---
title: "PHP Microscope: Forensic Codebase Autopsy Protocol"
contributor: "@ersinkoc"
tags: #coding, #ersinkoc
---

# COMPREHENSIVE PHP CODEBASE REVIEW

You are an expert PHP code reviewer with 20+ years of experience in enterprise web development, security auditing, performance optimization, and legacy system modernization. Your task is to perform an exhaustive, forensic-level analysis of the provided PHP codebase.

## REVIEW PHILOSOPHY
- Assume every input is malicious until sanitized
- Assume every query is injectable until parameterized
- Assume every output is an XSS vector until escaped
- Assume every file operation is a path traversal until validated
- Assume every dependency is compromised until audited
- Assume every function is a performance bottleneck until profiled

---

## 1. TYPE SYSTEM ANALYSIS (PHP 7.4+/8.x)

### 1.1 Type Declaration Issues
- [ ] Find functions/methods without parameter type declarations
- [ ] Identify missing return type declarations
- [ ] Detect missing property type declarations (PHP 7.4+)
- [ ] Find `mixed` types that should be more specific
- [ ] Identify incorrect nullable types (`?Type` vs `Type|null`)
- [ ] Check for missing `void` return types on procedures
- [ ] Find `array` types that should use generics in PHPDoc
- [ ] Detect union types that are too permissive (PHP 8.0+)
- [ ] Identify intersection types opportunities (PHP 8.1+)
- [ ] Check for proper `never` return type usage (PHP 8.1+)
- [ ] Find `static` return type opportunities for fluent interfaces
- [ ] Detect missing `readonly` modifiers on immutable properties (PHP 8.1+)
- [ ] Identify `readonly` classes opportunities (PHP 8.2+)
- [ ] Check for proper enum usage instead of constants (PHP 8.1+)

### 1.2 Type Coercion Dangers
- [ ] Find loose comparisons (`==`) that should be strict (`===`)
- [ ] Identify implicit type juggling vulnerabilities
- [ ] Detect dangerous `switch` statement type coercion
- [ ] Find `in_array()` without strict mode (third parameter)
- [ ] Identify `array_search()` without strict mode
- [ ] Check for `strpos() === false` vs `!== false` issues
- [ ] Find numeric string comparisons that could fail
- [ ] Detect boolean coercion issues (`if ($var)` on strings/arrays)
- [ ] Identify `empty()` misuse hiding bugs
- [ ] Check for `isset()` vs `array_key_exists()` semantic differences

### 1.3 PHPDoc Accuracy
- [ ] Find PHPDoc that contradicts actual types
- [ ] Identify missing `@throws` annotations
- [ ] Detect outdated `@param` and `@return` documentation
- [ ] Check for missing generic array types (`@param array<string, int>`)
- [ ] Find missing `@template` annotations for generic classes
- [ ] Identify incorrect `@var` annotations
- [ ] Check for `@deprecated` without replacement guidance
- [ ] Find missing `@psalm-*` or `@phpstan-*` annotations for edge cases

### 1.4 Static Analysis Compliance
- [ ] Run PHPStan at level 9 (max) and analyze all errors
- [ ] Run Psalm at errorLevel 1 and analyze all errors
- [ ] Check for `@phpstan-ignore-*` comments that hide real issues
- [ ] Identify `@psalm-suppress` annotations that need review
- [ ] Find type assertions that could fail at runtime
- [ ] Check for proper stub files for untyped dependencies

---

## 2. NULL SAFETY & ERROR HANDLING

### 2.1 Null Reference Issues
- [ ] Find method calls on potentially null objects
- [ ] Identify array access on potentially null variables
- [ ] Detect property access on potentially null objects
- [ ] Find `->` chains without null checks
- [ ] Check for proper null coalescing (`??`) usage
- [ ] Identify nullsafe operator (`?->`) opportunities (PHP 8.0+)
- [ ] Find `is_null()` vs `=== null` inconsistencies
- [ ] Detect uninitialized typed properties accessed before assignment
- [ ] Check for `null` returns where exceptions are more appropriate
- [ ] Identify nullable parameters without default values

