--- title: "Exakat 1.1.7 review" url: https://www.exakat.io/exakat-1-1-7-review/ date: 2018-03-06 modified: 2018-03-06 author: "dams" description: "Exakat 1.1.7 review Exakat 1.1.7 and 1.1.6 are reviewed together this week. Two new reports are introduced : Stats and Fitting PHP version. Several new analysis are added : suggestion..." categories: - "Company" image: https://www.exakat.io/wp-content/uploads/2018/03/xumaogong.320.jpg word_count: 1026 --- # Exakat 1.1.7 review # Exakat 1.1.7 review Exakat 1.1.7 and 1.1.6 are reviewed together this week. Two new reports are introduced : Stats and Fitting PHP version. Several new analysis are added : suggestion to use array*fill*keys(), 4 new PHP extensions, and a TOCTOU classic problem. It is time to walk the Exakat 1.1.7 review. ## New Stats and Fitting PHP report Exakat 1.1.7 features two new reports: stats and fitting PHP report. ### Fitting PHP report This report displays features with their compatibility across versions. For example, anonymous classes are valid since PHP 7.0, and defining multiple parameters with the same name in a method is not valid since PHP 7.0. Exakat finds the incompatibilities in the audited code, and collect them in a single report. It gives a great overview of the code's compatibility state: both what lies ahead and what is not possible to do anymore. It was interesting to see that detecting the fitting PHP version is sometimes not possible: when the code checks the version and decide to include adapted code, the source ends up with files that are compatible with one version, and others that are compatible with another. The final result is an apparent paradox of code unusable. The Stats report is a spin off from the Ambassador. It lists a number of elements from the code, along with the number of occurrences in the code. For example, we can see here that [kliqqi](https://www.kliqqi.com/)includes 20 classes and 272 functions but no namespaces. ``` ``` ``` ```   ``` ``` Stats includes also counts for structures, classes. Stats gives information about the code structure and features usage. It is also great to store, commit after commit, to see the evolution in the code. The Stats reports was introduce in 1.1.6 and the Fitting PHP report was introduced in 1.1.7. Finally, we added a 'All' format, that produces every available format with the current Exakat version. That makes quite a lot of reports, so be cautious when asking for this specialty. On the other hand, it is a great way to surf all the reports, and find the one you like. ## TOCTOU in PHP TOCTOU is Time Of Check, Time Of Use. This applies to the silent cast that PHP may apply to values at various times in the code. For example, this code: ``` ``` ``` ``` ``` ```   ``` ``` Although the variable `$a` is checked as non-zero, the following cast to integer may very well yield a 0, and lead to a DivisionByZero error. Try it with `$a = 0.2;` to understand the problem. Exakat now reports those situations with the [Test Then Cast](http://exakat.readthedocs.io/en/latest/Rules.html#test-then-cast) report. ## Support 4 new extensions Exakat includes support for 4 new extensions : uopz, opencensus, varnish, xxtea. [ext/uopz](http://php.net/manual/en/book.uopz.php) stands for "User Operations for Zend". It exposes Zend Engine functionality that are used at compilation and execution time, allowing to modification of the internal structures. For example, it allows deletion of constants, copy, backup, rename of functions and methods, alteration of classes. This extension is particularly useful for testing frameworks, which may have to break some rules to make testing easier. ``` ``` ```   ``` [ext/opencensus](https://github.com/census-instrumentation/opencensus-php) is a stats collection and distributed tracing framework. It works with the [opencensus.io](http://www.opencensus.io) library, that collect and trace metrics in the application, and send them to analysis tool. It also has integration library for Laravel, Symfony, Wordpress, etc. ``` getSnapshot(); } catch (VarnishException $e) { echo $e->getMessage(); } ?> ``` [/php] ```   ``` [ext/xxtea](https://en.wikipedia.org/wiki/XXTEA) is a [PECL extension](https://github.com/xxtea/xxtea-php) that implements the XXTEA encryption algorithm. It is a simple algorithm, with a low footprint. ## The array_fill_keys() suggestion The Ambassador report, the default report from Exakat, includes a 'Suggestions' section. Those suggestions to upgrade the code with native PHP functions or better technics. For example, it is classic to set up an array with a list of keys. The suggestions section has a lot of those improvements : [Substring first](http://exakat.readthedocs.io/en/latest/Rules.html#substring-first) which suggests to shorten a string before manipulating its content, [Never Used Parameter](http://exakat.readthedocs.io/en/latest/Rules.html#never-used-parameter) that reports parameters in function definitions that are never used or [Should Use array_column()](http://exakat.readthedocs.io/en/latest/Rules.html#should-use-array-column) to extract efficiently indices and properties from arrays of values. ## Happy PHP code reviews With Exakat 1.1.7, audit and improve your PHP code. Exakat is both able to help remove bugs and use efficient native PHP functions. You may use it to learn new tricks in your code. All the 344 analyzers are presented in the docs, including the delightful [preg_match_all() Flag](file:///Users/famille/Desktop/analyzeG3/docs/_build/html/Rules.html?highlight=preg_match#preg-match-all-flag) :preg_match_all() has an option to configure the structure of the results : it is either by capturing parenthesis (by default), or by result sets. It's a rare bug, rating at 5%, but it makes the code really cleaner. Download Exakat on exakat.io, install it with Docker, upgrade it with 'exakat.phar upgrade -u' and like us on github: [https://github.com/exakat/exakat](https://github.com/exakat/exakat). ``` ``` ``` ```