How to analyze PHP code for security without starting the server?

Question

linux

It is necessary to analyze the project folder for threats of XSS attacks, SQL injections and other things from the console and get the result in the same place in some json, is there a similar tool?

Answer 1

https://duckduckgo.com/?q=php+static+analyzer

Answer 2

Security Analysis in Psalm
Roave Security Advisories - installed as a composer package

Answer 3

Such tools are called "static code scanner", for example https://www.sonarqube.org/

Answer 4

The closest tool in terms of functionality is a qualified developer who will review the code. =)