PHPMD

What PHPMD is

PHPMD analyzes PHP source code for possible bugs, inefficient code, overly complex expressions and unused parameters, methods or properties. Its predefined rules flag code smells and possible errors, with documented rulesets covering clean code, code size, controversial practices, design, naming and unused code. Teams can add custom rules, and security rules are supported. PHPMD can be used in continuous integration and provides report renderers or options for JSON, SARIF, Checkstyle-compatible, GitHub and GitLab output, including a GitLab renderer for GitLab CI. The project identifies itself as free software under the BSD 3-Clause license. It supports Linux, macOS and Windows, as well as self-hosted use. Installation options documented by the project are a Phar file, PHIVE and Composer. Its download page lists PHP >= 5.3.9 and PHP_Depend >= 2.0.0 as requirements. Phar files are signed with a public key associated with [email protected]. The project names Manuel Pichler as its founder and says he has been involved since 2009. The homepage lists PHPMD 2.15.0, dated 2023/12/11, as its most recent release. The support page directs users to Gitter for help and the issue tracker for bugs or feature requests; commercial support and maintenance are offered through the Tidelift Subscription.

Who it suits

PHPMD suits PHP developers and teams who want automated checks for code smells, possible errors and unused code. Its custom rules and CI support may fit teams that want to incorporate those checks into their own development process.

Getting started

1. Choose an installation route: Phar, PHIVE or Composer.
2. Check that PHP >= 5.3.9 and PHP_Depend >= 2.0.0 meet the listed requirements.
3. Use the predefined rulesets or configure custom rules.
4. Select a report renderer or option, such as JSON, SARIF or GitLab.
5. For help, use the Gitter channel; report bugs or feature requests through the issue tracker.

Verdict

Choose PHPMD for free PHP source analysis with predefined and custom rules, plus CI reporting options. It supports several operating systems and self-hosted use. Look elsewhere if you need automatic fixes or IDE support.