PHPackages spaze/phpstan-disallowed-calls - PHPackages - PHPackages [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register) 1. [Directory](/) 2. / 3. [Testing & Quality](/categories/testing) 4. / 5. spaze/phpstan-disallowed-calls ActivePhpstan-extension[Testing & Quality](/categories/testing) spaze/phpstan-disallowed-calls ============================== PHPStan rules to detect disallowed method & function calls, constant, namespace, attribute, property & superglobal usages, with powerful rules to re-allow a call or a usage in places where it should be allowed. v4.9.1(1mo ago)33320.0M—0.7%23[3 issues](https://github.com/spaze/phpstan-disallowed-calls/issues)[1 PRs](https://github.com/spaze/phpstan-disallowed-calls/pulls)20MITPHPPHP ^7.4 || ^8.0CI passing Since Oct 31Pushed 2w ago5 watchersCompare [ Source](https://github.com/spaze/phpstan-disallowed-calls)[ Packagist](https://packagist.org/packages/spaze/phpstan-disallowed-calls)[ GitHub Sponsors](https://github.com/spaze)[ RSS](/packages/spaze-phpstan-disallowed-calls/feed)WikiDiscussions main Synced 1mo ago READMEChangelog (10)Dependencies (16)Versions (85)Used By (20) Disallowed calls for PHPStan ============================ [](#disallowed-calls-for-phpstan) [PHPStan](https://github.com/phpstan/phpstan) rules to detect disallowed calls and more, without running the code. [![PHP Tests](https://github.com/spaze/phpstan-disallowed-calls/workflows/PHP%20Tests/badge.svg)](https://github.com/spaze/phpstan-disallowed-calls/actions?query=workflow%3A%22PHP+Tests%22) There are some functions, methods, constants, namespaces, attributes, variables and properties which should not be used in production code. One good example is the `var_dump()` function, it is often used to quickly debug problems but should be removed before committing the code. And sometimes it's not. Another example would be a generic logger. Let's say you're using one of the generic logging libraries but you have your own logger that will add some more info, or sanitize data, before calling the generic logger. Your code should not call the generic logger directly but should instead use your custom logger. This [PHPStan](https://github.com/phpstan/phpstan) extension will detect such usage, if configured. It should be noted that this extension is not a way to defend against or detect hostile developers, as they can obfuscate the calls for example. This extension is meant to be another pair of eyes, detecting your own mistakes, it doesn't aim to detect-all-the-things. [Tests](tests) will provide examples what is ***currently*** detected. If it's not covered by tests, it might be, but most probably will not be detected. `*Test.php` files are the tests, start with those, the analyzed test code is in [src](tests/src), required test classes in [libs](tests/libs). Feel free to file [issues](https://github.com/spaze/phpstan-disallowed-calls/issues) or create [pull requests](https://github.com/spaze/phpstan-disallowed-calls/pulls) if you need to detect more calls. Installation ------------ [](#installation) Install the extension using [Composer](https://getcomposer.org/): ``` composer require --dev spaze/phpstan-disallowed-calls ``` [PHPStan](https://github.com/phpstan/phpstan), the PHP Static Analysis Tool, is a requirement. If you use [phpstan/extension-installer](https://github.com/phpstan/extension-installer), you are all set and can skip to configuration. For manual installation, add this to your `phpstan.neon`: ``` includes: - vendor/spaze/phpstan-disallowed-calls/extension.neon ``` Configuration files ------------------- [](#configuration-files) You can start with [bundled configuration files](docs/configuration-bundled.md). Custom rules ------------ [](#custom-rules) The extension supports versatile [custom rules](docs/custom-rules.md), too. ### Allow some previously disallowed calls or usages [](#allow-some-previously-disallowed-calls-or-usages) Let's say you have disallowed the `foo()` function (or any other supported items like constants or method calls etc.) with custom rules. But