Findings
What the linter reports on the regular expressions of real open-source PHP projects: proven catastrophic backtracking, useless flags, redundant quantifiers, overlapping classes. Each project is judged for the PHP its own composer.json asks for (its require.php floor, or the platform PHP it pins; PHP 8.1 when it names none), on the PCRE2 that PHP bundles, and each finding opens in the playground with the code it lives in.
The list is the latest run over the corpus: the repositories are cloned again, linted again, and the findings rewritten. A finding that is gone from a run is simply gone, whether its code changed, moved or was rewritten.
| Project | Findings | FAIL | WARN | Judged for |
|---|---|---|---|---|
| moodle/moodle | 310 | 15 | 295 | PHP 8.3 · PCRE2 10.42 |
| flarum/framework | 8 | 7 | 1 | PHP 8.3 · PCRE2 10.42 |
| wikimedia/mediawiki | 31 | 7 | 24 | PHP 8.3 · PCRE2 10.42 |
| WordPress/wordpress-develop | 66 | 7 | 59 | PHP 7.4 · PCRE2 10.33 |
| drupal/drupal | 18 | 6 | 12 | PHP 8.1 · PCRE2 10.39 |
| Automattic/jetpack | 67 | 5 | 62 | PHP 8.1 · PCRE2 10.39 |
| freescout-help-desk/freescout | 32 | 5 | 27 | PHP 7.3 · PCRE2 10.32 |
| pimcore/pimcore | 13 | 5 | 8 | PHP 8.4 · PCRE2 10.49 |
| magento/magento2 | 73 | 4 | 69 | PHP 8.3 · PCRE2 10.42 |
| composer/composer | 13 | 3 | 10 | PHP 7.3 · PCRE2 10.32 |
| craftcms/cms | 14 | 3 | 11 | PHP 8.2 · PCRE2 10.40 |
| grokability/snipe-it | 3 | 3 | 0 | PHP 8.2 · PCRE2 10.40 |
| nelmio/alice | 3 | 3 | 0 | PHP 8.2 · PCRE2 10.40 |
| processwire/processwire | 30 | 3 | 27 | PHP 7.3 · PCRE2 10.32 |
| salesagility/SuiteCRM | 132 | 3 | 129 | PHP 8.1 · PCRE2 10.39 |
| symfony/symfony | 40 | 3 | 37 | PHP 8.4.1 · PCRE2 10.49 |
| concretecms/concretecms | 26 | 2 | 24 | PHP 8.1 · PCRE2 10.39 |
| contao/contao | 11 | 2 | 9 | PHP 8.4 · PCRE2 10.49 |
| Humbug/php-scoper | 4 | 2 | 2 | PHP 8.2 · PCRE2 10.40 |
| hyperf/hyperf | 8 | 2 | 6 | PHP 8.2 · PCRE2 10.40 |
| matomo-org/matomo | 14 | 2 | 12 | PHP 8.1 · PCRE2 10.39 |
| nbs-system/php-malware-finder | 4 | 2 | 2 | PHP 8.1 · PCRE2 10.39 |
| thephpleague/glide | 3 | 2 | 1 | PHP 8.3 · PCRE2 10.42 |
| twigphp/Twig | 2 | 2 | 0 | PHP 8.1 · PCRE2 10.39 |
