions, and the default of a native `string`-typed
+ *   parameter.
  *
  * Concatenations and interpolated strings are reported once for the whole
  * expression instead of once per nested operand, so a rule can interpret the
diff --git a/tests/PHPStan/Node/UsedAsStringRuleTest.php b/tests/PHPStan/Node/UsedAsStringRuleTest.php
index 358dd9ccd48..93539bbf8b7 100644
--- a/tests/PHPStan/Node/UsedAsStringRuleTest.php
+++ b/tests/PHPStan/Node/UsedAsStringRuleTest.php
@@ -167,6 +167,10 @@ public function testRule(): void
 				"Used as string: 'arrow string argument' ('arrow string argument')",
 				116,
 			],
+			[
+				"Used as string: 'union with string argument' ('union with string argument')",
+				129,
+			],
 		]);
 	}
 
diff --git a/tests/PHPStan/Node/data/used-as-string.php b/tests/PHPStan/Node/data/used-as-string.php
index c0ca6334882..7aac75bd15f 100644
--- a/tests/PHPStan/Node/data/used-as-string.php
+++ b/tests/PHPStan/Node/data/used-as-string.php
@@ -115,3 +115,17 @@ function closuresAndArrowFunctions(string $s): void
 	$arrow($s);
 	$arrow('arrow string argument');
 }
+
+function takesUnionWithString(string|int $u): void
+{
+}
+
+function takesUnionWithoutString(int|float $u): void
+{
+}
+
+function passUnionArguments(): void
+{
+	takesUnionWithString('union with string argument');
+	takesUnionWithoutString(5);
+}

From 4fe62a6aadd079817565358b53cb8edce4c3c430 Mon Sep 17 00:00:00 2001
From: phpstan-bot <ondrej+phpstanbot@mirtes.cz>
Date: Sun, 31 May 2026 09:38:04 +0000
Subject: [PATCH 14/20] Test that a nowdoc used in concat-assignment fires
 UsedAsStringNode once

Covers the nowdoc (`<<<'EOS'`) counterpart of the existing heredoc case:
appended via `.=` it is reported once for the whole concat-assignment.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 tests/PHPStan/Node/UsedAsStringRuleTest.php | 10 +++++++++-
 tests/PHPStan/Node/data/used-as-string.php  |  8 ++++++++
 2 files changed, 17 insertions(+), 1 deletion(-)

diff --git a/tests/PHPStan/Node/UsedAsStringRuleTest.php b/tests/PHPStan/Node/UsedAsStringRuleTest.php
index 93539bbf8b7..3ee775ef1e6 100644
--- a/tests/PHPStan/Node/UsedAsStringRuleTest.php
+++ b/tests/PHPStan/Node/UsedAsStringRuleTest.php
@@ -167,9 +167,17 @@ public function testRule(): void
 				"Used as string: 'arrow string argument' ('arrow string argument')",
 				116,
 			],
+			[
+				"Used as string: '' ('')",
+				121,
+			],
+			[
+				"Used as string: \$html .= <<<'EOS'\n<script nonce=\"123\" type=\"module\">\nEOS ('<script nonce=\"123\" type=\"module\">')",
+				122,
+			],
 			[
 				"Used as string: 'union with string argument' ('union with string argument')",
-				129,
+				137,
 			],
 		]);
 	}
diff --git a/tests/PHPStan/Node/data/used-as-string.php b/tests/PHPStan/Node/data/used-as-string.php
index 7aac75bd15f..195378133ad 100644
--- a/tests/PHPStan/Node/data/used-as-string.php
+++ b/tests/PHPStan/Node/data/used-as-string.php
@@ -116,6 +116,14 @@ function closuresAndArrowFunctions(string $s): void
 	$arrow('arrow string argument');
 }
 
+function doNowdoc(): void
+{
+	$html = '';
+	$html .= <<<'EOS'
+<script nonce="123" type="module">
+EOS;
+}
+
 function takesUnionWithString(string|int $u): void
 {
 }

From 694caadd8515437b2f91d0d50115fefe550d4b34 Mon Sep 17 00:00:00 2001
From: phpstan-bot <ondrej+phpstanbot@mirtes.cz>
Date: Sun, 31 May 2026 09:41:49 +0000
Subject: [PATCH 15/20] Test that string literals in an array() assignment are
 not used as a string

