# PHPStan

> PHPStan is an open-source static analysis tool for PHP that finds errors in code without running it and without the need to write tests.

Original page: https://t10.de/en/glossary/phpstan
Publisher: total10 GmbH, https://t10.de/en/glossary

The project sums up its approach as finding bugs without writing tests: it scans the whole codebase, including rarely executed parts that tests do not reach. PHPStan can run on a developer's machine and in continuous integration (CI), where checks start automatically whenever the code changes, with the aim of stopping bugs from ever reaching customers on the live system.

How strict the check is depends on the [rule level](https://phpstan.org/user-guide/rule-levels). PHPStan currently has 11 levels, from 0, the loosest, to 10, the strictest. They are cumulative: a given level includes every check of the levels below it. Among other things, the lower levels look for unknown classes and methods, undefined variables, return and argument types, dead code and missing type declarations. Level 7 adds a check for values that can be of several types: it reports code that works for only some of them, such as a call to a method that not all of those types have.

Several business applications we have built for clients in the pharma sector are checked with PHPStan at level 7, and some are also screened for banned, risky functions and for consistent code style. The results of this static code analysis can go to the client's quality assurance team (QA).

## See also

- [PHPUnit](https://t10.de/en/glossary/phpunit): PHPUnit is an open-source testing framework for PHP that developers use to write automated tests comparing actual results with expected ones.
- [Non-GxP](https://t10.de/en/glossary/non-gxp): Non-GxP describes a system that its operator does not classify as GxP-relevant; PIC/S guidance uses the term without defining it formally.
- [QA](https://t10.de/en/glossary/qa): QA is short for quality assurance; in the EU, both good manufacturing practice (GMP) and good distribution practice (GDP) are defined as part of it.

## Where the term appears

- [What non-GxP means for pharma business software](https://t10.de/en/blog/non-gxp-pharma-logistics)
- [Stock alerts in pharma logistics, without a web shop](https://t10.de/en/blog/stock-alerts-pharma)
- [Case study: knowledge platform for pharma logistics](https://t10.de/en/blog/knowledge-platform-pharma)

## Sources

1. [README des Repositorys phpstan/phpstan (Branch 2.1.x)](https://raw.githubusercontent.com/phpstan/phpstan/2.1.x/README.md), PHPStan (GitHub phpstan/phpstan), accessed 2026-11-07
2. [PHPStan: Find Bugs Without Writing Tests](https://phpstan.org/), PHPStan s.r.o. (phpstan.org), accessed 2026-11-07
3. [User Guide: Rule Levels](https://phpstan.org/user-guide/rule-levels), PHPStan s.r.o. (phpstan.org), accessed 2026-11-07