| TYPO3/typo3 | 18 | 2 | 16 | PHP 8.5 · PCRE2 10.44 |
| vimeo/psalm | 5 | 2 | 3 | PHP 8.1.31 · PCRE2 10.39 |
| wp-cli/wp-cli | 14 | 2 | 12 | PHP 7.3 · PCRE2 10.32 |
| bcit-ci/CodeIgniter | 24 | 1 | 23 | PHP 7.3 · PCRE2 10.32 |
| cakephp/cakephp | 17 | 1 | 16 | PHP 8.2 · PCRE2 10.40 |
| canyongbs/aidingapp | 5 | 1 | 4 | PHP 8.4 · PCRE2 10.49 |
| cebe/markdown | 10 | 1 | 9 | PHP 7.3 · PCRE2 10.32 |
| codeigniter4/CodeIgniter4 | 14 | 1 | 13 | PHP 8.2 · PCRE2 10.40 |
| deployphp/deployer | 3 | 1 | 2 | PHP 8.3 · PCRE2 10.42 |
| elementor/elementor | 9 | 1 | 8 | PHP 7.4 · PCRE2 10.33 |
| FOSSBilling/FOSSBilling | 8 | 1 | 7 | PHP 8.3 · PCRE2 10.42 |
| invoiceninja/invoiceninja | 3 | 1 | 2 | PHP 8.2 · PCRE2 10.40 |
| joomla/joomla-cms | 47 | 1 | 46 | PHP 8.1 · PCRE2 10.39 |
| laminas/laminas-code | 10 | 1 | 9 | PHP 8.2.99 · PCRE2 10.40 |
| laminas/laminas-validator | 5 | 1 | 4 | PHP 8.2.99 · PCRE2 10.40 |
| laravel/boost | 6 | 1 | 5 | PHP 8.2 · PCRE2 10.40 |
| laravel/framework | 15 | 1 | 14 | PHP 8.2 · PCRE2 10.40 |
| livewire/blaze | 1 | 1 | 0 | PHP 8.1 · PCRE2 10.39 |
| pestphp/pest | 2 | 1 | 1 | PHP 8.3 · PCRE2 10.42 |
| phpactor/phpactor | 6 | 1 | 5 | PHP 8.2 · PCRE2 10.40 |
| PHPOffice/PhpSpreadsheet | 70 | 1 | 69 | PHP 8.2.99 · PCRE2 10.40 |
| phpspec/phpspec | 4 | 1 | 3 | PHP 8.2 · PCRE2 10.40 |
| phpunit/phpunit | 1 | 1 | 0 | PHP 8.5.12 · PCRE2 10.44 |
| PrestaShop/PrestaShop | 70 | 1 | 69 | PHP 8.1 · PCRE2 10.39 |
| Respect/Validation | 3 | 1 | 2 | PHP 8.5 · PCRE2 10.44 |
| s9e/TextFormatter | 15 | 1 | 14 | PHP 8.1 · PCRE2 10.39 |
| shipmonk-rnd/composer-dependency-analyser | 1 | 1 | 0 | PHP 8.1 · PCRE2 10.39 |
| shopware/shopware | 11 | 1 | 10 | PHP 8.2 · PCRE2 10.40 |
| silverstripe/silverstripe-framework | 23 | 1 | 22 | PHP 8.3 · PCRE2 10.42 |
| simplepie/simplepie | 8 | 1 | 7 | PHP 7.4 · PCRE2 10.33 |
| smalot/pdfparser | 30 | 1 | 29 | PHP 7.3 · PCRE2 10.32 |
| symfony/maker-bundle | 1 | 1 | 0 | PHP 8.2 · PCRE2 10.40 |
| symfony/ux | 2 | 1 | 1 | PHP 8.1 · PCRE2 10.39 |
| tubalmartin/YUI-CSS-compressor-PHP-port | 3 | 1 | 2 | PHP 7.3 · PCRE2 10.32 |
| voku/portable-utf8 | 6 | 1 | 5 | PHP 7.3 · PCRE2 10.32 |
