AI code review for PHP.
PHP review is injection review: query strings assembled from request data, output echoed without escaping, keys pasted into config. WellMerged sorts the diff into Stories, then checks where the strings meet the database and the browser.
What WellMerged checks on every PHP pull request.
- Interpolated queries
- String-built SQL is flagged at the line with the prepared-statement rewrite.
- Unescaped output
- Echoed request data without escaping is surfaced as a security concern with the template path.
- Committed secrets
- Keys in constants and config fail the required checks check.
- Missing tests
- Changed classes without PHPUnit coverage are flagged; test drafts arrive with the review.
The AI review follows the request: which route reads which input, where it lands in the database, and what gets echoed back.
Run it on your PHP repository.
Install the GitHub App and open a pull request. Reviews on public repositories are free with no cap, and every plan starts with 100 private reviews a month.
