One interesting thing about software is that because it is written in a language that a computer can understand, it is also possible, in theory, to get the computer to tell you things about that software. There are various classes of utilities from static analysers to code style checkers, but I have recently been considering how possible it is to check for uses of specific deprecated functions and classes in a PHP project. The actual checker I was thinking of creating would use regular expressions and be written in PHP itself, but because the process would be a static analysis one, which I hoped didn’t have to resort to tokenising the PHP source code it was examining, this checker could in fact be written in any language just as (if not more) easily. As is often the case in my blog posts about PHP recently, it turns out that various “features” of PHP make things more difficult (regardless of the language that the checker is written in), although trying to solve a problem the wrong way doesn’t help either.
Continue reading "Checking PHP security with PHP"