psalm
A PHP static analysis tool for finding errors and security vulnerabilities in PHP applications
Psalm is a PHP static analysis tool that reads your code before you run it to catch type errors, undefined variables, dead code, and security vulnerabilities like SQL injection, originally built at Vimeo and now open source.
Psalm is a tool that reads PHP code and flags problems before you ever run the program. This kind of tool is called a static analyzer because it works by examining the code itself, not by executing it. It can catch type mismatches (where a value of the wrong kind gets passed to a function), undefined variables, dead code, and a range of security issues like places where untrusted user input could flow into a database query or shell command.
The security analysis feature, called taint analysis, traces a path from where data enters your application (a form submission, a URL parameter) to where it might cause harm if not properly cleaned first. Psalm reports the full path it found so developers know exactly what to fix.
Psalm was originally built by engineers at Vimeo to help manage a large PHP codebase and catch errors that code review alone would miss. It became open source and is now maintained by a single developer, Daniil Gentili. The maintainer offers paid support contracts for teams that want help integrating Psalm into an existing codebase or developing custom features around it.
The README is brief. It points to the project website for documentation, a live demo where you can paste PHP code and see Psalm analyze it immediately, and an installation guide. The tool is installed through PHP's standard package manager, Composer.
If you are a non-technical person evaluating a PHP codebase, knowing that it uses Psalm suggests the team has invested in automated code quality checks, which is generally a sign of a more careful development process.
Where it fits
- Catch type mismatches and undefined variables in a PHP codebase before running the code.
- Trace untrusted user input through your application to find security holes like SQL injection using taint analysis.
- Add automated code quality checks to a PHP project so errors are caught earlier than code review.
- Get paid support for integrating Psalm into a large existing PHP codebase.