Phan is a static analyzer for PHP that prefers to minimize false-positives. Phan attempts to prove incorrectness rather than correctness.
Phan looks for common issues and will verify type compatibility on various operations when type
information is available or can be deduced. Phan has a good (but not comprehensive) understanding of flow control
and can track values in a few use cases (e.g. arrays, integers, and strings).
Getting Started
The easiest way to use Phan is via Composer.
composer require phan/phan
With Phan installed, you can start analyzing your code immediately! Phan includes built-in stubs for enhanced type checking of PHP extensions.
For new projects, use phan --init to create a .phan/config.php file with recommended settings and bundled stubs. You can also manually create a config file if you prefer. Once configured, you can run it via ./vendor/bin/phan.
Phan 6 requires PHP 8.1+ with the php-ast extension (1.1.3+ is required for PHP 8.4+ support) and supports analyzing PHP version 8.1-8.5 syntax.
Installation instructions for php-ast can be found here.
(Phan can be used without php-ast by using the CLI option --allow-polyfill-parser, but there are slight differences in the parsing of doc comments)
- Alternative Installation Methods
See Getting Started for alternative methods of using
Phan and details on how to configure Phan for your project.
- Incrementally Strengthening Analysis
Take a look at Incrementally Strengthening Analysis for some tips on how to slowly ramp up the strictness of the analysis as your code becomes better equipped to be analyzed.
- Installing Dependencies
Take a look at Installing Phan Dependencies for help getting Phan's dependencies installed on your system.
The Wiki has more information about using Phan.
Tolerant parser dependency
Phan relies on phan/phan-tolerant for the fallback parser and language-server mapping. The project is now consumed as a Composer dependency (microsoft/tolerant-php-parser, overridden to our fork via the repository entry in composer.json) rather than via a vendored subtree.
To run the tolerant parser’s own PHPUnit suites, install its dev dependencies and invoke PHPUnit from the dependency directory:
composer install
cd vendor/microsoft/tolerant-php-parser
composer install
php -d zend.assertions=1 -d assert.exception=1 vendor/bin/phpunit --testsuite invariants,api
When you need to refresh the parser to a newer commit, adjust the constraint in composer.json (or run composer update microsoft/tolerant-php-parser) and commit the resulting lockfile change.
Features
Phan is able to perform the following kinds of analysis:
This is the beginning of the README. Read the rest at the original. Read the full README ↗