| yiisoft/yii | 48 | 1 | 47 | PHP 7.3 · PCRE2 10.32 |
| yiisoft/yii2 | 20 | 1 | 19 | PHP 7.4 · PCRE2 10.33 |
| 10up/ElasticPress | 1 | 0 | 1 | PHP 7.4 · PCRE2 10.33 |
| akaunting/akaunting | 1 | 0 | 1 | PHP 8.2 · PCRE2 10.40 |
| Alexia/php7mar | 2 | 0 | 2 | PHP 7.3 · PCRE2 10.32 |
| api-platform/core | 3 | 0 | 3 | PHP 8.2 · PCRE2 10.40 |
| aws/aws-sdk-php | 2 | 0 | 2 | PHP 8.2 · PCRE2 10.40 |
| awslabs/aws-crt-php | 1 | 0 | 1 | PHP 7.3 · PCRE2 10.32 |
| beberlei/assert | 3 | 0 | 3 | PHP 7.3 · PCRE2 10.32 |
| bobthecow/psysh | 10 | 0 | 10 | PHP 7.4 · PCRE2 10.33 |
| bolt/core | 4 | 0 | 4 | PHP 8.2 · PCRE2 10.40 |
| browscap/browscap-php | 3 | 0 | 3 | PHP 8.1 · PCRE2 10.39 |
| captainhook-git/captainhook | 1 | 0 | 1 | PHP 8.0 · PCRE2 10.35 |
| CarbonPHP/carbon | 5 | 0 | 5 | PHP 8.1 · PCRE2 10.39 |
| cartalyst/stripe | 2 | 0 | 2 | PHP 7.3 · PCRE2 10.32 |
| Codeception/Codeception | 4 | 0 | 4 | PHP 8.2 · PCRE2 10.40 |
| CuyZ/Valinor | 2 | 0 | 2 | PHP 8.2 · PCRE2 10.40 |
| cycle/database | 1 | 0 | 1 | PHP 8.1 · PCRE2 10.39 |
| doctrine/dbal | 5 | 0 | 5 | PHP 8.2 · PCRE2 10.40 |
| dompdf/dompdf | 7 | 0 | 7 | PHP 7.3 · PCRE2 10.32 |
| ecsphp/ecs | 1 | 0 | 1 | PHP 7.3 · PCRE2 10.32 |
| EdgedesignCZ/phpqa | 1 | 0 | 1 | PHP 7.3 · PCRE2 10.32 |
| egulias/EmailValidator | 1 | 0 | 1 | PHP 8.1 · PCRE2 10.39 |
| erusev/parsedown | 4 | 0 | 4 | PHP 7.3 · PCRE2 10.32 |
| espocrm/espocrm | 5 | 0 | 5 | PHP 8.3 · PCRE2 10.42 |
| exakat/exakat | 52 | 0 | 52 | PHP 7.3 · PCRE2 10.32 |
| exposedev/expose | 1 | 0 | 1 | PHP 8.2 · PCRE2 10.40 |
| exussum12/coverageChecker | 1 | 0 | 1 | PHP 8.1 · PCRE2 10.39 |
| ezyang/htmlpurifier | 1 | 0 | 1 | PHP 7.3 · PCRE2 10.32 |
| facebook/facebook-for-woocommerce | 1 | 0 | 1 | PHP 7.4 · PCRE2 10.33 |
| facebook/facebook-php-business-sdk | 1 | 0 | 1 | PHP 8.0 · PCRE2 10.35 |
| facebook/open-graph-protocol | 4 | 0 | 4 | PHP 8.1 · PCRE2 10.39 |
| FakerPHP/Faker | 4 | 0 | 4 | PHP 7.4 · PCRE2 10.33 |
| filamentphp/filament | 2 | 0 | 2 | PHP 8.2 · PCRE2 10.40 |
| filp/whoops | 2 | 0 | 2 | PHP 7.3 · PCRE2 10.32 |
| getgrav/grav | 23 | 0 | 23 | PHP 8.3 · PCRE2 10.42 |
| google/google-cloud-php | 6 | 0 | 6 | PHP 8.2 · PCRE2 10.40 |