you want to re-allow it when used in your custom wrapper, or when the first parameter equals, or not, a specified value. The extension offers multiple ways of doing that: - [Ignore errors](docs/allow-ignore-errors.md) the PHPStan way - [Allow in paths](docs/allow-in-paths.md) - [Allow in methods or functions](docs/allow-in-methods.md) - [Allow with specified parameters](docs/allow-with-parameters.md) - [Allow with specified flags](docs/allow-with-flags.md) - [Allow in classes, child classes, classes implementing an interface](docs/allow-in-instance-of.md) (same as the `instanceof` operator) - [Allow in class with given attributes](docs/allow-in-class-with-attributes.md) - [Allow in methods or functions with given attributes](docs/allow-in-methods.md) - [Allow in class with given attributes on any method](docs/allow-in-class-with-method-attributes.md) - [Allow in type hint positions](docs/allow-in-type-hint-positions.md) (param types, return types - `disallowedNamespaces` and `disallowedClasses` only) [Re-allowing attributes](docs/allow-attributes.md) uses a similar [configuration](docs/allow-attributes.md). Disallow disabled functions & classes ----------------------------------------- [](#disallow-disabled-functions--classes) Use the [provided generator](docs/disallow-disabled-functions-classes.md) to generate a configuration snippet from PHP's `disable_functions` & `disable_classes` configuration directives. Example output -------------- [](#example-output) ``` ------ -------------------------------------------------------- Line libraries/Report/Processor/CertificateTransparency.php ------ -------------------------------------------------------- 116 Calling var_dump() is forbidden, use logger instead ------ -------------------------------------------------------- ``` Case-(in)sensitivity -------------------- [](#case-insensitivity) Function names, method names, class names, namespaces are matched irrespective of their case (disallowing `print_r` will also find `print_R` calls), while anything else like constants, file names, paths are not. No other rules -------------- [](#no-other-rules) You can also use this extension [without any other PHPStan rules](docs/phpstan-custom-ruleset.md). This may be useful if you want to for example check a third-party code for some calls or usage of something. Running tests ------------- [](#running-tests) If you want to contribute (awesome, thanks!), you should add/run tests for your contributions. First install dev dependencies by running `composer install`, then run PHPUnit tests with `composer test`, see `scripts` in `composer.json`. Tests are also run on GitHub with Actions on each push. You can fix coding style issues automatically by running `composer cs-fix`. See also -------- [](#see-also) There's a similar project with a slightly different configuration, created almost at the same time (just a few days difference): [PHPStan Banned Code](https://github.com/ekino/phpstan-banned-code). Framework or package-specific configurations -------------------------------------------- [](#framework-or-package-specific-configurations) - For [Nette Framework](https://github.com/spaze/phpstan-disallowed-calls-nette) - For [Symfony](https://github.com/spaze/phpstan-disallowed-calls-symfony) ### Health Score 75 — ExcellentBetter than 100% of packages Maintenance93 Actively maintained with recent releases Popularity67 Solid adoption and visibility Community46 Growing community involvement Maturity82 Battle-tested with a long release history Bus Factor1 Top contributor holds 91.7% of commits — single point of failure How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window. **Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores. **Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement. **Maturity (30%)** — Project age, version count, PHP version support, and release stability. ### Release Activity Cadence Every ~33 days Total 81 Last Release 53d ago Major Versions v0.12.7 → v1.0.02020-10-18 v1.11.0 → v2.0.02021-11-01 v2.16.1 → v3.0.02023-12-22 v3.5.1 → v4.0.02024-11-11 PHP version history (6 changes)v0.0.1PHP ^7.0 v0.0.2PHP ^7.1 v1.0.1PHP >=7.1 v1.1.0PHP ^7.1 || ^8.0 v2.7.0PHP ^7.2 || ^8.0 v4.0.0PHP ^7.4 || ^8.0 ### Community Maintainers ![](https://www.gravatar.com/avatar/6777bd445610e6e458e4d41bdefa3070d2ed4e068323362353b061b15e9ff81b?d=identicon)[spaze](/maintainers/spaze) --- Top Contributors [![spaze](https://avatars.githubusercontent.com/u/1966648?v=4)](https://github.com/spaze "spaze (606 commits)")[![ruudk](https://avatars.githubusercontent.com/u/104180?v=4)](https://github.com/ruudk "ruudk (20 commits)")[![Copilot](https://avatars.githubusercontent.com/in/1143301?v=4)](https://github.com/Copilot "Copilot (5 commits)")[![szepeviktor](https://avatars.githubusercontent.com/u/952007?v=4)](https://github.com/szepeviktor "szepeviktor (5 commits)")[![xificurk](https://avatars.githubusercontent.com/u/117465?v=4)](https://github.com/xificurk "xificurk (4 commits)")[![enumag](https://avatars.githubusercontent.com/u/539462?v=4)](https://github.com/enumag "enumag (4 commits)")[![BackEndTea](https://avatars.githubusercontent.com/u/14289961?v=4)](https://github.com/BackEndTea "BackEndTea (3 commits)")[![dependabot[bot]](https://avatars.githubusercontent.com/in/29110?v=4)](https://github.com/dependabot[bot] "dependabot[bot] (2 commits)")[![janedbal](https://avatars.githubusercontent.com/u/1993453?v=4)](https://github.com/janedbal "janedbal (1 commits)")[![ksaveras](https://avatars.githubusercontent.com/u/485111?v=4)](https://github.com/ksaveras "ksaveras (1 commits)")[![mad-briller](https://avatars.githubusercontent.com/u/28307684?v=4)](https://github.com/mad-briller "mad-briller (1 commits)")[![mnastalski](https://avatars.githubusercontent.com/u/10223434?v=4)](https://github.com/mnastalski "mnastalski (1 commits)")[![morrislaptop](https://avatars.githubusercontent.com/u/67807?v=4)](https://github.com/morrislaptop "morrislaptop (1 commits)")[![ondrejmirtes](https://avatars.githubusercontent.com/u/104888?v=4)](https://github.com/ondrejmirtes "ondrejmirtes (1 commits)")[![peter279k](https://avatars.githubusercontent.com/u/9021747?v=4)](https://github.com/peter279k "peter279k (1 commits)")[![ramondantas-cp](https://avatars.githubusercontent.com/u/156222208?v=4)](https://github.com/ramondantas-cp "ramondantas-cp (1 commits)")[![francescolaffi](https://avatars.githubusercontent.com/u/357331?v=4)](https://github.com/francescolaffi "francescolaffi (1 commits)")[![eithed](https://avatars.githubusercontent.com/u/795678?v=4)](https://github.com/eithed "eithed (1 commits)")[![ilazaridis](https://avatars.githubusercontent.com/u/2973490?v=4)](https://github.com/ilazaridis "ilazaridis (1 commits)")[![compwright](https://avatars.githubusercontent.com/u/138688?v=4)](https://github.com/compwright "compwright (1 commits)") --- Tags disallowed-callsphpphpstanphpstan-rulesstatic-analysisstatic analysis ### Code Quality TestsPHPUnit ### Embed Badge ![Health badge](/badges/spaze-phpstan-disallowed-calls/health.svg) ``` [![Health](https://phpackages.com/badges/spaze-phpstan-disallowed-calls/health.svg)](https://phpackages.com/packages/spaze-phpstan-disallowed-calls) ``` ### Alternatives [larastan/larastan Larastan - Discover bugs in your code without running it. A phpstan/phpstan extension for Laravel 6.4k43.5M5.2k](/packages/larastan-larastan)[phpstan/phpstan-symfony Symfony Framework extensions and rules for PHPStan 78768.9M1.5k](/packages/phpstan-phpstan-symfony)[phpstan/phpstan-doctrine Doctrine extensions for PHPStan 66766.6M1.1k](/packages/phpstan-phpstan-doctrine)[phpstan/phpstan-strict-rules Extra strict and opinionated rules for PHPStan 69661.6M3.9k](/packages/phpstan-phpstan-strict-rules)[phpstan/phpstan-phpunit PHPUnit extensions and rules for PHPStan 529102.1M8.6k](/packages/phpstan-phpstan-phpunit)[phpstan/phpstan-deprecation-rules PHPStan rules for detecting usage of deprecated classes, methods, properties, constants and traits. 44979.0M6.4k](/packages/phpstan-phpstan-deprecation-rules) PHPackages © 2026 [Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)