www.icosaedro.it

PHPLint-on-line check list

What you should absolutely know to effectively use PHPLint and PHPLint-on-line:

PHPLint is not a bare syntax checker. Instead, it is completely different beast. So do not expect that a source program that simply "works" or passes the "php -l" syntax validation may also pass the PHPLint validation. There are many features of PHP that PHPLint does not (and probably never will) implement because they are either unsafe or do not allow the static validation of the source. If you already know other compiled languages like C, Java or C#, it is better to think at PHPLint as a source compiler rather than a syntax checker, with the only difference that PHPLint does not generate compiled object code.
You must declare the modules (that is, the extensions) your program depends on. PHP provides several modules that implement data bases, cryptography, etc. and even more modules are available from external sources (mostly from PECL). PHPLint must be made aware which of these modules your program needs. This must be done with the require_module meta-code statement. For example:
```
<?php
/*.
	require_module 'standard';
	require_module 'standard_reflection';
	require_module 'spl';
	require_module 'mysql';
	require_module 'hash';
	require_module 'session';
.*/
```
The standard module contains very basic PHP declarations that should be required by any practical PHP program.
include* and require* are disabled in the PHPLint-on-line form for obvious security reasons:
```
<?php
require_once "my/path/mylib.php";  # NOT ALLOWED UNDER PHPLINT-ON-LINE
```
so you may check with PHPLint-on-line only very basic programs that do not depends on external packages. You may download the stand-alone PHPLint program if you want to check more complex programs that may involve several source files.
Always declare function and classes before usage. The declarations of the functions and classes must appear in the source before their usage. So, as a general rule, lower-level functions must appear first, then higher-level functions must appear next:
```
<?php
function parseWord($w){ ... }
function parseLine($l){ ... parseWord() ... }
function parseText($t){  ... parseLine() ... }

# Main program:
$t = (string) $_POST["text"];
parseText($t);
```
For recursive functions and other mutually dependent declarations, see the Recursive declarations chapter of the reference manual.
Declare the signature of each function. The signature includes: the type of each argument; the type of the returned value; the checked exceptions thrown. You may use the specific PHPLint meta-code extension:
```
<?php
/*. void .*/ function f(/*. int .*/ $i, /*. string .*/ $s)
	/*. throws SomeException, AnotherException .*/
{ ... }
```
or you may use a DocBlock as well:
```
<?php
/**
	@param int $i
	@param string $s
	@return void
	@throws SomeException
	@throws AnotherException
*/
function f($i, $s){ ... }
```
For parameters that have a default value, the type of the default value already provides the type of the parameter to PHPLint, so an explicit declaration is not mandatory in this case and can be omitted for brevity:
```
<?php
/*. void .*/ function echoSepLine($c = "*", $n = 80){ ... }
```
Here it is obvious that $c is a string and $n is an int number.
You must cast $_GET[] and $_POST[] to either int or string:
```
<?php
$name = (string) $_POST["name"];
$n = (int) $_POST["n"];
```
This is because these arrays may contain both strings and arrays, so they are declared under PHPLint as arrays of mixed values. Mixed values cannot be practically used under PHPLint and should be converted to some specific actual type according to the intention of the programmer.
The NULL value and the empty array() constructor require a formal type-cast. The formal type-cast /*.(T).*/ tells that the item that follows is intended to be of the exact type T, so avoiding any ambiguity of interpretation. For example:
```
<?php
$s = /*. (string) .*/ NULL;
$a = /*. (float[int]) .*/ array();
/*. void .*/ function g($a = /*. (string[int]) .*/ array()){ ... }
```
Note that this type-cast is allowed only in front to the NULL value and the empty array constructor, and it is not allowed in any other context.
Variable-variables $$v are not allowed.
Variable functions $f() are not allowed.
Variable classes new $myclass() are not allowed.

Safe string comparison must be made with ===, !== and strcmp(). Do not use the weak comparison operators ==, != and < because their behavior is very difficult to predict and it is practically unreliable. You must then map the invalid expressions according this practical table (we assume $a and $b be two variables of the string type):


WRONG GOOD
if( $a == $b )... if( $a === $b )...
if( $a == "foo" )... if( $a === "foo" )...
if( $a != $b )... if( $a !== $b )...
if( $a < $b )... if( strcmp($a,$b) < 0 )...
if( $a <= $b )... if( strcmp($a,$b) <= 0 )...

WRONG	GOOD
`if( $a == $b )...`	`if( $a === $b )...`
`if( $a == "foo" )...`	`if( $a === "foo" )...`
`if( $a != $b )...`	`if( $a !== $b )...`
`if( $a < $b )...`	`if( strcmp($a,$b) < 0 )...`
`if( $a <= $b )...`	`if( strcmp($a,$b) <= 0 )...`

The if(EXPR) statement requires a strictly boolean expression. Then

<?php
$s = "some string";
if( ! $s ){ ... }  # WRONG

is not allowed. Choose one of these alternatives instead, depending on what you are really testing for:

<?php
$s = "some string";
if( $s === NULL ){ ... }  # if $s is NULL.
if( $s === "" ){ ... }  # if $s is the empty string.
if( strlen($s) == 0 ){ ... }  # if $s is NULL or empty.

Concrete examples of simple, typical PHP programs are available from the PHPLint on-line mask; even more examples of more or less complex PHP programs are available along with the PHPLint Standard Library.

PHPLint-on-line check list

Further readings