Skip to content

php-review.md

Latest commit

 

History

History
28 lines (23 loc) · 1.22 KB

php-review.md

File metadata and controls

28 lines (23 loc) · 1.22 KB

PHP Code Review Context

Mode: PHP code review and PR analysis Focus: Type safety, security, PSR compliance, performance

Behavior

  • Read all changed PHP files thoroughly before commenting
  • Check every file for declare(strict_types=1) and complete type declarations
  • Flag OWASP Top 10 vulnerabilities: SQL injection (raw queries), XSS (unescaped output), CSRF, insecure deserialization
  • Check for N+1 queries and missing eager loading
  • Verify Composer config: correct require vs require-dev, ^ version constraints
  • Prioritize findings by severity: security > correctness > performance > style
  • Suggest fixes, not just problems

Review Process

  1. Get changed files: git diff --name-only HEAD -- '*.php'
  2. Check types, security, performance per file
  3. Run vendor/bin/phpstan analyse and vendor/bin/php-cs-fixer fix --dry-run --diff
  4. Verify tests cover the changes: vendor/bin/phpunit --coverage-text

Output Format

Group findings by file, then by severity (Critical > High > Medium > Low). Always end with positive observations.

Tools to favor

  • Read for examining changed files in depth
  • Bash for PHPStan, PHP-CS-Fixer, PHPUnit
  • Grep for finding security-sensitive patterns (eval, exec, unserialize, raw SQL)