PHP Code Quality with PHPStan, PHP-CS-Fixer, and Composer Audit

This practical PHP 8.5 tutorial explains PHP Code Quality with PHPStan, PHP-CS-Fixer, and Composer Audit with a small reproducible lab, strict types, secure defaults, verification, and production troubleshooting.

1. Prepare the project

mkdir php-lab
cd php-lab
printf "vendor/n.envnvar/n" > .gitignore
php -v
php -m

2. Implement the example

<?php
declare(strict_types=1);
final readonly class ServerStatus {
    public function __construct(public string $name, public bool $healthy) {}
}
$status = new ServerStatus('api-1', true);
echo json_encode($status, JSON_THROW_ON_ERROR | JSON_PRETTY_PRINT);

Save the example in app.php. Use declare(strict_types=1), validate data at trust boundaries, prefer explicit dependencies, and avoid hidden global state.

3. Run the lab

composer require --dev phpstan/phpstan friendsofphp/php-cs-fixer
vendor/bin/phpstan analyse src --level=8
vendor/bin/php-cs-fixer check --diff

4. Verify the result

composer validate --strict
composer audit

Verify real behavior, not only a zero exit status. Inspect HTTP status and headers, database changes, service logs, file permissions, memory use, and graceful shutdown where applicable.

Troubleshooting

Start with php -l, php --ini, and php -m. Confirm the CLI and PHP-FPM use the intended version and configuration. Then inspect permissions, environment variables, dependency lockfiles, extensions, FPM and web-server logs, upstream connectivity, and timeouts.

Security and production checklist

• Supported PHP and exact Composer dependencies are recorded.
• Output is escaped for its HTML context and SQL uses prepared statements.
• Authentication, authorization, CSRF, session cookies, upload limits, and SSRF controls are explicit.
• display_errors is disabled in production while errors are logged securely.
• Tests, static analysis, health checks, backups, resource limits, upgrades, and rollback are verified.

References: PHP manual, supported PHP versions, and Composer documentation.