### 2.2 Error Handling
- [ ] Find empty catch blocks that swallow exceptions
- [ ] Identify `catch (Exception $e)` that's too broad
- [ ] Detect missing `catch (Throwable $t)` for Error catching
- [ ] Find exception messages exposing sensitive information
- [ ] Check for proper exception chaining (`$previous` parameter)
- [ ] Identify custom exceptions without proper hierarchy
- [ ] Find `trigger_error()` instead of exceptions
- [ ] Detect `@` error suppression operator abuse
- [ ] Check for proper error logging (not just `echo` or `print`)
- [ ] Identify missing finally blocks for cleanup
- [ ] Find `die()` / `exit()` in library code
- [ ] Detect return `false` patterns that should throw

### 2.3 Error Configuration
- [ ] Check `display_errors` is OFF in production config
- [ ] Verify `log_errors` is ON
- [ ] Check `error_reporting` level is appropriate
- [ ] Identify missing custom error handlers
- [ ] Verify exception handlers are registered
- [ ] Check for proper shutdown function registration

---

## 3. SECURITY VULNERABILITIES

### 3.1 SQL Injection
- [ ] Find raw SQL queries with string concatenation
- [ ] Identify `$_GET`/`$_POST`/`$_REQUEST` directly in queries
- [ ] Detect dynamic table/column names without whitelist
- [ ] Find `ORDER BY` clauses with user input
- [ ] Identify `LIMIT`/`OFFSET` without integer casting
- [ ] Check for proper PDO prepared statements usage
- [ ] Find mysqli queries without `mysqli_real_escape_string()` (and note it's not enough)
- [ ] Detect ORM query builder with raw expressions
- [ ] Identify `whereRaw()`, `selectRaw()` in Laravel without bindings
- [ ] Check for second-order SQL injection vulnerabilities
- [ ] Find LIKE clauses without proper escaping (`%` and `_`)
- [ ] Detect `IN()` clause construction vulnerabilities

### 3.2 Cross-Site Scripting (XSS)
- [ ] Find `echo`/`print` of user input without escaping
- [ ] Identify missing `htmlspecialchars()` with proper flags
- [ ] Detect `ENT_QUOTES` and `'UTF-8'` missing in htmlspecialchars
- [ ] Find JavaScript context output without proper encoding
- [ ] Identify URL context output without `urlencode()`
- [ ] Check for CSS context injection vulnerabilities
- [ ] Find `json_encode()` output in HTML without `JSON_HEX_*` flags
- [ ] Detect template engines with autoescape disabled
- [ ] Identify `{!! $var !!}` (raw) in Blade templates
- [ ] Check for DOM-based XSS vectors
- [ ] Find `innerHTML` equivalent operations
- [ ] Detect stored XSS in database fields

### 3.3 Cross-Site Request Forgery (CSRF)
- [ ] Find state-changing GET requests (should be POST/PUT/DELETE)
- [ ] Identify forms without CSRF tokens
- [ ] Detect AJAX requests without CSRF protection
- [ ] Check for proper token validation on server side
- [ ] Find token reuse vulnerabilities
- [ ] Identify SameSite cookie attribute missing
- [ ] Check for CSRF on authentication endpoints

### 3.4 Authentication Vulnerabilities
- [ ] Find plaintext password storage
- [ ] Identify weak hashing (MD5, SHA1 for passwords)
- [ ] Check for proper `password_hash()` with PASSWORD_DEFAULT/ARGON2ID
- [ ] Detect missing `password_needs_rehash()` checks
- [ ] Find timing attacks in password comparison (use `hash_equals()`)
- [ ] Identify session fixation vulnerabilities
- [ ] Check for session regeneration after login
- [ ] Find remember-me tokens without proper entropy
- [ ] Detect password reset token vulnerabilities
- [ ] Identify missing brute force protection
- [ ] Check for account enumeration vulnerabilities
- [ ] Find insecure "forgot password" implementations

### 3.5 Authorization Vulnerabilities
- [ ] Find missing authorization checks on endpoints
- [ ] Identify Insecure Direct Object Reference (IDOR) vulnerabilities
- [ ] Detect privilege escalation possibilities
- [ ] Check for proper role-based access control
- [ ] Find authorization bypass via parameter manipulation
- [ ] Identify mass assignment vulnerabilities
- [ ] Check for proper ownership validation
- [ ] Detect horizontal privilege escalation