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 tests/PHPStan/Node/data/used-as-string.php | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/tests/PHPStan/Node/data/used-as-string.php b/tests/PHPStan/Node/data/used-as-string.php
index 195378133ad..2e868bd54f2 100644
--- a/tests/PHPStan/Node/data/used-as-string.php
+++ b/tests/PHPStan/Node/data/used-as-string.php
@@ -137,3 +137,8 @@ function passUnionArguments(): void
 	takesUnionWithString('union with string argument');
 	takesUnionWithoutString(5);
 }
+
+function arrayAssignment(): void
+{
+	$bar = array('Bar1', 'Bar2', 'Bar3');
+}

From edb4503765c3ab377411fd503723beaca5e5b696 Mon Sep 17 00:00:00 2001
From: Markus Staab <maggus.staab@googlemail.com>
Date: Sun, 31 May 2026 11:44:56 +0200
Subject: [PATCH 16/20] simplify

---
 src/Analyser/NodeScopeResolver.php | 18 +-----------------
 1 file changed, 1 insertion(+), 17 deletions(-)

diff --git a/src/Analyser/NodeScopeResolver.php b/src/Analyser/NodeScopeResolver.php
index 2ba3189d1ec..1f00f8b8f39 100644
--- a/src/Analyser/NodeScopeResolver.php
+++ b/src/Analyser/NodeScopeResolver.php
@@ -3300,22 +3300,6 @@ private function processParamNode(
 		$this->callNodeCallback($nodeCallback, new UsedAsStringNode($param->default), $scope, $storage);
 	}
 
-	/**
-	 * Whether the native type is a string slot: a plain `string` or a union that
-	 * contains a `string` member (e.g. `string|int`). Plain `mixed` is not a string
-	 * slot, so arguments to untyped parameters do not fire.
-	 */
-	private function isStringSlotType(Type $type): bool
-	{
-		foreach (TypeUtils::flattenTypes($type) as $slotMemberType) {
-			if ($slotMemberType->isString()->yes()) {
-				return true;
-			}
-		}
-
-		return false;
-	}
-
 	/**
 	 * @param AttributeGroup[] $attrGroups
 	 * @param callable(Node $node, Scope $scope): void $nodeCallback
@@ -3759,7 +3743,7 @@ public function processArgs(
 				$argStringSlotType = $parameterNativeType ?? ($parameter instanceof NativeParameterReflection ? $parameter->getType() : null);
 				if (
 					$argStringSlotType !== null
-					&& $this->isStringSlotType($argStringSlotType)
+					&& !$argStringSlotType->isString()->no()
 					&& !ExprUsedAsStringVisitor::isAlreadyUsedAsStringSite($arg->value)
 				) {
 					$this->callNodeCallback($nodeCallback, new UsedAsStringNode($arg->value), $scopeToPass, $storage);

From 81ed0096c80580d80f00bacd3042a2cc8f3d72ad Mon Sep 17 00:00:00 2001
From: phpstan-bot <ondrej+phpstanbot@mirtes.cz>
Date: Sun, 31 May 2026 10:16:22 +0000
Subject: [PATCH 17/20] Do not fire UsedAsStringNode for arguments passed to
 PHPDoc-only string parameters

A parameter typed only via @param (no native typehint) has a native type of
mixed. The previous "simplify" used !isString()->no() as the slot discriminator,
which treats mixed as a string slot, so an argument passed to such a parameter
fired UsedAsStringNode. Restore the "native type contains a string member"
discriminator (flatten + isString()->yes()) so mixed is excluded while plain
string and string|int still fire. Apply the same check to the property-assignment
slot, which had the same latent mixed-fires issue.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 src/Analyser/ExprHandler/AssignHandler.php |  8 +++++++-
 src/Analyser/NodeScopeResolver.php         | 18 +++++++++++++++++-
 tests/PHPStan/Node/data/used-as-string.php | 12 ++++++++++++
 3 files changed, 36 insertions(+), 2 deletions(-)

diff --git a/src/Analyser/ExprHandler/AssignHandler.php b/src/Analyser/ExprHandler/AssignHandler.php
index 81498e0f384..dc9c187840d 100644
--- a/src/Analyser/ExprHandler/AssignHandler.php
+++ b/src/Analyser/ExprHandler/AssignHandler.php
@@ -258,7 +258,13 @@ private function isAssignToStringSlot(MutatingScope $scope, Expr $var, Expr $ass
 			return false;
 		}
 
