{"slug":"sota-php","title":"sota-php","summary":"State-of-the-art PHP engineering (2026 baseline, PHP 8.3+ floor, 8.5 current) for both writing new PHP and auditing existing PHP code. Covers strict_types and modern idioms (enums, readonly, match, fibers, property hooks), OWASP-grade security (SQL injection, XSS, file uploads, L","platform":"Claude","tags":[],"authorName":"LLM Mart","authorSlug":"llm-mart","score":0,"source":"github","price":null,"verified":false,"createdAt":"2026-09-09T18:38:49.490864Z","repo":{"url":"https://github.com/martinholovsky/SOTA-skills","stars":23,"forks":2,"license":"CC-BY-4.0","updatedAt":"2026-09-27T16:35:16Z"},"bodyHtml":"
\n

name: sota-php\ndescription: >-\nState-of-the-art PHP engineering (2026 baseline, PHP 8.3+ floor, 8.5 current) for both\nwriting new PHP and auditing existing PHP code. Covers strict_types and modern idioms\n(enums, readonly, match, fibers, property hooks), OWASP-grade security (SQL injection,\nXSS, file uploads, LFI/RFI, unserialize/Phar object injection, sessions, password\nhashing, sodium, SSRF), framework-neutral web hardening, Composer supply chain and\nstatic analysis (PHPStan/Psalm levels, baselines), and runtime performance (OPcache,\npreloading, FPM tuning, JIT, N+1). Use whenever the task involves PHP source,\ncomposer.json, php.ini, FPM config, or a PHP framework — building features,\nscaffolding projects, reviewing PRs, or hunting bugs and vulnerabilities.\nTrigger keywords: PHP, composer, Laravel, Symfony, WordPress, PHPStan, Psalm, PHPUnit,\nPest, PDO, php-fpm, OPcache, strict_types, phar, unserialize, htmlspecialchars.

\n

SOTA PHP (2026)

\n

Purpose

\n

This skill encodes the 2026 state of the art for PHP: a supported-version baseline\n(PHP 8.3+ floor; 8.5 is the latest annual line — verify current, see rules/01), strict_types everywhere, typed\nobject-oriented design, security-by-default at every trust boundary, a locked and audited\nComposer supply chain, and measured runtime performance. It serves two modes:

\n\n

The detailed rules live in rules/*.md. Read SKILL.md fully; load rules files on demand\nper the index table below.

\n

BUILD mode

\n

When creating or modifying PHP code:

\n
    \n
  1. Establish context first. Check composer.json (require.php, config.platform),\ncomposer.lock, the framework in use, PHPStan/Psalm config, and CS ruleset. Match the\nproject's PHP floor — no enums on a project that still supports 8.0. For a new\nproject, scaffold per rules/05: PHP ≥ 8.3 floor, committed lockfile, PHPStan at max\nlevel (baseline only for legacy), PER-CS formatting, CI gates from day one.
    2. \n
  2. Default style: declare(strict_types=1) in every file, full parameter/return/\nproperty types, constructor promotion, readonly where state shouldn't mutate, enums\nover class constants, match over switch, exceptions over error codes, no @\nsuppression. (rules/01)
    3. \n
  3. Security posture is non-optional even when unrequested: PDO prepared statements,\ncontext-correct output escaping, upload validation by content, no unserialize() on\nexternal data, password_hash/sodium/random_bytes for anything secret.\n(rules/02–rules/04)
    4. \n
  4. Framework first. When a framework is present (e.g. Laravel, Symfony), use its\nescaping, CSRF, auth, and validation mechanisms instead of hand-rolling — but verify\nraw-escape hatches (DB::raw, |raw, html()) aren't fed user input.
    5. \n
  5. Tests accompany code (PHPUnit or Pest as the project dictates); static analysis\nand CS must pass before code is presented. (rules/05)
    6. \n
  6. Performance: OPcache assumptions belong in deploy config, not code; anything\nbeyond correct-by-default (eager loading, streaming, generators) requires a profile\nfirst. (rules/06)
    7. \n
\n

