What are all the tools available for checking Magento 2 coding standard?

Question

I am currently working on Magento 2 coding standard checking project.

Any other tool available other than PHP_CodeSniffer to check Magento 2 and PHP coding standing.

Answer 1

Magento 2 use ECGM2 coding standard

You can download from here

https://github.com/magento-ecg/coding-standard

ECG Magento Code Sniffer Coding Standard is a set of rules and sniffs for PHP_CodeSniffer tool.

It allows automatically check your code against some of the common Magento and PHP coding issues, like:

1. raw SQL queries; SQL queries inside a loop;
2. direct instantiation of Mage and Enterprise classes;
3. unnecessary collection loading;
4. excessive code complexity;
5. use of dangerous functions; use of PHP Superglobals;

and many others.

1. Ecg for Magento
2. EcgM2 for Magento 2

Both Magento and Magento 2 are supported.

Answer 2

Magento 2 use ECGM2 coding standard:

1. Install Coding Standard :

   cd to/your/magento/install/directory
   composer create-project --repository=https://repo.magento.com magento/marketplace-eqp magento-coding-standard
   composer require magento/marketplace-eqp
   cd magento-coding-standard
   

   If you get error:

   PHP Fatal error: Uncaught PHP_CodeSniffer_Exception: Referenced sniff "MEQP1.Exceptions.Namespace" does not exist

   vendor/bin/phpcs --config-set installed_paths ../../..
   vendor/bin/phpcs --config-set m2-path <path-to-magento2> ( for eg. sudo vendor/bin/phpcs --config-set m2-path  /var/www/html/magento2 )
   

2. Test your M2 extension:

   To auto correct errors use phpcbf :

   vendor/bin/phpcbf <path-to-magento2>/app/code/Vendor/Module/Block/ --standard=MEQP2 --no-patch --extensions=php,phtml,xml,css,js
   

   For View File

   vendor/bin/phpcbf <path-to-magento2>/app/code/Vendor/Module/view/frontend/templates --standard=MEQP2 --extensions=php,phtml 
   

   To Check Error/ Warnnings :

   vendor/bin/phpcs <path-to-magento2>/app/code/Vendor/Module/Block/ --standard=MEQP2 --extensions=phtml,xml,css,js,php
   

   For View File

   vendor/bin/phpcbf <path-to-magento2>/app/code/Vendor/Module/view/frontend/templates --standard=MEQP2 --extensions=php,phtml
   

   Solution for some warnings available here :

   How to fix warnings / errors raised by the Magento Marketplace technical review report?

3. Marketplace Technical Review :

   vendor/bin/phpcs /path/to/your/extension --standard=MEQP2 --severity=10
   

4. Validate Magento 2 extension:

   Download "validate_m2_package.php" from https://gist.github.com/alankent/fcf280dd9c599921b71d#file-validate_m2_package_v2-php and put it on root of magento:

   cd <path-to-magento2>
   php validate_m2_package.php Vendor_Module.zip
   

Answer 3

In addition to Prince Patels answer ...

Magento 2 also uses PSR-2 coding standard, so you can also run phpcs --standard=PSR2 /path/to/module. For fixing PSR-2 "errors" you can use "PHP Code Beautifier and Fixer (phpcbf)"

For me this works very good ...

• fix PSR2 error automatically
• create reports
• merge reports into one file

Commands:

phpcbf --standard=PSR2 ./app/
phpcs --report-gitblame=CS-blame --report-source=CS-code --report-full=CS-full ./app/
cat CS-* >> ECG-PSR2 ; rm CS-*

If you use git, you can add a pre-commit hook to run phpcs/phpcbf automatically before commiting your changes.

---

Update:

Not espaccially for magento coding standards, but good practice imho ...

• run phpcbf with PSR2 and MEQP2 standard
• run phpcs -s with both standards
• run phpmd -s
• run phpstan -l 7
  • for magento 2.2 you have to use version 0.8.5

^{-s option is to display sniff name ... maybe use ful if you want to supress warnings}

For nice reports I'd suggest phpdox. It aggregates data from ...

• phploc
• phpcs
• phpmd
• phpunit code coverage
• git log
• ...

Sample (w/o code coverage): http://phpdox.de/demo/PHPUnit/index.xhtml

Other tools:

• PHP Assumptions
• PHP Magic Number Detector (PHPMND)
• PhpMetrics with a cool class relation diagram that helped me a lot

Answer 4

To validate vulnerabilities of M2 application, we can use :

ZAP(Zed Attack Proxy).