Run php in lint mode from the command line to validate syntax without execution:
php -l FILENAME
Higher-level static analyzers include:
- php-sat – Requires http://strategoxt.org/
- PHP_Depend
- PHP_CodeSniffer
- PHP Mess Detector
- PHPStan
- PHP-CS-Fixer
- phan
Lower-level analyzers include:
- PHP_Parser
- token_get_all (primitive function)
Runtime analyzers, which are more useful for some things due to PHP’s dynamic nature, include:
- Xdebug has code coverage and function traces.
- My PHP Tracer Tool uses a combined static/dynamic approach, building on Xdebug’s function traces.
The documentation libraries phpdoc and Doxygen perform a kind of code analysis. Doxygen, for example, can be configured to render nice inheritance graphs with Graphviz.
Another option is xhprof, which is similar to Xdebug, but lighter, making it suitable for production servers. The tool includes a PHP-based interface.