-		return !$slotType->isString()->no();
+		foreach (TypeUtils::flattenTypes($slotType) as $innerType) {
+			if ($innerType->isString()->yes()) {
+				return true;
+			}
+		}
+
+		return false;
 	}
 
 	private function getAssignTargetPropertyNativeType(MutatingScope $scope, Expr $var): ?Type
diff --git a/src/Analyser/NodeScopeResolver.php b/src/Analyser/NodeScopeResolver.php
index 1f00f8b8f39..a5d92326fb1 100644
--- a/src/Analyser/NodeScopeResolver.php
+++ b/src/Analyser/NodeScopeResolver.php
@@ -3300,6 +3300,22 @@ private function processParamNode(
 		$this->callNodeCallback($nodeCallback, new UsedAsStringNode($param->default), $scope, $storage);
 	}
 
+	/**
+	 * Whether the native type is a string slot: a plain `string` or a union that
+	 * contains a `string` member (e.g. `string|int`). Plain `mixed` is not a string
+	 * slot, so arguments to untyped or PHPDoc-only `@param string` parameters do not fire.
+	 */
+	private function isStringSlotType(Type $type): bool
+	{
+		foreach (TypeUtils::flattenTypes($type) as $slotMemberType) {
+			if ($slotMemberType->isString()->yes()) {
+				return true;
+			}
+		}
+
+		return false;
+	}
+
 	/**
 	 * @param AttributeGroup[] $attrGroups
 	 * @param callable(Node $node, Scope $scope): void $nodeCallback
@@ -3743,7 +3759,7 @@ public function processArgs(
 				$argStringSlotType = $parameterNativeType ?? ($parameter instanceof NativeParameterReflection ? $parameter->getType() : null);
 				if (
 					$argStringSlotType !== null
-					&& !$argStringSlotType->isString()->no()
+					&& $this->isStringSlotType($argStringSlotType)
 					&& !ExprUsedAsStringVisitor::isAlreadyUsedAsStringSite($arg->value)
 				) {
 					$this->callNodeCallback($nodeCallback, new UsedAsStringNode($arg->value), $scopeToPass, $storage);
diff --git a/tests/PHPStan/Node/data/used-as-string.php b/tests/PHPStan/Node/data/used-as-string.php
index 2e868bd54f2..e5afbfc19fc 100644
--- a/tests/PHPStan/Node/data/used-as-string.php
+++ b/tests/PHPStan/Node/data/used-as-string.php
@@ -142,3 +142,15 @@ function arrayAssignment(): void
 {
 	$bar = array('Bar1', 'Bar2', 'Bar3');
 }
+
+/**
+ * @param string $s
+ */
+function takesPhpDocString($s): void
+{
+}
+
+function passPhpDocStringArgument(): void
+{
+	takesPhpDocString('phpdoc string argument');
+}

From 0b444c5782d5f840ed7cd3c9bfdb9767dff6e967 Mon Sep 17 00:00:00 2001
From: phpstan-bot <ondrej+phpstanbot@mirtes.cz>
Date: Sun, 31 May 2026 10:36:32 +0000
Subject: [PATCH 18/20] Test that a string passed to a native mixed parameter
 does not fire UsedAsStringNode

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 tests/PHPStan/Node/data/used-as-string.php | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/tests/PHPStan/Node/data/used-as-string.php b/tests/PHPStan/Node/data/used-as-string.php
index e5afbfc19fc..1307baf2c4e 100644
--- a/tests/PHPStan/Node/data/used-as-string.php
+++ b/tests/PHPStan/Node/data/used-as-string.php
@@ -154,3 +154,12 @@ function passPhpDocStringArgument(): void
 {
 	takesPhpDocString('phpdoc string argument');
 }
+
+function takesMixed(mixed $m): void
+{
+}
+
+function passMixedArgument(): void
+{
+	takesMixed('mixed argument');
+}

From 6b10f694bdf10e6fd27566bf7ebd45ec9679bef0 Mon Sep 17 00:00:00 2001
From: phpstan-bot <ondrej+phpstanbot@mirtes.cz>
Date: Sun, 31 May 2026 11:03:28 +0000
Subject: [PATCH 19/20] Test that a Stringable object passed to a native string
 parameter fires UsedAsStringNode

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 tests/PHPStan/Node/UsedAsStringRuleTest.php |  4 ++++
 tests/PHPStan/Node/data/used-as-string.php  | 15 +++++++++++++++
 2 files changed, 19 insertions(+)

diff --git a/tests/PHPStan/Node/UsedAsStringRuleTest.php b/tests/PHPStan/Node/UsedAsStringRuleTest.php
index 3ee775ef1e6..0bb1be4f590 100644
--- a/tests/PHPStan/Node/UsedAsStringRuleTest.php
+++ b/tests/PHPStan/Node/UsedAsStringRuleTest.php
@@ -179,6 +179,10 @@ public function testRule(): void
 				"Used as string: 'union with string argument' ('union with string argument')",
 				137,
 			],
+			[
+				'Used as string: $obj (ExprUsedAsString\StringableObject)',
+				179,
+			],
 		]);
 	}
 