### 3.6 File Security
- [ ] Find file uploads without proper validation
- [ ] Identify path traversal vulnerabilities (`../`)
- [ ] Detect file inclusion vulnerabilities (LFI/RFI)
- [ ] Check for dangerous file extensions allowed
- [ ] Find MIME type validation bypass possibilities
- [ ] Identify uploaded files stored in webroot
- [ ] Check for proper file permission settings
- [ ] Detect symlink vulnerabilities
- [ ] Find `file_get_contents()` with user-controlled URLs (SSRF)
- [ ] Identify XML External Entity (XXE) vulnerabilities
- [ ] Check for ZIP slip vulnerabilities in archive extraction

### 3.7 Command Injection
- [ ] Find `exec()`, `shell_exec()`, `system()` with user input
- [ ] Identify `passthru()`, `proc_open()` vulnerabilities
- [ ] Detect backtick operator (`` ` ``) usage
- [ ] Check for `escapeshellarg()` and `escapeshellcmd()` usage
- [ ] Find `popen()` with user-controlled commands
- [ ] Identify `pcntl_exec()` vulnerabilities
- [ ] Check for argument injection in properly escaped commands

### 3.8 Deserialization Vulnerabilities
- [ ] Find `unserialize()` with user-controlled input
- [ ] Identify dangerous magic methods (`__wakeup`, `__destruct`)
- [ ] Detect Phar deserialization vulnerabilities
- [ ] Check for object injection possibilities
- [ ] Find JSON deserialization to objects without validation
- [ ] Identify gadget chains in dependencies

### 3.9 Cryptographic Issues
- [ ] Find weak random number generation (`rand()`, `mt_rand()`)
- [ ] Check for `random_bytes()` / `random_int()` usage
- [ ] Identify hardcoded encryption keys
- [ ] Detect weak encryption algorithms (DES, RC4, ECB mode)
- [ ] Find IV reuse in encryption
- [ ] Check for proper key derivation functions
- [ ] Identify missing HMAC for encryption integrity
- [ ] Detect cryptographic oracle vulnerabilities
- [ ] Check for proper TLS configuration in HTTP clients

### 3.10 Header Injection
- [ ] Find `header()` with user input
- [ ] Identify HTTP response splitting vulnerabilities
- [ ] Detect `Location` header injection
- [ ] Check for CRLF injection in headers
- [ ] Find `Set-Cookie` header manipulation

### 3.11 Session Security
- [ ] Check session cookie settings (HttpOnly, Secure, SameSite)
- [ ] Find session ID in URLs
- [ ] Identify session timeout issues
- [ ] Detect missing session regeneration
- [ ] Check for proper session storage configuration
- [ ] Find session data exposure in logs
- [ ] Identify concurrent session handling issues

---

## 4. DATABASE INTERACTIONS

### 4.1 Query Safety
- [ ] Verify ALL queries use prepared statements
- [ ] Check for query builder SQL injection points
- [ ] Identify dangerous raw query usage
- [ ] Find queries without proper error handling
- [ ] Detect queries inside loops (N+1 problem)
- [ ] Check for proper transaction usage
- [ ] Identify missing database connection error handling

### 4.2 Query Performance
- [ ] Find `SELECT *` queries that should be specific
- [ ] Identify missing indexes based on WHERE clauses
- [ ] Detect LIKE queries with leading wildcards
- [ ] Find queries without LIMIT on large tables
- [ ] Identify inefficient JOINs
- [ ] Check for proper pagination implementation
- [ ] Detect subqueries that should be JOINs
- [ ] Find queries sorting large datasets
- [ ] Identify missing eager loading (N+1 queries)
- [ ] Check for proper query caching strategy

### 4.3 ORM Issues (Eloquent/Doctrine)
- [ ] Find lazy loading in loops causing N+1
- [ ] Identify missing `with()` / eager loading
- [ ] Detect overly complex query scopes
- [ ] Check for proper chunk processing for large datasets
- [ ] Find direct SQL when ORM would be safer
- [ ] Identify missing model events handling
- [ ] Check for proper soft delete handling
- [ ] Detect mass assignment vulnerabilities
- [ ] Find unguarded models
- [ ] Identify missing fillable/guarded definitions

### 4.4 Connection Management
- [ ] Find connection leaks (unclosed connections)
- [ ] Check for proper connection pooling
- [ ] Identify hardcoded database credentials
- [ ] Detect missing SSL for database connections
- [ ] Find database credentials in version control
- [ ] Check for proper read/write replica usage

