PHPStan & Psalm

If you’ve ever deployed PHP code only to be blindsided by a typo, type mismatch, or a missing return value, you’re not alone. Dynamic languages like PHP offer fast development cycles, but that flexibility can come at a cost — particularly in large codebases where bugs hide in plain sight. The good news? Static analysis can be your secret weapon.

Static analysis is the process of analyzing your code without executing it. Tools scan the source code to detect bugs, type inconsistencies, dead code, and potential security issues before they become real problems in production.

Unlike unit tests, static analysis doesn’t need a running app or database. It’s like a spell checker for your code — always watching, always judging, and usually right.

PHP has come a long way, especially with recent versions like PHP 8.x introducing better typing, attributes, and more robust syntax. But even modern PHP can suffer from issues that only appear at runtime unless you take preventative measures.

Key Benefits:

• Early Bug Detection: Catch undefined variables, missing return types, or misuse of nullables.
• Improved Code Quality: Enforce consistent coding standards and practices.
• Better Refactoring: Feel confident making changes, knowing static tools will alert you to breakages.
• Team Efficiency: Provide instant feedback to teammates during development or via CI pipelines.

Popular PHP Static Analysis Tools

Here are the most widely adopted tools for static analysis in the PHP ecosystem:

🧠 PHPStan

• Tagline: “PHPStan focuses on finding bugs in your code without running it.”
• Strengths: Great for type checks, dead code detection, and enforcing strict rules.
• How to use:

composer require --dev phpstan/phpstan
vendor/bin/phpstan analyse src

🔍 Psalm

• Developed by Vimeo, Psalm is another excellent static analyzer that also doubles as a type checker.
• Strengths: Deep type inference, supports annotations like @psalm-return, integrates well with IDEs.
• Setup:

composer require --dev vimeo/psalm
vendor/bin/psalm --init
vendor/bin/psalm

🧼 PHP_CodeSniffer + PHP CS Fixer

While technically linters and fixers, these tools help maintain consistent code style — a part of the static analysis ecosystem.

🧑🏼‍💻How to Integrate Static Analysis into Your Workflow

• Install via Composer: Use Composer to install tools locally in your project. This ensures team members use the same version.
• Configure Your Rules: Start with default levels, then gradually increase strictness. PHPStan and Psalm both allow incremental adoption.
• CI/CD Integration: Add analysis as a step in your CI pipeline to prevent regressions. For example, in GitHub Actions:

- name: Run PHPStan
  run: vendor/bin/phpstan analyse src

• IDE Plugins: Tools like Psalm and PHPStan have extensions for PHPStorm and VSCode to show issues as you code.

👉 Best Practices

1. Start with Level 1 or 2, then increase as your code improves.
2. Suppress wisely: Avoid silencing errors unless you’re certain they’re harmless.
3. Leverage annotations: Psalm and PHPStan both support PHPDoc annotations to improve type inference.
4. Don’t rely solely on analysis: Static analysis complements, not replaces, unit and integration testing.

Real-World Example✍️

Imagine this code:

function getUser(int $id): User {
    $user = findUserById($id); // could return null
    return $user; // fatal error at runtime if null
}

With static analysis enabled, tools like PHPStan or Psalm would flag this:

ERROR: ReturnTypeCoercion - getUser: Returning possibly null value from function declared to return User

Without running your app, you’ve caught a critical bug. Static analysis isn’t just for enterprise projects — it’s for anyone who wants fewer bugs, faster development, and more confidence in their code. PHP may be dynamic, but your development process doesn’t have to be chaotic. Bulletproof your PHP code today — one static analysis tool at a time.

Just ask our experts🧑🏼‍💻