diff --git a/tests/PHPStan/Node/data/used-as-string.php b/tests/PHPStan/Node/data/used-as-string.php
index 1307baf2c4e..6321eb45366 100644
--- a/tests/PHPStan/Node/data/used-as-string.php
+++ b/tests/PHPStan/Node/data/used-as-string.php
@@ -163,3 +163,18 @@ function passMixedArgument(): void
 {
 	takesMixed('mixed argument');
 }
+
+class StringableObject
+{
+
+	public function __toString(): string
+	{
+		return 'stringable';
+	}
+
+}
+
+function passStringableArgument(StringableObject $obj): void
+{
+	takesString($obj);
+}

From 7f470e0d15446e560b748c2e0aa1ad3ce9ce625e Mon Sep 17 00:00:00 2001
From: phpstan-bot <ondrej+phpstanbot@mirtes.cz>
Date: Tue, 2 Jun 2026 06:03:28 +0000
Subject: [PATCH 20/20] Only emit UsedAsStringNode for property assignments
 when the value can be coerced to a string

A property string slot (a `string` or a union containing `string`, e.g.
`string|int`) only really receives a string when the assigned value can be
coerced to a string in the current typing mode. Gate the emission on
`Type::toCoercedArgumentType()` so a non-Stringable object assigned to such a
slot no longer fires, while a Stringable assigned to it in weak mode does.

Tests cover assigning a Stringable and a non-Stringable object to string slots
under strict_types=1 (neither fires) and a non-strict-types variant where a
Stringable and a coerced int do fire.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 src/Analyser/ExprHandler/AssignHandler.php    | 26 ++++++++--
 src/Node/UsedAsStringNode.php                 |  7 ++-
 tests/PHPStan/Node/UsedAsStringRuleTest.php   | 20 +++++++-
 .../Node/data/used-as-string-non-strict.php   | 47 +++++++++++++++++++
 tests/PHPStan/Node/data/used-as-string.php    | 15 ++++++
 5 files changed, 108 insertions(+), 7 deletions(-)
 create mode 100644 tests/PHPStan/Node/data/used-as-string-non-strict.php

diff --git a/src/Analyser/ExprHandler/AssignHandler.php b/src/Analyser/ExprHandler/AssignHandler.php
index dc9c187840d..6b7a30856f3 100644
--- a/src/Analyser/ExprHandler/AssignHandler.php
+++ b/src/Analyser/ExprHandler/AssignHandler.php
@@ -244,8 +244,11 @@ private function emitUsedAsStringNode(
 	/**
 	 * Whether the assigned value lands in a string slot: a string-valued variable
 	 * assignment, or an assignment to a native property whose declared type allows a
-	 * string (a plain `string` or a union that contains `string`, e.g. `string|int`).
-	 * A union without any `string` member (e.g. `int|float`) is not a string slot.
+	 * string (a plain `string` or a union that contains `string`, e.g. `string|int`)
+	 * when the assigned value can actually be coerced to a string in the current
+	 * typing mode. A union without any `string` member (e.g. `int|float`) is not a
+	 * string slot, and a value that cannot be coerced to a string (e.g. a
+	 * non-`Stringable` object) does not land in the slot as a string.
 	 */
 	private function isAssignToStringSlot(MutatingScope $scope, Expr $var, Expr $assignedExpr): bool
 	{
@@ -254,11 +257,26 @@ private function isAssignToStringSlot(MutatingScope $scope, Expr $var, Expr $ass
 		}
 
 		$slotType = $this->getAssignTargetPropertyNativeType($scope, $var);
-		if ($slotType === null) {
+		if ($slotType === null || !$this->containsString($slotType)) {
 			return false;
 		}
 