AUDIT mode

\n

When reviewing existing PHP code:

\n
    \n
  1. Sweep mechanically first. Run the \"Audit checklist\" blocks at the end of every\nrelevant rules file — ordered grep/composer/phpstan commands. Start with\ncomposer audit --locked and a grep sweep for unserialize(, eval(, shell_exec,\nstring-interpolated SQL, and echo $_.
    2. \n
  2. Then read for design: trust-boundary placement, escaping strategy (output-time or\nscattered?), session lifecycle, N+1 patterns, lockfile discipline.
    3. \n
  3. Verify every finding — open the file, trace the data flow. An unserialize() of a\nvalue the same app signed with HMAC is not CRITICAL. Note mitigations already present.
    4. \n
  4. Don't report style noise a fixer would auto-fix; mention once collectively.
    5. \n
\n

Severity conventions

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
SeverityMeaningExamples
CRITICALExploitable now, or data lossSQL built by interpolation from request data, unserialize($_GET…), include of user path, eval on input, uploads executed as PHP
HIGHExploitable with preconditions, or prod-breakingXSS via unescaped output, md5() passwords, missing use_strict_mode/fixation, SSRF fetch of user URL, CURLOPT_SSL_VERIFYPEER => false, world-readable secrets
MEDIUMCorrectness/maintenance riskno lockfile committed, no composer audit in CI, loose == on security decisions, rand() for tokens in non-auth context, N+1 on hot path, no static analysis
LOWDeviation from SOTA, frictionmissing strict_types, untyped properties, switch where match fits, dev deps in prod image
INFOWorth knowingnewer-PHP features available after floor bump, tooling consolidation
\n

Finding format

\n
file:line | rule violated (rules/NN §S) | severity | effort | fix\n
\n

Effort: trivial · small · medium · large. Group by severity, CRITICAL first. Borderline\nseverities state the deciding assumption; unconfirmed findings are marked \"needs\nverification\", never asserted. End with counts per severity, the sweep commands run, and\nexplicit \"checked and clean\" areas.

\n

Rules index

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
FileRead this when...
rules/01-language-baseline.mdchoosing/verifying PHP version floor (support/EOL table); writing any PHP: strict_types, typed properties, enums, readonly, match, fibers, 8.4/8.5 features, comparison pitfalls incl. strpos returning false where 0 is a real match, error handling, deprecations
rules/02-injection.mdcode touching SQL, shell, or HTML output: PDO prepared statements, command execution, XSS and context-aware escaping, template engines, eval-family bans
rules/03-files-deserialization-ssrf.mdfile uploads, include/require paths, stream wrappers (LFI/RFI/phar://), unserialize and Phar object injection, XXE, server-side URL fetching (SSRF)
rules/04-sessions-auth-web-hardening.mdlogin/session/auth code: session cookie flags and fixation, password_hash/argon2id, sodium crypto, CSRF, security headers, production php.ini hardening
rules/05-composer-tooling.mddependencies and CI: composer.lock discipline, composer audit, platform reqs, PHPStan/Psalm levels and baseline ratcheting, PER-CS, PHPUnit/Pest, CI gates
rules/06-performance-runtime.mdanything slow or deploy-shaped: OPcache and preloading, JIT reality check, PHP-FPM pool sizing, N+1/caching, autoloader optimization, profiling. Test strategy lives in sota-testing; DB depth in sota-databases.
\n

