Weave Code
Phpstan Banned Code Laravel Package
ekino/phpstan-banned-code
PHPStan extension to ban unwanted code in your project. Detects calls like var_dump, dd, eval, exit/die, echo/print, shell exec/backticks, and even “use” imports from Tests in non-test files. Configurable rules for CI enforcement.
Detected banned code using PHPStan
Frequently asked questions about Phpstan Banned Code
- How do I install PHPStan Banned Code in a Laravel project?
- Run `composer require --dev ekino/phpstan-banned-code` and include the extension in your PHPStan config by adding `includes: - vendor/ekino/phpstan-banned-code/extension.neon` to your `phpstan.neon` file. If using the extension-installer, no extra steps are needed.
- Which Laravel versions does this package support?
- This package works with Laravel 9+ and is compatible with PHP 8.0–8.4. It’s designed as a PHPStan extension, so it integrates with any Laravel project already using PHPStan for static analysis.
- Can I customize which functions are banned (e.g., allow `echo` in CLI but not web)?
- Yes. Configure granular rules in `phpstan.neon` under `parameters.banned_code.nodes`. For example, disable `Stmt_Echo` for CLI scripts by excluding specific directories or using `non_ignorable: false` for selective enforcement.
- Will this break my CI pipeline if banned code is detected?
- By default, errors are non-ignorable, so they’ll block builds. To mitigate this, set `non_ignorable: false` in your config or use PHPStan’s baseline feature to suppress known issues temporarily while refactoring.
- Does this package work with Laravel’s debug tools like `dd()` or `dump()`?
- Yes, it explicitly detects `dd()`, `dump()`, and similar functions. You can ban them entirely or whitelist them in test files by configuring `use_from_tests: true` and excluding non-test directories.
- How do I handle false positives, like `var_dump` in legacy code?
- Use PHPStan’s baseline feature to ignore existing banned code temporarily. For new projects, enable `non_ignorable: true` and refactor incrementally. Tools like Rector can automate replacements (e.g., `echo` → `response()->json()`).
- Can I enforce stricter rules in production vs. development?
- Yes. Use environment-specific `phpstan.neon` configs (e.g., `phpstan.prod.neon`) and enable stricter rules like `use_from_tests: false` or additional banned functions in production builds.
- What’s the performance impact of running this in CI?
- Minimal. The package runs during static analysis (compile-time) and adds negligible overhead. Benchmark with `phpstan analyze --generate-report`—tests show <5% impact on typical Laravel projects.
- Are there alternatives to PHPStan Banned Code for Laravel?
- If you’re not using PHPStan, consider Psalm (similar extensibility) or PHP-CS-Fixer (for style rules). For runtime checks, custom scripts or Laravel’s `app.debug` flag can block debug tools, but they lack AST precision.
- How do I add custom banned functions (e.g., Laravel’s `abort()` in production)?
- Extend the package by adding custom rules via PHPStan’s `addRule()` method. For example, ban `abort()` in non-test files by defining a new `Expr_FuncCall` node with `functions: [abort]` in your config.
Weaver
How can I help you explore Laravel packages today?