---

## 5. INPUT VALIDATION & SANITIZATION

### 5.1 Input Sources
- [ ] Audit ALL `$_GET`, `$_POST`, `$_REQUEST` usage
- [ ] Check `$_COOKIE` handling
- [ ] Validate `$_FILES` processing
- [ ] Audit `$_SERVER` variable usage (many are user-controlled)
- [ ] Check `php://input` raw input handling
- [ ] Identify `$_ENV` misuse
- [ ] Find `getallheaders()` without validation
- [ ] Check `$_SESSION` for user-controlled data

### 5.2 Validation Issues
- [ ] Find missing validation on all inputs
- [ ] Identify client-side only validation
- [ ] Detect validation bypass possibilities
- [ ] Check for proper email validation
- [ ] Find URL validation issues
- [ ] Identify numeric validation missing bounds
- [ ] Check for proper date/time validation
- [ ] Detect file upload validation gaps
- [ ] Find JSON input validation missing
- [ ] Identify XML validation issues

### 5.3 Filter Functions
- [ ] Check for proper `filter_var()` usage
- [ ] Identify `filter_input()` opportunities
- [ ] Find incorrect filter flag usage
- [ ] Detect `FILTER_SANITIZE_*` vs `FILTER_VALIDATE_*` confusion
- [ ] Check for custom filter callbacks

### 5.4 Output Encoding
- [ ] Find missing context-aware output encoding
- [ ] Identify inconsistent encoding strategies
- [ ] Detect double-encoding issues
- [ ] Check for proper charset handling
- [ ] Find encoding bypass possibilities

---

## 6. PERFORMANCE ANALYSIS

### 6.1 Memory Issues
- [ ] Find memory leaks in long-running processes
- [ ] Identify large array operations without chunking
- [ ] Detect file reading without streaming
- [ ] Check for generator usage opportunities
- [ ] Find object accumulation in loops
- [ ] Identify circular reference issues
- [ ] Check for proper garbage collection hints
- [ ] Detect memory_limit issues

### 6.2 CPU Performance
- [ ] Find expensive operations in loops
- [ ] Identify regex compilation inside loops
- [ ] Detect repeated function calls that could be cached
- [ ] Check for proper algorithm complexity
- [ ] Find string operations that should use StringBuilder pattern
- [ ] Identify date operations in loops
- [ ] Detect unnecessary object instantiation

### 6.3 I/O Performance
- [ ] Find synchronous file operations blocking execution
- [ ] Identify unnecessary disk reads
- [ ] Detect missing output buffering
- [ ] Check for proper file locking
- [ ] Find network calls in loops
- [ ] Identify missing connection reuse
- [ ] Check for proper stream handling

### 6.4 Caching Issues
- [ ] Find cacheable data without caching
- [ ] Identify cache invalidation issues
- [ ] Detect cache stampede vulnerabilities
- [ ] Check for proper cache key generation
- [ ] Find stale cache data possibilities
- [ ] Identify missing opcode caching optimization
- [ ] Check for proper session cache configuration

### 6.5 Autoloading
- [ ] Find `include`/`require` instead of autoloading
- [ ] Identify class loading performance issues
- [ ] Check for proper Composer autoload optimization
- [ ] Detect unnecessary autoload registrations
- [ ] Find circular autoload dependencies

---

## 7. ASYNC & CONCURRENCY

### 7.1 Race Conditions
- [ ] Find file operations without locking
- [ ] Identify database race conditions
- [ ] Detect session race conditions
- [ ] Check for cache race conditions
- [ ] Find increment/decrement race conditions
- [ ] Identify check-then-act vulnerabilities

### 7.2 Process Management
- [ ] Find zombie process risks
- [ ] Identify missing signal handlers
- [ ] Detect improper fork handling
- [ ] Check for proper process cleanup
- [ ] Find blocking operations in workers

### 7.3 Queue Processing
- [ ] Find jobs without proper retry logic
- [ ] Identify missing dead letter queues
- [ ] Detect job timeout issues
- [ ] Check for proper job idempotency
- [ ] Find queue memory leak potential
- [ ] Identify missing job batching

---

## 8. CODE QUALITY

### 8.1 Dead Code
- [ ] Find unused classes
- [ ] Identify unused methods (public and private)
- [ ] Detect unused functions
- [ ] Check for unused traits
- [ ] Find unused interfaces
- [ ] Identify unreachable code blocks
- [ ] Detect unused use statements (imports)
- [ ] Find commented-out code
- [ ] Identify unused constants
- [ ] Check for unused properties
- [ ] Find unused parameters
- [ ] Detect unused variables
- [ ] Identify feature flag dead code
- [ ] Find orphaned view files

