PHP Protected Method

A protected method in PHP is a class method bound by an access modifier that restricts its visibility strictly to the defining class, its parent classes, and its derived (child) classes. Crucially, PHP’s visibility model is class-scoped rather than instance-scoped. This means access restrictions are evaluated based on the type of the calling class, allowing objects of the exact same class type to access each other’s protected methods.

Syntax Declaration

The protected keyword is placed before the function keyword in the method signature.

class BaseClass {
    protected function processData(): void {
        // Method implementation
    }
}

Visibility and Access Mechanics

The PHP engine enforces strict invocation rules for protected methods during runtime:

Internal Invocation: The method can be called from within the class that defines it using the $this-> pseudo-variable.
Inherited Invocation: Derived classes can invoke the method using $this-> (if not overridden) or the parent:: scope resolution operator.
Cross-Instance Invocation: Because visibility is evaluated at the class level, an object can invoke a protected method on a completely different instance, provided both instances share the same class type.
External Invocation: Attempting to call a protected method on an instantiated object from outside the class hierarchy (e.g., from the global scope) results in a fatal error.

class Core {
    protected function initialize(): string {
        return "Initialized";
    }

    public function inspectOther(Core $otherInstance): string {
        // Valid: Cross-instance access. Calling a protected method on 
        // a different instance of the same class type.
        return $otherInstance->initialize();
    }
}

class Extension extends Core {
    public function run(): string {
        // Valid: Invoked from within a derived class
        return $this->initialize(); 
    }
}

$instanceA = new Extension();
$instanceB = new Core();

$instanceA->run();                  // Valid: Returns "Initialized"
$instanceB->inspectOther($instanceA); // Valid: Returns "Initialized" (Cross-instance)

// Fatal Error: Call to protected method Core::initialize() from global scope
$instanceA->initialize(); 

Overriding Rules and Signature Validation

When a derived class overrides a protected method from a parent class, PHP enforces visibility constraints based on the Liskov Substitution Principle. The overriding method must either maintain the protected access level or weaken it to public. It cannot be strengthened to private.

class ParentClass {
    protected function executeTask(): void {}
}

class ValidChild extends ParentClass {
    // Valid: Visibility weakened from protected to public
    public function executeTask(): void {}
}

class InvalidChild extends ParentClass {
    // Fatal Error: Access level to InvalidChild::executeTask() must be protected (as in class ParentClass) or weaker
    private function executeTask(): void {}
}

Static Protected Methods

The protected modifier can be combined with the static keyword. The same visibility rules apply, but the method is bound to the class itself rather than an object instance. It is invoked using the self::, static:: (for late static binding), or parent:: operators.

class AbstractFactory {
    protected static function getIdentifier(): string {
        return "Factory_A";
    }
}

class ConcreteFactory extends AbstractFactory {
    public static function build(): string {
        // Valid: Accessing protected static method from derived class
        return parent::getIdentifier();
    }
}