14

I am currently working on Magento 2 coding standard checking project.

Is any other tool available, other than PHP_CodeSniffer, to check Magento 2 and PHP coding standing?

9

Magento 2 use ECGM2 coding standard

You can download from here

https://github.com/magento-ecg/coding-standard

ECG Magento Code Sniffer Coding Standard is a set of rules and sniffs for PHP_CodeSniffer tool.

It allows automatically check your code against some of the common Magento and PHP coding issues, like:

  1. raw SQL queries; SQL queries inside a loop;
  2. direct instantiation of Mage and Enterprise classes;
  3. unnecessary collection loading;
  4. excessive code complexity;
  5. use of dangerous functions; use of PHP Superglobals;

and many others.

  1. Ecg for Magento
  2. EcgM2 for Magento 2

Both Magento and Magento 2 are supported.

  • This tool is for extension for entire Magento 2 code check? – Rama Chandran M Jun 7 '17 at 10:35
  • You can check Magento 2 module by this command after ECGM2 installation "phpcs --standard=EcgM2 /path/to/module" – Prince Patel Jun 7 '17 at 10:38
  • Sure Patel. Any other tool available for please add in comments. – Rama Chandran M Jun 7 '17 at 16:55
  • Shall i know W3C validation need for Magento 2 code validation? – Rama Chandran M Jun 8 '17 at 18:56
  • W3C validation is for Magento Web Page Presentation, Not for coding standard. Magento use only ECG for both Magento 1 and 2 for checking extension coding standard. – Prince Patel Jun 9 '17 at 4:46
11

Magento 2 use ECGM2 coding standard:

  1. Install Coding Standard :

    cd to/your/magento/install/directory
    composer create-project --repository=https://repo.magento.com magento/marketplace-eqp magento-coding-standard
    composer require magento/marketplace-eqp
    cd magento-coding-standard
    

    If you get error:

    PHP Fatal error: Uncaught PHP_CodeSniffer_Exception: Referenced sniff "MEQP1.Exceptions.Namespace" does not exist

    vendor/bin/phpcs --config-set installed_paths ../../..
    vendor/bin/phpcs --config-set m2-path <path-to-magento2> ( for eg. sudo vendor/bin/phpcs --config-set m2-path  /var/www/html/magento2 )
    
  2. Test your M2 extension:

    To auto correct errors use phpcbf :

    vendor/bin/phpcbf <path-to-magento2>/app/code/Vendor/Module/Block/ --standard=MEQP2 --no-patch --extensions=php,phtml,xml,css,js
    

    For View File

    vendor/bin/phpcbf <path-to-magento2>/app/code/Vendor/Module/view/frontend/templates --standard=MEQP2 --extensions=php,phtml 
    

    To Check Error/ Warnnings :

    vendor/bin/phpcs <path-to-magento2>/app/code/Vendor/Module/Block/ --standard=MEQP2 --extensions=phtml,xml,css,js,php
    

    For View File

    vendor/bin/phpcbf <path-to-magento2>/app/code/Vendor/Module/view/frontend/templates --standard=MEQP2 --extensions=php,phtml
    

    Solution for some warnings available here :

    How to fix warnings / errors raised by the Magento Marketplace technical review report?

  3. Marketplace Technical Review :

    vendor/bin/phpcs /path/to/your/extension --standard=MEQP2 --severity=10
    
  4. Validate Magento 2 extension:

    Download "validate_m2_package.php" from https://gist.github.com/alankent/fcf280dd9c599921b71d#file-validate_m2_package_v2-php and put it on root of magento:

    cd <path-to-magento2>
    php validate_m2_package.php Vendor_Module.zip
    
8

In addition to Prince Patels answer ...

Magento 2 also uses PSR-2 coding standard, so you can also run phpcs --standard=PSR2 /path/to/module. For fixing PSR-2 "errors" you can use "PHP Code Beautifier and Fixer (phpcbf)"

For me this works very good ...

  • fix PSR2 error automatically
  • create reports
  • merge reports into one file

Commands:

phpcbf --standard=PSR2 ./app/
phpcs --report-gitblame=CS-blame --report-source=CS-code --report-full=CS-full ./app/
cat CS-* >> ECG-PSR2 ; rm CS-*

If you use git, you can add a pre-commit hook to run phpcs/phpcbf automatically before commiting your changes.


Update:

Not espaccially for magento coding standards, but good practice imho ...

  • run phpcbf with PSR2 and MEQP2 standard
  • run phpcs -s with both standards
  • run phpmd -s
  • run phpstan -l 7
    • for magento 2.2 you have to use version 0.8.5

-s option is to display sniff name ... maybe use ful if you want to supress warnings

For nice reports I'd suggest phpdox. It aggregates data from ...

  • phploc
  • phpcs
  • phpmd
  • phpunit code coverage
  • git log
  • ...

Sample (w/o code coverage): http://phpdox.de/demo/PHPUnit/index.xhtml

Other tools:

  • Thanks @sv3n. Any tool for check security? – Rama Chandran M Jul 16 '17 at 13:07
  • 1
    For secuirty I've no tools. I think following coding standards (avoid raw queries and so on) is a first good step. – sv3n Jul 16 '17 at 13:10
2

To validate vulnerabilities of M2 application, we can use :

ZAP(Zed Attack Proxy).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.