Static Analysis with PHPStan and Psalm

PHPStan and Psalm analyze code without running it, catching undefined methods, wrong types, null access and dead code. They understand PHPDoc generics (array<int, User>, list<string>, Collection<User>) and framework plugins (Larastan for Laravel, phpstan-symfony, phpstan-doctrine). Start at a low level, generate a baseline for existing errors, and raise levels over time so new code is held to the strictest standard.

# phpstan.neon
parameters:
  level: 8
  paths:
    - src
    - tests
includes:
  - phpstan-baseline.neon

/**
 * @param list<OrderLine> $lines
 * @return array<string, int> totals keyed by currency
 */
function totalsByCurrency(array $lines): array { /* ... */ }

vendor/bin/phpstan analyse --generate-baseline   # accept current errors, block new ones
vendor/bin/phpstan analyse

Common pitfalls

• Ignoring errors with broad ignoreErrors patterns instead of fixing or baselining.
• Missing framework extensions, causing false positives on magic methods.
• Never revisiting the baseline.

Key points

• Catch type and null bugs before runtime
• Use generics in PHPDoc
• Baseline legacy errors, raise levels gradually

Further reading: PHPStan user guide