5 ms·

Dear Lazyweb, the `Controler' part of my main codebase consists of interwoven PHP and MySQL. Is there static analysis tool that understands both, one in relati

by dexen 14y ago

Dear Lazyweb, the `Controler' part of my main codebase consists of interwoven PHP and MySQL. Is there static analysis tool that understands both, one in relation to the other?

Too 14y ago
Good question, there aren't exactly any good tools that interweave several languages into the same environment. Not just for php-mysql but also for php-html or html-javascript or php-javascript. Phpstorm gives you intellisense for sql-strings embedded in your php code but that's the most advanced cross-language-feature i've seen, except for LINQ in C#. Imagine a tool that could analyze this: //sql table T having columns int x, string y //php $data = sql_fetch_from_column(T) //javascript var d = <?=json_encode($data)?> for(a in d) var b = a.x / a.y; //Type error, int division by string not defined
Darmani 14y ago
The closest thing I'm aware of is a tool by the University of Tartu which does this for Java, described in the paper "An Interactive Tool for Analyzing Embedded SQL Quries." It can find the SQL errors (misspelled "name" and missing space before "AND") in the following code: public Statement ageFilter(int minimalAge) throws SQLException { Connection conn = getConnection(); String sql = "SELECT name FROM people WHERE nmae IS NOT NULL"; if (minimalAge > 0) sql += "AND (age >= " + minimalAge + ")"; return conn.prepareStatement(sql); } There are a lot of really interesting challenges in doing this. Their tool uses a powerful technique called "abstract parsing" which can analyze all possible parse trees created by running the SQL parser on a string produced by Java string operations. It's pretty impressive what modern static analysis can do, and just how weak the linters we've gotten used to are in comparison.
mark_story 14y ago
Probably not, but you might want to give phpcpd, pdepend and pmd a try. They're all open source static analysis tools for PHP, and will find a number of potential issues. I also find getting a good set of rules for phpcs is extremely helpful in PHP. You can use its sniffs to catch past mistakes and enforce consistent coding standards.

by dexen 14y ago

Dear Lazyweb, the `Controler' part of my main codebase consists of interwoven PHP and MySQL. Is there static analysis tool that understands both, one in relation to the other?

Too 14y ago

Good question, there aren't exactly any good tools that interweave several languages into the same environment. Not just for php-mysql but also for php-html or html-javascript or php-javascript. Phpstorm gives you intellisense for sql-strings embedded in your php code but that's the most advanced cross-language-feature i've seen, except for LINQ in C#. Imagine a tool that could analyze this: //sql table T having columns int x, string y //php $data = sql_fetch_from_column(T) //javascript var d = <?=json_encode($data)?> for(a in d) var b = a.x / a.y; //Type error, int division by string not defined

Darmani 14y ago

The closest thing I'm aware of is a tool by the University of Tartu which does this for Java, described in the paper "An Interactive Tool for Analyzing Embedded SQL Quries." It can find the SQL errors (misspelled "name" and missing space before "AND") in the following code: public Statement ageFilter(int minimalAge) throws SQLException { Connection conn = getConnection(); String sql = "SELECT name FROM people WHERE nmae IS NOT NULL"; if (minimalAge > 0) sql += "AND (age >= " + minimalAge + ")"; return conn.prepareStatement(sql); } There are a lot of really interesting challenges in doing this. Their tool uses a powerful technique called "abstract parsing" which can analyze all possible parse trees created by running the SQL parser on a string produced by Java string operations. It's pretty impressive what modern static analysis can do, and just how weak the linters we've gotten used to are in comparison.

mark_story 14y ago

Probably not, but you might want to give phpcpd, pdepend and pmd a try. They're all open source static analysis tools for PHP, and will find a number of potential issues. I also find getting a good set of rules for phpcs is extremely helpful in PHP. You can use its sniffs to catch past mistakes and enforce consistent coding standards.