# PHP Conventions

> PHP code conventions covering PHP 8.2+ strict types, PSR-12 formatting, PHPStan/Psalm static analysis, PHPUnit, Composer dependency management, PSR-4 autoloading, and security. Load when writing or reviewing PHP code.

- Skill: `goldziher/php-conventions` (Agent Skill)
- Install (CLI): `npx skillmds@latest add goldziher/php-conventions`
- Raw SKILL.md: https://api.skillmd.com/api/skills/goldziher/php-conventions/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: goldziher (https://skillmd.com/u/goldziher)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/goldziher/php-conventions

---


- PHP 8.2+, `declare(strict_types=1)`, typed properties, union types, enums, readonly classes.
- Formatting: PSR-12 via a fixer (e.g., PHP_CodeSniffer/phpcbf or php-cs-fixer). Static analysis: a strict analyzer (e.g., PHPStan at max level or Psalm).
- Testing: PHPUnit with `@dataProvider`, 80%+ coverage.
- Error handling: specific exceptions extending `RuntimeException`, constructor promotion for value objects.
- First-class callable syntax (`$fn = strlen(...)`) for callbacks. Arrow functions (`fn() =>`) for simple closures.
- Dependencies: Composer with `composer.lock` committed, `^` version constraints. `composer audit` in CI.
- Security: require `roave/security-advisories` as dev dependency to block vulnerable packages.
- PSR-4 autoloading exclusively — no `require`/`include` for classes.
- Intersection types for strict parameter contracts. Named arguments for readability.
- Anti-patterns: `@` suppression, `eval()`, dynamic property access, `extract()`.