Glossary

Static Analysis (PHPStan, Psalm)

Static analysis is automatic code checking without executing it. It finds type errors, unreachable code, and incorrect method calls during CI — before a bug reaches production.

PHPStan

The most popular PHP analyser. 10 strictness levels (0–10). Level 0 covers basic errors; level 9 checks every line for type correctness.

vendor/bin/phpstan analyse src --level=6

Psalm

An alternative from Vimeo. Stricter, supports @template generics and taint analysis (detecting SQL injection and XSS through data flow).

What it finds

Calling a method on a null value
Passing the wrong type to a function
Unreachable code after a return
Unused variables and imports
Non-exhaustive match expressions