Hacker News

by Ryan Harman

Psalm 7 release: PHP security&static analysis software (psalm.dev)

67 points by danogentili 2 days ago

idoubtit 4 hours ago

For anyone not familiar with PHP, static analysis is pretty much required because the official PHP type system is minimal. The detailed types are added through phpdoc comments, and they also help IDEs to provide a sane completion. For instance, the plain "array" should be detailed with phpdoc:

    /**
     * @param array<string, MyRecord> $input
     * @return list<int>
     */
    function foo(array $input): array
    {
        foreach ($input as $string => $record) {
            // IDE knows $record is an instance of MyRecord
The static analysis will use both type systems, and it's the only way to check that phpdoc are consistent. Psalm has various levels of strictness, and even at a very lax level, it can help detect errors or code smells.

There are two major static analysis tools for PHP, Psalm and PHPstan, both written in PHP. The latter used to be much slower, but last time I tried it there was little difference (about 20 s for 100k lines + dependencies).

My guess is that a new contender, Mago, written in Rust, will probably soon replace those other tools. Its commands (analyze, lint) are already almost as complete as psalm/phpstan. Though the migration won't be easy because it does not have a notion of levels.

bel8 4 hours ago

PHP type system is lacking but I wouldn't call it minimal.

PHP even has union types, just like TypeScript.

The major issue is the lack of array types and it's 90% of the reason I see projects using extra linting tools.

[1] https://php.watch/versions/8.0/union-types

someothherguyy a minute ago

it has union types, but it is nothing like typescript

Timon3 3 hours ago

> PHP type system is lacking but I wouldn't call it minimal.

PHP still doesn't have generics, right? IMO any type system without higher-order types is definitely on the minimal side.

eithed 2 hours ago

wesammikhail 4 hours ago

That's exactly it but PHP Core refuses to address the typed array issue in wait for a consensus on Generics even though those two things serve different audiences.

I haven't actually run into a single issue with PHP's type system in the last few years. Literally the only thing that remains is typed arrays but that seems to be ways off due to fragmentation in how the core devs want it handled.

hparadiz 4 hours ago

anthk 6 hours ago

Thou shall use the Rust rewrite of PHP.

hiccuphippo 2 hours ago

Why not skip the php and write rust directly?

Y-bar 5 hours ago

”Rewrite in Rust” fanboys are more annoying than crypto bros. How is such a feat even possible?

scronkfinkle 3 hours ago

I dunno,unlike the crypto/NFT era, Rust rewrites have demonstrated measured performance and memory savings gains. Some grimace when they see "written in Rust" as a tagline but my immediate thought tends to land more on the "thank God this isn't an electron app" side of things

Y-bar 2 hours ago

RunSet 2 hours ago

Google funding, I suspect. One day they will turn off the tap and the mantra will be silenced.

"Strange; seems like all I hear about these days are projects funded by the world's largest advertising corporation."

wesammikhail 4 hours ago

inb4 "Rewrite bitcoin in Rust" comments stars pouring in

origini 6 hours ago

Ah boy o boy, PHP was the first lanuage I teached myself but man it still needs PHPDoc comment on return types?

Come on PHP has so many shitty things, but even something basic like this is still not in the lanuage itself?

pkkm 2 hours ago

PHP does have return type annotations. The reason the PHPDoc comments are needed here is that it lacks generics. Unfortunately, adding generics has proven problematic, but I still hope that we'll see them in the next few years.

monster_truck 6 hours ago

It's had return type declarations since 7. There's even intersection and literal types now. You could have typed this into google and it would have told you

origini 5 hours ago

I did and it told me that it doesn't support typed arrays.

bakugo 5 hours ago

Type declarations are still quite limited, though. For example, you can declare that a function returns an array or a string, but not an array of strings.

lofaszvanitt 5 hours ago

Y-bar 6 hours ago

TFA even shows examples of native return types. How could you not see that?

origini 5 hours ago

The page itself shows plenty of examples were this is not true.

Including generic type arrays which is not supported.

throw1234567891 5 hours ago

"Taught", not "teached".

spiderfarmer 5 hours ago

"Cool! A PHP article on HN, let's rehash some of my comments that got lots of upvotes 11 years ago!"

origini 5 hours ago

Yepp, especially because not much changed and other languages did quite a lot. Strong contrast don't you think?

wesammikhail 4 hours ago