-		foreach (TypeUtils::flattenTypes($slotType) as $innerType) {
+		// Only fire when the assigned value can actually be coerced to a string in
+		// the current (strict/weak) typing mode: a non-`Stringable` object assigned
+		// to a `string|int` property is not used as a string, while a `Stringable`
+		// assigned to it in weak mode is.
+		$coercedAssignedType = $scope->getType($assignedExpr)->toCoercedArgumentType($scope->isDeclareStrictTypes());
+
+		return $this->containsString($coercedAssignedType);
+	}
+
+	/**
+	 * Whether the type is a plain `string` or a union with at least one `string`
+	 * member (e.g. `string|int`).
+	 */
+	private function containsString(Type $type): bool
+	{
+		foreach (TypeUtils::flattenTypes($type) as $innerType) {
 			if ($innerType->isString()->yes()) {
 				return true;
 			}
diff --git a/src/Node/UsedAsStringNode.php b/src/Node/UsedAsStringNode.php
index 49249be976a..87a38a852e7 100644
--- a/src/Node/UsedAsStringNode.php
+++ b/src/Node/UsedAsStringNode.php
@@ -17,8 +17,11 @@
  *   variable (`$foo->{$s}`, `$$s`, etc.),
  * - the value assigned to a variable when that value is a string,
  * - the value assigned to a native property whose type allows a string (a plain
- *   `string` or a union containing `string`, e.g. `string|int`) and the default
- *   of a native `string`-typed property,
+ *   `string` or a union containing `string`, e.g. `string|int`) when the assigned
+ *   value can be coerced to a string in the current typing mode (so a
+ *   non-`Stringable` object assigned to such a slot does not fire, while a
+ *   `Stringable` assigned to it in weak mode does), and the default of a native
+ *   `string`-typed property,
  * - an argument passed to a native parameter whose type allows a string (a plain
  *   `string` or a union containing `string`, e.g. `string|int`), including
  *   closures and arrow functions, and the default of a native `string`-typed
diff --git a/tests/PHPStan/Node/UsedAsStringRuleTest.php b/tests/PHPStan/Node/UsedAsStringRuleTest.php
index 0bb1be4f590..9bcbfcbebf9 100644
--- a/tests/PHPStan/Node/UsedAsStringRuleTest.php
+++ b/tests/PHPStan/Node/UsedAsStringRuleTest.php
@@ -181,7 +181,25 @@ public function testRule(): void
 			],
 			[
 				'Used as string: $obj (ExprUsedAsString\StringableObject)',
-				179,
+				184,
+			],
+		]);
+	}
+
+	public function testRuleNonStrictTypes(): void
+	{
+		$this->analyse([__DIR__ . '/data/used-as-string-non-strict.php'], [
+			[
+				"Used as string: '' ('')",
+				25,
+			],
+			[
+				'Used as string: $s (ExprUsedAsStringNonStrict\StringableObject)',
+				34,
+			],
+			[
+				'Used as string: 5 (5)',
+				46,
 			],
 		]);
 	}
diff --git a/tests/PHPStan/Node/data/used-as-string-non-strict.php b/tests/PHPStan/Node/data/used-as-string-non-strict.php
new file mode 100644
index 00000000000..87512037b8d
--- /dev/null
+++ b/tests/PHPStan/Node/data/used-as-string-non-strict.php
@@ -0,0 +1,47 @@
+<?php // lint >= 8.3
+
+declare(strict_types = 0);
+
+namespace ExprUsedAsStringNonStrict;
+
+class StringableObject
+{
+
+	public function __toString(): string
+	{
+		return 'stringable';
+	}
+
+}
+
+class NonStringableObject
+{
+
+}
+
+class Holder
+{
+
+	public string $prop = '';
+
+	public string|int $unionWithString = '';
+
+}
+
+function assignStringableToStringProperty(Holder $h, StringableObject $s): void
+{
+	// strict_types = 0: a Stringable is coerced to a string, so it fires.
+	$h->prop = $s;
+}
+
+function assignNonStringableToMaybeStringProperty(Holder $h, NonStringableObject $o): void
+{
+	// A non-Stringable object cannot be coerced to a string, so it does not fire.
+	$h->unionWithString = $o;
+}
+
+function assignIntToStringProperty(Holder $h): void
+{
+	// strict_types = 0: an int is coerced to a string, so it fires.
+	$h->prop = 5;
+}
diff --git a/tests/PHPStan/Node/data/used-as-string.php b/tests/PHPStan/Node/data/used-as-string.php
index 6321eb45366..28bba6470a3 100644
--- a/tests/PHPStan/Node/data/used-as-string.php
+++ b/tests/PHPStan/Node/data/used-as-string.php
@@ -174,7 +174,22 @@ public function __toString(): string
 
 }
 
+class NonStringableObject
+{
+
+}
+
 function passStringableArgument(StringableObject $obj): void
 {
 	takesString($obj);
 }
+
+function assignObjectsToStringSlots(StringableObject $stringable, NonStringableObject $plain): void
+{
+	$h = new Holder();
+	// strict_types = 1: a Stringable is not coerced to a string, so it does not fire.
+	$h->prop = $stringable;
+	// A non-Stringable object cannot be coerced to a string, so it does not fire
+	// even though the property type allows a string.
+	$h->unionWithString = $plain;
+}