| google/recaptcha | 1 | 0 | 1 | PHP 8.4 · PCRE2 10.49 |
| google/site-kit-wp | 5 | 0 | 5 | PHP 7.4.33 · PCRE2 10.33 |
| greenlion/php-sql-parser | 1 | 0 | 1 | PHP 7.3 · PCRE2 10.32 |
| guzzle/psr7 | 3 | 0 | 3 | PHP 7.4 · PCRE2 10.33 |
| Heyosseus/sloppy | 3 | 0 | 3 | PHP 8.3 · PCRE2 10.42 |
| ibexa/core | 2 | 0 | 2 | PHP 8.5 · PCRE2 10.44 |
| infection/infection | 5 | 0 | 5 | PHP 8.3 · PCRE2 10.42 |
| janephp/janephp | 4 | 0 | 4 | PHP 8.3 · PCRE2 10.42 |
| jbowens/jBBCode | 1 | 0 | 1 | PHP 7.3 · PCRE2 10.32 |
| jolicode/castor | 1 | 0 | 1 | PHP 8.4.1 · PCRE2 10.49 |
| laminas/laminas-filter | 1 | 0 | 1 | PHP 8.2.99 · PCRE2 10.40 |
| larastan/larastan | 2 | 0 | 2 | PHP 8.2 · PCRE2 10.40 |
| laravel/pao | 1 | 0 | 1 | PHP 8.3 · PCRE2 10.42 |
| laravel/pint | 1 | 0 | 1 | PHP 8.3 · PCRE2 10.42 |
| laravel/prompts | 1 | 0 | 1 | PHP 8.1 · PCRE2 10.39 |
| laravel/valet | 1 | 0 | 1 | PHP 8.0 · PCRE2 10.35 |
| livewire/livewire | 6 | 0 | 6 | PHP 8.1 · PCRE2 10.39 |
| matthiasmullie/minify | 8 | 0 | 8 | PHP 7.3 · PCRE2 10.32 |
| mautic/mautic | 57 | 0 | 57 | PHP 8.1 · PCRE2 10.39 |
| michelf/php-markdown | 6 | 0 | 6 | PHP 7.4 · PCRE2 10.33 |
| minkphp/Mink | 1 | 0 | 1 | PHP 7.3 · PCRE2 10.32 |
| mmoreram/php-formatter | 3 | 0 | 3 | PHP 7.3 · PCRE2 10.32 |
| mockery/mockery | 4 | 0 | 4 | PHP 7.12.99 · PCRE2 10.33 |
| modelcontextprotocol/php-sdk | 5 | 0 | 5 | PHP 8.1 · PCRE2 10.39 |
| mpdf/mpdf | 57 | 0 | 57 | PHP 7.3 · PCRE2 10.32 |
| mustangostang/spyc | 1 | 0 | 1 | PHP 7.3 · PCRE2 10.32 |
| MyIntervals/PHP-CSS-Parser | 4 | 0 | 4 | PHP 7.3 · PCRE2 10.32 |
| NativePHP/desktop | 2 | 0 | 2 | PHP 8.3 · PCRE2 10.42 |
| nette/latte | 2 | 0 | 2 | PHP 8.2 · PCRE2 10.40 |
| nette/tester | 3 | 0 | 3 | PHP 8.1 · PCRE2 10.39 |
| nette/tracy | 3 | 0 | 3 | PHP 8.2 · PCRE2 10.40 |
| nette/utils | 4 | 0 | 4 | PHP 8.2 · PCRE2 10.40 |
| nextcloud/server | 14 | 0 | 14 | PHP 8.3 · PCRE2 10.42 |
| nikic/PHP-Parser | 1 | 0 | 1 | PHP 7.4 · PCRE2 10.33 |
| nunomaduro/termwind | 1 | 0 | 1 | PHP 8.2 · PCRE2 10.40 |
| octobercms/october | 7 | 0 | 7 | PHP 8.2 · PCRE2 10.40 |
| OskarStark/doctor-rst | 1 | 0 | 1 | PHP 8.5 · PCRE2 10.44 |
