Developer tool

Legacy PHP Risk Checker

Paste PHP source for a static scan that classifies removed APIs, deprecated calls, and security-sensitive legacy patterns—without executing code.

How it works

What it does

The Legacy PHP Risk Checker performs a static scan of pasted PHP. Findings are grouped as critical blockers, likely migration blockers, deprecated APIs, security-sensitive legacy patterns, or manual review items.

Important: Pattern matches are worded as potential risks requiring review. This tool does not prove vulnerabilities and does not execute your code.

When to use it

  • Quick triage of a suspicious legacy file before a PHP upgrade
  • Spotting mysql_*, eval, weak password hashing patterns, or removed APIs
  • Pairing with the compatibility and deprecated checkers for coverage

How input is processed safely

Submitted text is token/pattern scanned only. There is no eval, include, or shell execution. Do not paste secrets or full proprietary codebases.

Related: Compatibility checker · Security modernization · Removed functions

Run in browser

AJAX processing only. No remote PHP execution sandbox. Results are not indexed.

Inputs are processed for this request only and are not stored in analytics. Object unserialize and arbitrary PHP execution are blocked.

Safety notes

  • Submitted tool contents are not written to analytics or search logs.
  • This site never evaluates arbitrary PHP from the browser.
  • Generated configs are starting points—validate on a staging host before production.