Back to Course |
Larastan: Catch Bugs with Static Analysis

PHPStan Levels

As you might have noticed - we have used quite a few levels of PHPStan in this course. Let's look at what they mean.

Level 0

  • basic checks
  • unknown classes
  • unknown functions
  • unknown methods called on $this
  • wrong number of arguments passed to those methods and functions
  • always undefined variables

It means that running PHPStan on level 0 will give you information about issues with the code, such as missing classes or functions. It will cover the basic syntax errors or misuse of functions.

Level 1

  • possibly undefined variables
  • unknown magic methods and properties on classes with call and get

It will warn you about possible issues with the code, such as calling a method that does not exist in the class, or they are accessed via magic methods.

Level 2

  • unknown methods checked on all expressions (not just $this)
  • validating PHPDocs

It becomes a little more important as it will check what your current PHPDoc says about the code. For example, if you have a method that returns a string, but you have a PHPDoc that says it returns an integer, PHPStan will warn you about that. It will also check if you are calling existing methods on classes.

Level 3

  • return types
  • types assigned to properties

This is where things start to get interesting. PHPStan will check if you are returning the correct type from a method. For example, if you have a method that returns an integer, but you are returning a string, PHPStan will warn you about that. It will also check if you are assigning the correct type to a property. For example, you have a property string but you are using it as an array

Level 4

  • basic dead code checking - always false instanceof and other type checks
  • dead else branches
  • unreachable code after return; etc.

Level 4 dives deeper into the code and checks if there is any dead code. For example, if you have an if statement that always returns, PHPStan will warn you about it. It will also check if you have an else statement that is never executed. Another great example here is a return statement that is never reached due to a previous return statement.

Level 5

  • checking types of arguments passed to methods and functions

It extends level 3 by checking if you are passing the correct type to a method or function. For example, if you have a method that expects an integer, but you are passing a string, PHPStan will warn you about an incorrect function call. The difference between level 3 is that here you'll get the warning from the caller, not the callee.

Level 6

  • report missing typehints

PHPStan will check if you have missing type hints. For example, if you have a method that returns an integer, but you are not using a type hint, PHPStan will warn you about that. It will also check if you have a property that is an integer, but you are not using a type hint, PHPStan will warn you about that.

Level 7

  • report partially wrong union types - if you call a method that only exists on some types in a union type, level 7 starts to report that; other possibly incorrect situations

This level will check if your union types are correct. For example, if you have a method that returns a string or integer, but you are calling a method that only exists on string, PHPStan will warn you about that. Another example would be accepting something like array|User and attempting to use a method that only exists on the User model.

Level 8

  • report calling methods and accessing properties on nullable types

This level will check if you are calling methods or accessing properties on nullable types. For example, if you have a method that returns a User|null, but you are calling a method on the User model, PHPStan will warn you about that. This helps your application to be more robust and avoid any unexpected errors when calling a function onnull.

Level 9

  • be strict about the mixed type - the only allowed operation you can do with it is to pass it to another mixed

This level will check if you are using the mixed type correctly. For example, if you have a method that returns a mixed type, but you are calling a method on it, PHPStan will warn you about that. For example, you have a mixed parameter on a function where you passed a User Model. If you are calling a method on that parameter, PHPStan will warn you about that especially if there are other cases where you are passing anything else (like an integer or an array).

What Should You Use?

It is a choice and depends on your application as you might be overwhelmed with the number of errors you get on level 9. I would recommend starting with level 0 and then slowly increasing the level as you fix the issues. Or you can read the next chapter where you will learn how to set a Baseline on your PHPStan which will allow you to focus on freshly added code instead of already existing code. This is especially helpful for big projects.

But if you are starting a new project, I would recommend starting with level 9. This will give you the most robust checks and help you to avoid quite a few issues in the future.