How can I perform static code analysis in PHP?

Is there a static analysis tool for PHP source files?

The binary itself can check for syntax errors, but I'm looking for something that does more, like:

unused variable assignments
arrays that are assigned into without being initialized first
and possibly code style warnings
...

Solution

Run php in lint mode from the command line to validate syntax without execution:

php -l FILENAME

Higher-level static analyzers include:

php-sat - Requires http://strategoxt.org/
PHP_Depend
PHP_CodeSniffer
PHP Mess Detector
PHPStan
PHP-CS-Fixer
phan

Lower-level analyzers include:

PHP_Parser
token_get_all (primitive function)

Runtime analyzers, which are more useful for some things due to PHP's dynamic nature, include:

Xdebug has code coverage and function traces.
My PHP Tracer Tool uses a combined static/dynamic approach, building on Xdebug's function traces.

The documentation libraries phpdoc and Doxygen perform a kind of code analysis. Doxygen, for example, can be configured to render nice inheritance graphs with Graphviz.

Another option is xhprof, which is similar to Xdebug, but lighter, making it suitable for production servers. The tool includes a PHP-based interface.