| owncloud/core | 7 | 0 | 7 | PHP 8.3 · PCRE2 10.42 |
| parsecsv/parsecsv-for-php | 1 | 0 | 1 | PHP 7.3 · PCRE2 10.32 |
| phan/phan | 38 | 0 | 38 | PHP 8.1 · PCRE2 10.39 |
| php-debugbar/php-debugbar | 1 | 0 | 1 | PHP 8.2 · PCRE2 10.40 |
| php-debugger/php-debugger | 1 | 0 | 1 | PHP 8.2 · PCRE2 10.40 |
| PHP-FFMpeg/PHP-FFMpeg | 1 | 0 | 1 | PHP 8.0 · PCRE2 10.35 |
| phpbb/phpbb | 49 | 0 | 49 | PHP 8.1 · PCRE2 10.39 |
| PhpCodeArcheology/PhpCodeArcheology | 5 | 0 | 5 | PHP 8.2 · PCRE2 10.40 |
| PHPCompatibility/PHPCompatibility | 2 | 0 | 2 | PHP 7.3 · PCRE2 10.32 |
| PHPCSStandards/PHP_CodeSniffer | 2 | 0 | 2 | PHP 7.3 · PCRE2 10.32 |
| phpDocumentor/ReflectionDocBlock | 4 | 0 | 4 | PHP 7.4 · PCRE2 10.33 |
| phplrt/phplrt | 1 | 0 | 1 | PHP 8.2 · PCRE2 10.40 |
| PHPMailer/PHPMailer | 8 | 0 | 8 | PHP 7.3 · PCRE2 10.32 |
| phpmd/phpmd | 1 | 0 | 1 | PHP 8.1 · PCRE2 10.39 |
| phpmetrics/PhpMetrics | 2 | 0 | 2 | PHP 8.1 · PCRE2 10.39 |
| phpmyadmin/phpmyadmin | 6 | 0 | 6 | PHP 8.2.99 · PCRE2 10.40 |
| phpmyadmin/sql-parser | 1 | 0 | 1 | PHP 8.2 · PCRE2 10.40 |
| PHPOffice/PHPWord | 1 | 0 | 1 | PHP 7.3 · PCRE2 10.32 |
| phpseclib/phpseclib | 7 | 0 | 7 | PHP 8.1 · PCRE2 10.39 |
| phpstan/phpstan-src | 2 | 0 | 2 | PHP 8.2.99 · PCRE2 10.40 |
| protonemedia/laravel-splade | 1 | 0 | 1 | PHP 8.2 · PCRE2 10.40 |
| reactphp/http | 2 | 0 | 2 | PHP 7.3 · PCRE2 10.32 |
| rectorphp/rector-src | 5 | 0 | 5 | PHP 8.4 · PCRE2 10.49 |
| Roave/DocbookTool | 1 | 0 | 1 | PHP 8.3.3 · PCRE2 10.42 |
| roundcube/roundcubemail | 39 | 0 | 39 | PHP 8.1 · PCRE2 10.39 |
| sabre-io/dav | 4 | 0 | 4 | PHP 7.4 · PCRE2 10.33 |
| sabre-io/vobject | 4 | 0 | 4 | PHP 8.2 · PCRE2 10.40 |
| schmittjoh/serializer | 2 | 0 | 2 | PHP 7.4 · PCRE2 10.33 |
| scrivo/highlight.php | 3 | 0 | 3 | PHP 7.3 · PCRE2 10.32 |
| shipmonk-rnd/dead-code-detector | 1 | 0 | 1 | PHP 8.1 · PCRE2 10.39 |
| Shopify/shopify-api-php | 2 | 0 | 2 | PHP 8.1 · PCRE2 10.39 |
| slevomat/coding-standard | 4 | 0 | 4 | PHP 7.4 · PCRE2 10.33 |
| smarty-php/smarty | 7 | 0 | 7 | PHP 7.3 · PCRE2 10.32 |
| spipu/html2pdf | 55 | 0 | 55 | PHP 7.3 · PCRE2 10.32 |
| spiral/framework | 1 | 0 | 1 | PHP 8.1 · PCRE2 10.39 |
