review-phplisted

# Review PHP Correctness and security review for PHP. PHP's defaults are permissive and its superglobals put attacker-controlled data one variable away from every sink in the file, so data flow is where the review lives. The checklist runs whether or not any tool is installed. ## Procedure Follow `../../references/procedure.md`. Probe, scope, run what exists, walk the checklist by hand, score per `../../references/rubric.md`, emit both artifacts. ## Capability probe ```bash command -v php command -v phpstan command -v composer ``` | Tool | Invocation | If absent | |---|---|---| | `php -l` | `php -l <file>` — one file per invocation | install PHP; nothing else here runs without it | | `phpstan` | `phpstan analyse --level max <paths>` | `composer require --dev phpstan/phpstan`, or `vendor/bin/phpstan` if already vendored | | `composer audit` | `composer audit` — needs a `composer.lock` in scope | `composer install` first, or note the project does not use Composer | Several missing at once? The suite ships `review-tools.sh`, which probes and installs the whole toolchain in one pass. **Name it in `## Checks skipped` and leave running it to the user** — a review reports, it does not install. Check `vendor/bin/` before concluding a tool is absent — PHP projects vendor their tooling far more often than they install it globally. `php -l` reports syntax errors only; a clean lint says nothing about the checklist below. A missing `composer.lock` means `composer audit` did not r