How does Phan compare to PHPStan for PHP static analysis?

Phan prioritizes minimizing false positives and incremental adoption on large codebases, while PHPStan offers more aggressive type inference. Phan requires the php-ast extension, whereas PHPStan does not, making Phan better for teams wary of false alarms.

How to suppress false positives in Phan?

Use the @suppress annotation in PHPDoc comments to ignore specific issue types, or configure Phan to exclude directories or adjust severity levels in the config.php file. This allows targeted control over analysis output.

Does Phan work well with Laravel or Symfony frameworks?

Yes, but it requires proper configuration to handle framework-specific autoloading and magic methods. You may need to add framework directories to the analysis list and use PHPDoc annotations for dynamic properties to avoid missed issues.

How to integrate Phan with GitHub Actions?

Install Phan via Composer in your workflow, set up the config.php file, and run it with output formats like JSON or checkstyle. Use the action's cache to speed up runs and fail the build on critical errors for CI enforcement.

What PHP versions does Phan support for analysis?

Phan 6 supports analyzing PHP version 8.1 to 8.5 syntax, checking for backward incompatibilities and unsupported features. It requires PHP 8.1+ to run, as noted in the getting started section.

How to configure Phan for a legacy codebase?

Start with a basic config using phan --init, then incrementally strengthen analysis by enabling plugins and adjusting strictness settings. Exclude third-party code from analysis to focus on your source, as recommended in the wiki.

Open-Awesome

phan

NOASSERTIONPHP6.0.7

A static analyzer for PHP that minimizes false positives by attempting to prove incorrectness rather than correctness.

Visit Website GitHub

5.6k stars366 forks0 contributors

What is phan?

Phan is a static analyzer for PHP that detects bugs, type errors, and potential issues in code without executing it. It analyzes PHP source files to catch common mistakes like undefined variables, type mismatches, dead code, and PHP version incompatibilities, helping developers improve code reliability and maintainability.

Target Audience

PHP developers and teams working on medium to large codebases who want to catch bugs early, enforce type safety, and gradually improve code quality through static analysis.

Value Proposition

Developers choose Phan for its low false-positive rate, practical approach to analyzing sloppy legacy code, and extensive support for modern PHP features like union types and generics. Its plugin system and editor integration make it highly adaptable to specific project needs.

Overview

Phan is a static analyzer for PHP. Phan prefers to avoid false-positives and attempts to prove incorrectness rather than correctness.

Use Cases

Best For

Finding type mismatches and undefined symbols in PHP applications
Detecting dead code and unused variables to clean up codebases
Ensuring PHP version compatibility when upgrading or maintaining projects
Enforcing code quality standards through customizable plugins
Integrating static analysis into CI/CD pipelines for PHP projects
Analyzing large, existing PHP codebases with minimal configuration

Not Ideal For

Projects relying heavily on eval() or dynamic code generation that bypasses static analysis
Teams needing zero-configuration, real-time linting for small, single-file scripts
Environments where installing PHP extensions like php-ast is restricted or not feasible
Codebases that extensively use magic methods or framework-specific autoloading without PHPDoc annotations

Pros & Cons

Pros

Minimized False Positives

Phan focuses on proving incorrectness rather than correctness, leading to fewer false alarms and making it practical for large, sloppy codebases, as stated in its philosophy.

Advanced Type Support

Supports modern PHP features like union types, generics, and array shapes, along with comprehensive PHPDoc annotation parsing, as detailed in the features list.

Extensible Plugin System

Allows custom checks via plugins for regex validation, printf formatting, and coding style, with several bundled plugins available for immediate use.

Incremental Adoption Friendly

Designed to be configured with varying strictness levels, enabling teams to gradually strengthen analysis as code quality improves, per the wiki guidance.

Cons

Requires php-ast Extension

Phan depends on the php-ast extension for optimal parsing, which must be installed separately and may not be available in all hosting or CI environments.

Configuration Overhead

Setting up involves creating a detailed config.php file and managing directory lists, which can be complex for projects with intricate structures or legacy code.

Limited Flow Control Analysis

The README admits Phan has a good but not comprehensive understanding of flow control, potentially missing issues in complex conditional logic or dynamic value tracking.

Frequently Asked Questions

Related Projects

PHPStan

PHP Static Analysis Tool - discover bugs in your code without running it!

Stars14,100

Forks961

Last commit11 hours ago

Larastan

⚗️ Adds code analysis to Laravel improving developer productivity and code quality.

Stars6,499

Forks505

Last commit15 hours ago

Psalm

A PHP static analysis tool for finding errors and security vulnerabilities in PHP applications

Stars5,889

Forks709

Last commit1 month ago

Mago

Mago is a toolchain for PHP that aims to provide a set of tools to help developers write better code.

Stars3,427

Forks183

Last commit8 hours ago

Community-curated · Updated weekly · 100% open source

Found a gem we're missing?

Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.

Submit a project Star on GitHub