title: When exactly is the autoloader called?
body: <p>I have an autoloader that is registered using <code>spl_autoload_register()</code>:</p>
  
  <pre><code>class MyAutoLoader{
     public function __construct(){
         spl_autoload_register(array($this, 'loader'));
     }
  
     public function loader($className){
         var_dump($className);
     }
  }
  
  $al = new MyAutoLoader(); //Register the autoloader
  </code></pre>
  
  <p>From the <code>var_dump()</code>, the autoloader seems to be called on lots of things, things that are data to be inserted into a database, parameterized SQL queries and what not:</p>
  
  <pre><code>string 'name' (length=4)
  
  string 'a:2:{s:5:"label";s:4:"Name";s:8:"required";b:1;}' (length=48)
  
  string 'en_US' (length=5)
  
  string 'object' (length=6)
  
  string 'name = ?' (length=8)
  </code></pre>
  
  <p>These things will never be classes so should never be loaded using <code>new</code> or <code>class_exists()</code>, etc. </p>
  
  <p><strong>Under what circumstances/function calls are autoloaders called?</strong> I would like to put a stop to autoloading "classNames" that are not classes from being called, because each <code>$className</code> is checked using <code>file_exist()</code>, and having these data strings checked is pretty inefficient.</p>
  
  <hr>
  
  <p><strong>Problem resolved.</strong> I first did a back trace as suggested by Brad and dumped the traces to a file (just add a small snippet that opens a file and appends to it).</p>
  
  <p>Obviously, the trace was very big, but I picked the simplest one I could find. Incidentally, that trace happened to be one that called a database (ORM) wrapper I have written to wrap around the awesome <a href="http://www.redbeanphp.com">RedBean</a> ORM library. The results from me dumping <code>$className</code> also validates that, because those strings are data are going into or coming out of the database.</p>
  
  <p>Having said that, I have a <code>__call()</code> that intercepts methods to my database wrapper, does some processing, pass it to RedBean, process the result, and then sends it back to the caller.</p>
  
  <p><strong>Problem: During the processing, I am making calls to <a href="http://php.net/manual/en/function.is-subclass-of.php">is_subclass_of()</a> and <a href="http://php.net/manual/en/language.operators.type.php">instanceof</a>, which will obviously ask the autoloader to try and load the class (since we don't have any class called <code>name =?</code> loaded, nor does it exist).</strong></p>
  
  <p>The solution was to actually make sure we have an <code>object</code> before calling <code>is_subclass_of()</code> and <code>instanceof</code>: <code>if(is_object($someproperty) &amp;&amp; is_subclass_of($someproperty))</code>.</p>
  
  <p>If <code>$someproperty</code> is not an object, the <code>if</code> immediately short-circuits and <code>instanceof</code> and <code>is_subclass_of()</code> is never called, which means the call to the autoloader is never made.</p>
  
  <p>As mentioned by brad, having all sorts of things going to the autoloader to be included using <code>require_once</code> can be a huge security risk and at the same time, hitting the file system so many times using <code>file_exists()</code> is pretty inefficient too.</p>
  
  <p>So, in conclusion, the autoloader is called every time you use <code>instanceof</code>, <code>is_subclass_of</code>, other class-type functions, class-exist functions and reflection methods, as Charles motioned in his answer. </p>
  
  <p><strong>So, the moral of the story is that if you plan to use a class-type function, or any of the functions mentioned above on a variable of mixed type, check it first before passing it to the class-type function.</strong></p>