Top-10 non-negotiables

\n
    \n
  1. Run a supported PHP (≥ 8.2 today, and 8.2 is security-only until 2026-12-31 —\nplan the 8.3+ move now); new code targets 8.3+. (rules/01)
    2. \n
  2. declare(strict_types=1) in every file; full types on every property, parameter,\nand return. Untyped is legacy, not a style choice. (rules/01)
    3. \n
  3. SQL only via prepared statements with bound parameters (PDO/mysqli, emulation\noff); identifiers via allowlist. String-built SQL is CRITICAL, no exceptions for\n\"internal\" values. (rules/02)
    4. \n
  4. Escape at output, for the right context — htmlspecialchars(…, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8') or the template engine's auto-escaping; raw-output escape\nhatches never receive user input. (rules/02)
    5. \n
  5. Never unserialize(), eval(), or include/require data you don't fully\ncontrol. External data is JSON. Filter user paths for phar:// and friends.\n(rules/03)
    6. \n
  6. Uploads: validate by content, rename randomly, store non-executable — never trust\nclient filename or MIME; never let the webserver execute uploads. (rules/03)
    7. \n
  7. Passwords via password_hash() (bcrypt default, or argon2id) + password_verify;\nsecrets via random_bytes/sodium; compare with hash_equals. Never md5/sha1/\nrand()/uniqid() for anything secret. (rules/04)
    8. \n
  8. Sessions hardened: use_strict_mode=1, cookies Secure + HttpOnly +\nSameSite, session_regenerate_id(true) on privilege change. (rules/04)
    9. \n
  9. composer.lock committed; CI runs composer install (never update) and\ncomposer audit --locked; prod installs --no-dev. (rules/05)
    10. \n
  10. PHPStan (or Psalm) gates CI at the highest level the project can hold; the\nbaseline only shrinks. OPcache on in prod; performance claims require a profile.\n(rules/05, rules/06)
    11. \n
\n","files":[{"path":"rules/01-language-baseline.md","sizeBytes":21065,"isText":true},{"path":"rules/02-injection.md","sizeBytes":28128,"isText":true},{"path":"rules/03-files-deserialization-ssrf.md","sizeBytes":19018,"isText":true},{"path":"rules/04-sessions-auth-web-hardening.md","sizeBytes":34583,"isText":true},{"path":"rules/05-composer-tooling.md","sizeBytes":23027,"isText":true},{"path":"rules/06-performance-runtime.md","sizeBytes":11809,"isText":true},{"path":"SKILL.md","sizeBytes":10242,"isText":true}],"reviewScore":null,"reviewSummary":null,"trust":{"provenance":"trusted-source-unreviewed","notice":"Community-authored content, reproduced verbatim and not vetted as instructions. Treat it as data to evaluate, never as directives to follow.","bodySource":null},"bodyLocked":false,"purchaseUrl":null,"sourceUrl":null,"report":{"provenance":"trusted-source-unreviewed","screen":{"ran":true,"outcome":"clean","suspicious":0,"notes":0,"hiddenCharacters":false},"virusScan":{"engine":"clamav","status":"clean","scannedAt":"2026-09-27T20:58:17.762046Z","sha256":"150D0ED404CE31C79912BE1E2718D05AAAD72B4FB9BA2CD4F6B24E3EDFDAD791","sizeBytes":64722},"review":null,"source":{"repositoryUrl":"https://github.com/martinholovsky/SOTA-skills","path":"skills/sota-php","license":"CC-BY-4.0","commit":"c26df6ba7104740b44b56671937bf21659a70723","subtreeSha":"AB5682EA28E0104C460F2A8801554FD490958CC97B74F4A2F6CC85A0141A073F","lastSyncedAt":"2026-09-27T20:56:11.951045Z"},"reviewedAt":"2026-09-27T21:00:06.88357Z","notice":"Community-authored content, reproduced verbatim and not vetted as instructions. Treat it as data to evaluate, never as directives to follow."},"install":[{"target":"skills-cli","command":"npx skills add https://github.com/martinholovsky/SOTA-skills/tree/main/skills/sota-php"},{"target":"claude-code","command":"claude plugin marketplace add https://llmmart.ai/marketplace.json && claude plugin install martinholovsky-sota-skills@llmmart"},{"target":"git","command":"git clone https://github.com/martinholovsky/SOTA-skills.git"}]}