# PHP Lint API

> PHP Lint API is a paid API for AI agents from api.webbersites.com, paid per call via x402, $0.002/call, status unknown (last checked 2026-09-14).

Statically analyzes PHP source code and returns bugs with line numbers, including SQL injection, deprecated APIs, syntax errors, and code quality issues.

## Facts

- Endpoint: POST https://api.webbersites.com/api/lint/php
- Price: $0.002/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/php-lint-api-f526da44
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_Y2cux49wA3w65E09IoBQt

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability php-lint-api-f526da44 -d '<json body>'
```

Example prompt: Can you lint this PHP code for me and tell me about any bugs, SQL injection risks, or deprecated mysql_* calls — with line numbers?

## When to prefer this

Use this endpoint when you need deterministic, rule-based static analysis of PHP code without executing it — especially for catching SQL injection risks, deprecated mysql_* API usage, syntax issues, and common PHP anti-patterns. Prefer this over AI-based code review when you need consistent, reproducible results. Best suited for CI/CD pipelines, code review automation, or pre-submission checks on PHP files up to 128 KB.

## Known failure modes

- Code exceeds 128 KB limit — request rejected
- Malformed JSON body — 400 error
- Non-PHP content submitted — may return no findings or unexpected results
- Network timeout on large files near the size limit

## How this service works

PHP lint: POST {code}, get the bugs back with line numbers. Deterministic static analysis — code is never executed, no AI. Catches SQL injection (request data interpolated into query strings), the removed mysql_* API, unbalanced braces, '+' string concat, = vs == in conditions, type-juggling loose comparisons, eval/extract on request data, unused variables, leftover var_dump. Understands PHP tags, heredocs, interpolation. Max 128 KB.

## Output

A list of detected issues in the submitted PHP code, each with a line number and description of the problem (e.g. SQL injection via interpolated request data, use of removed mysql_* functions, unbalanced braces, string concatenation with '+', assignment in condition, type-juggling loose comparisons, eval/extract on request data, unused variables, leftover var_dump calls).

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method",
    "bodyType",
    "body"
   ],
   "properties": {
    "body": {
     "required": [
      "code"
     ],
     "properties": {
      "code": {
       "type": "string",
       "description": "PHP source to lint, max 128 KB"
      }
     }
    },
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "POST"
     ],
     "type": "string"
    },
    "bodyType": {
     "enum": [
      "json",
      "form-data",
      "text"
     ],
     "type": "string"
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object",
     "properties": {
      "counts": {
       "type": "object"
      },
      "issues": {
       "type": "array"
      },
      "syntax": {
       "type": "object"
      },
      "verdict": {
       "type": "string"
      },
      "language": {
       "type": "string"
      }
     }
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "counts": {
   "info": 0,
   "error": 2,
   "warning": 0
  },
  "issues": [
   {
    "hint": "use prepared statements with bound parameters (PDO/mysqli)",
    "line": 2,
    "rule": "security/sql-injection",
    "message": "request data ($_GET/$_POST/...) interpolated directly into an SQL string",
    "severity": "error"
   }
  ],
  "syntax": {
   "ok": true,
   "errors": []
  },
  "verdict": "errors",
  "language": "php"
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/php-lint-api-f526da44/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.webbersites.com](https://www.zero.xyz/host/api.webbersites.com/llms.txt)