How can I perform static code analysis in PHP? [closed]

Is there a static analysis tool for PHP source files?

The binary itself can check for syntax errors, but I’m looking for something that does more, like:

• unused variable assignments
• arrays that are assigned into without being initialized first
• and possibly code style warnings
• …

Run php in lint mode from the command line to validate syntax without execution:

php -l FILENAME

Higher-level static analyzers include:

• php-sat – Requires http://strategoxt.org/
• PHP_Depend
• PHP_CodeSniffer
• PHP Mess Detector
• PHPStan
• PHP-CS-Fixer
• phan

Lower-level analyzers include:

• PHP_Parser
• token_get_all (primitive function)

Runtime analyzers, which are more useful for some things due to PHP’s dynamic nature, include:

• Xdebug has code coverage and function traces.
• My PHP Tracer Tool uses a combined static/dynamic approach, building on Xdebug’s function traces.

The documentation libraries phpdoc and Doxygen perform a kind of code analysis. Doxygen, for example, can be configured to render nice inheritance graphs with Graphviz.

Another option is xhprof, which is similar to Xdebug, but lighter, making it suitable for production servers. The tool includes a PHP-based interface.