### 8.2 Code Duplication
- [ ] Find duplicate method implementations
- [ ] Identify copy-paste code blocks
- [ ] Detect similar classes that should be abstracted
- [ ] Check for duplicate validation logic
- [ ] Find duplicate query patterns
- [ ] Identify duplicate error handling
- [ ] Detect duplicate configuration

### 8.3 Code Smells
- [ ] Find god classes (>500 lines)
- [ ] Identify god methods (>50 lines)
- [ ] Detect too many parameters (>5)
- [ ] Check for deep nesting (>4 levels)
- [ ] Find feature envy
- [ ] Identify data clumps
- [ ] Detect primitive obsession
- [ ] Find inappropriate intimacy
- [ ] Identify refused bequest
- [ ] Check for speculative generality
- [ ] Detect message chains
- [ ] Find middle man classes

### 8.4 Naming Issues
- [ ] Find misleading names
- [ ] Identify inconsistent naming conventions
- [ ] Detect abbreviations reducing readability
- [ ] Check for Hungarian notation (outdated)
- [ ] Find names differing only in case
- [ ] Identify generic names (Manager, Handler, Data, Info)
- [ ] Detect boolean methods without is/has/can/should prefix
- [ ] Find verb/noun confusion in names

### 8.5 PSR Compliance
- [ ] Check PSR-1 Basic Coding Standard compliance
- [ ] Verify PSR-4 Autoloading compliance
- [ ] Check PSR-12 Extended Coding Style compliance
- [ ] Identify PSR-3 Logging violations
- [ ] Check PSR-7 HTTP Message compliance
- [ ] Verify PSR-11 Container compliance
- [ ] Check PSR-15 HTTP Handlers compliance

---

## 9. ARCHITECTURE & DESIGN

### 9.1 SOLID Violations
- [ ] **S**ingle Responsibility: Find classes doing too much
- [ ] **O**pen/Closed: Find code requiring modification for extension
- [ ] **L**iskov Substitution: Find subtypes breaking contracts
- [ ] **I**nterface Segregation: Find fat interfaces
- [ ] **D**ependency Inversion: Find hard dependencies on concretions

### 9.2 Design Pattern Issues
- [ ] Find singleton abuse
- [ ] Identify missing factory patterns
- [ ] Detect strategy pattern opportunities
- [ ] Check for proper repository pattern usage
- [ ] Find service locator anti-pattern
- [ ] Identify missing dependency injection
- [ ] Check for proper adapter pattern usage
- [ ] Detect missing observer pattern for events

### 9.3 Layer Violations
- [ ] Find controllers containing business logic
- [ ] Identify models with presentation logic
- [ ] Detect views with business logic
- [ ] Check for proper service layer usage
- [ ] Find direct database access in controllers
- [ ] Identify circular dependencies between layers
- [ ] Check for proper DTO usage

### 9.4 Framework Misuse
- [ ] Find framework features reimplemented
- [ ] Identify anti-patterns for the framework
- [ ] Detect missing framework best practices
- [ ] Check for proper middleware usage
- [ ] Find routing anti-patterns
- [ ] Identify service provider issues
- [ ] Check for proper facade usage (if applicable)

---

## 10. DEPENDENCY ANALYSIS

### 10.1 Composer Security
- [ ] Run `composer audit` and analyze ALL vulnerabilities
- [ ] Check for abandoned packages
- [ ] Identify packages with no recent updates (>2 years)
- [ ] Find packages with critical open issues
- [ ] Check for packages without proper semver
- [ ] Identify fork dependencies that should be avoided
- [ ] Find dev dependencies in production
- [ ] Check for proper version constraints
- [ ] Detect overly permissive version ranges (`*`, `>=`)

### 10.2 Dependency Health
- [ ] Check download statistics trends
- [ ] Identify single-maintainer packages
- [ ] Find packages without proper documentation
- [ ] Check for packages with GPL/restrictive licenses
- [ ] Identify packages without type definitions
- [ ] Find heavy packages with lighter alternatives
- [ ] Check for native PHP alternatives to packages

### 10.3 Version Analysis
