Static Analysis Saved My Code Tonight
summary
Claims concrete results: an AST-based checks pipeline finds undefined properties, dead branches, and magic-number clusters; migration scanners (php7cc) flag removed functions and behavior changes for upgrade; security rules trace taint from $_GET to SQL sinks (RIPS-style) and report exploitable paths. A survey surfaces 68 tools scanned and recommends picking ~10 rules; practical timings: PHPStan runs in minutes while whole-repo audits take ~20 minutes, letting teams automate fixes and PHP 7 readiness.
AI-written summary · about
chapters (21)
- 0:00Introduction
- 3:16Pitch B Code
- 5:28Why to Default
- 8:35How Technology Works
- 11:23Abstract Syntax Tree
- 14:26Flow Control Graph
- 15:30Dependency Graph
- 18:55PHP as a Database
- 19:51Static Analysis Categories
- 20:13Migration Tools
- 22:18Migration Report
- 23:37Code Quality Tools
- 26:14Security Tools
- 27:38Mexico
- 28:40Matrix
- 29:04Pitch Metrics
- 30:25Pitch Key Matrix
- 33:14Error Messages
- 34:46Spelling
- 42:01ASD
- 44:27Ideas
related talks
50mPractical Advanced Static Analysis
47mStatic Code Analysis: Judging a Forest by Its Trees
55mSquash Bugs with Static Analysis
25mTypes & static analysis are good in PHP
55mReview unknown code with static analysis
32mFrom Zero to Static Analysis Hero
40mBullet-proof projects
45mTesting Strategy with the Help of a Static Analyzer