I am currently working on Magento 2 coding standard checking project.

Is any other tool available, other than PHP_CodeSniffer, to check Magento 2 and PHP coding standing?


4 Answers 4


Magento 2 use ECGM2 coding standard

You can download from here


ECG Magento Code Sniffer Coding Standard is a set of rules and sniffs for PHP_CodeSniffer tool.

It allows automatically check your code against some of the common Magento and PHP coding issues, like:

  1. raw SQL queries; SQL queries inside a loop;
  2. direct instantiation of Mage and Enterprise classes;
  3. unnecessary collection loading;
  4. excessive code complexity;
  5. use of dangerous functions; use of PHP Superglobals;

and many others.

  1. Ecg for Magento
  2. EcgM2 for Magento 2

Both Magento and Magento 2 are supported.

  • This tool is for extension for entire Magento 2 code check? Commented Jun 7, 2017 at 10:35
  • You can check Magento 2 module by this command after ECGM2 installation "phpcs --standard=EcgM2 /path/to/module" Commented Jun 7, 2017 at 10:38
  • Sure Patel. Any other tool available for please add in comments. Commented Jun 7, 2017 at 16:55
  • Shall i know W3C validation need for Magento 2 code validation? Commented Jun 8, 2017 at 18:56
  • W3C validation is for Magento Web Page Presentation, Not for coding standard. Magento use only ECG for both Magento 1 and 2 for checking extension coding standard. Commented Jun 9, 2017 at 4:46

Magento 2 use ECGM2 coding standard:

  1. Install Coding Standard :

    cd to/your/magento/install/directory
    composer create-project --repository=https://repo.magento.com magento/marketplace-eqp magento-coding-standard
    composer require magento/marketplace-eqp
    cd magento-coding-standard

    If you get error:

    PHP Fatal error: Uncaught PHP_CodeSniffer_Exception: Referenced sniff "MEQP1.Exceptions.Namespace" does not exist

    vendor/bin/phpcs --config-set installed_paths ../../..
    vendor/bin/phpcs --config-set m2-path <path-to-magento2> ( for eg. sudo vendor/bin/phpcs --config-set m2-path  /var/www/html/magento2 )
  2. Test your M2 extension:

    To auto correct errors use phpcbf :

    vendor/bin/phpcbf <path-to-magento2>/app/code/Vendor/Module/Block/ --standard=MEQP2 --no-patch --extensions=php,phtml,xml,css,js

    For View File

    vendor/bin/phpcbf <path-to-magento2>/app/code/Vendor/Module/view/frontend/templates --standard=MEQP2 --extensions=php,phtml 

    To Check Error/ Warnnings :

    vendor/bin/phpcs <path-to-magento2>/app/code/Vendor/Module/Block/ --standard=MEQP2 --extensions=phtml,xml,css,js,php

    For View File

    vendor/bin/phpcbf <path-to-magento2>/app/code/Vendor/Module/view/frontend/templates --standard=MEQP2 --extensions=php,phtml

    Solution for some warnings available here :

    How to fix warnings / errors raised by the Magento Marketplace technical review report?

  3. Marketplace Technical Review :

    vendor/bin/phpcs /path/to/your/extension --standard=MEQP2 --severity=10
  4. Validate Magento 2 extension:

    Download "validate_m2_package.php" from https://gist.github.com/alankent/fcf280dd9c599921b71d#file-validate_m2_package_v2-php and put it on root of magento:

    cd <path-to-magento2>
    php validate_m2_package.php Vendor_Module.zip

In addition to Prince Patels answer ...

Magento 2 also uses PSR-2 coding standard, so you can also run phpcs --standard=PSR2 /path/to/module. For fixing PSR-2 "errors" you can use "PHP Code Beautifier and Fixer (phpcbf)"

For me this works very good ...

  • fix PSR2 error automatically
  • create reports
  • merge reports into one file


phpcbf --standard=PSR2 ./app/
phpcs --report-gitblame=CS-blame --report-source=CS-code --report-full=CS-full ./app/
cat CS-* >> ECG-PSR2 ; rm CS-*

If you use git, you can add a pre-commit hook to run phpcs/phpcbf automatically before commiting your changes.


Not espaccially for magento coding standards, but good practice imho ...

  • run phpcbf with PSR2 and MEQP2 standard
  • run phpcs -s with both standards
  • run phpmd -s
  • run phpstan -l 7
    • for magento 2.2 you have to use version 0.8.5

-s option is to display sniff name ... maybe use ful if you want to supress warnings

For nice reports I'd suggest phpdox. It aggregates data from ...

  • phploc
  • phpcs
  • phpmd
  • phpunit code coverage
  • git log
  • ...

Sample (w/o code coverage): http://phpdox.de/demo/PHPUnit/index.xhtml

Other tools:

  • Thanks @sv3n. Any tool for check security? Commented Jul 16, 2017 at 13:07
  • 1
    For secuirty I've no tools. I think following coding standards (avoid raw queries and so on) is a first good step.
    – sv3n
    Commented Jul 16, 2017 at 13:10

To validate vulnerabilities of M2 application, we can use :

ZAP(Zed Attack Proxy).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.