| squizlabs/PHP_CodeSniffer | 4 | 0 | 4 | PHP 7.3 · PCRE2 10.32 |
| staabm/phpstan-dba | 1 | 0 | 1 | PHP 7.4 · PCRE2 10.33 |
| statamic/cms | 16 | 0 | 16 | PHP 8.1 · PCRE2 10.39 |
| stecman/symfony-console-completion | 1 | 0 | 1 | PHP 8.1 · PCRE2 10.39 |
| Sylius/Sylius | 1 | 0 | 1 | PHP 8.2 · PCRE2 10.40 |
| symfony/flex | 1 | 0 | 1 | PHP 8.1 · PCRE2 10.39 |
| symfony/mime | 1 | 0 | 1 | PHP 8.4.1 · PCRE2 10.49 |
| symfony/polyfill | 4 | 0 | 4 | PHP 7.3 · PCRE2 10.32 |
| symfony/polyfill-mbstring | 1 | 0 | 1 | PHP 7.3 · PCRE2 10.32 |
| tempestphp/highlight | 8 | 0 | 8 | PHP 8.4 · PCRE2 10.49 |
| tempestphp/tempest-framework | 4 | 0 | 4 | PHP 8.5 · PCRE2 10.44 |
| thecodingmachine/safe | 8 | 0 | 8 | PHP 8.1 · PCRE2 10.39 |
| thephpleague/commonmark | 2 | 0 | 2 | PHP 7.4 · PCRE2 10.33 |
| thephpleague/flysystem | 1 | 0 | 1 | PHP 8.0.2 · PCRE2 10.35 |
| thephpleague/geotools | 5 | 0 | 5 | PHP 7.3 · PCRE2 10.32 |
| theseer/phpdox | 2 | 0 | 2 | PHP 7.3 · PCRE2 10.32 |
| theseer/tokenizer | 1 | 0 | 1 | PHP 8.1 · PCRE2 10.39 |
| tijsverkoyen/CssToInlineStyles | 1 | 0 | 1 | PHP 7.4 · PCRE2 10.33 |
| twigstan/twigstan | 1 | 0 | 1 | PHP 8.3 · PCRE2 10.42 |
| TYPO3/Fluid | 3 | 0 | 3 | PHP 8.2 · PCRE2 10.40 |
| vinkius-labs/laravel-page-speed | 1 | 0 | 1 | PHP 8.2 · PCRE2 10.40 |
| voku/anti-xss | 6 | 0 | 6 | PHP 7.3 · PCRE2 10.32 |
| voku/email-check | 1 | 0 | 1 | PHP 7.3 · PCRE2 10.32 |
| voku/simple_html_dom | 3 | 0 | 3 | PHP 7.3 · PCRE2 10.32 |
| voku/urlify | 20 | 0 | 20 | PHP 7.3 · PCRE2 10.32 |
| walkor/workerman | 3 | 0 | 3 | PHP 8.1 · PCRE2 10.39 |
| wapmorgan/PhpCodeAnalyzer | 1 | 0 | 1 | PHP 8.1 · PCRE2 10.39 |
| WhichBrowser/Parser | 11 | 0 | 11 | PHP 7.3 · PCRE2 10.32 |
| willdurand/Negotiation | 1 | 0 | 1 | PHP 7.3 · PCRE2 10.32 |
| Wixel/GUMP | 4 | 0 | 4 | PHP 7.3 · PCRE2 10.32 |
| woocommerce/woocommerce | 58 | 0 | 58 | PHP 8.1 · PCRE2 10.39 |
| WordPress/WordPress-Coding-Standards | 5 | 0 | 5 | PHP 7.3 · PCRE2 10.32 |
| Yoast/wordpress-seo | 6 | 0 | 6 | PHP 7.4 · PCRE2 10.33 |
| zbateson/mail-mime-parser | 1 | 0 | 1 | PHP 8.1 · PCRE2 10.39 |
| zircote/swagger-php | 1 | 0 | 1 | PHP 8.2 · PCRE2 10.40 |
Want a project in the corpus? Propose a project.