# PHPCodeSniffer **Auditor Job Name**: PHP Security Audit v2\ **Auditor image:** registry.gitlab.com/whitespots-public/security-images/phpcs-security-audit:2.0.1\ **AppSec Portal Importer Name**: PHPCodeSniffer Scanner tokenizes PHP files and detects violations of a defined set of coding standards. [PHPCodeSniffer](https://github.com/PHPCSStandards/PHP_CodeSniffer/) is a set of two PHP scripts; the main `phpcs` script that tokenizes PHP, JavaScript and CSS files to detect violations of a defined coding standard, and a second `phpcbf` script to automatically correct coding standard violations. PHP\_CodeSniffer is an essential development tool that ensures your code remains clean and consistent. **Curl example** {% code overflow="wrap" %} ``` curl -X POST localhost/api/v1/scan/import/ -H "Authorization: Token a75bb26171cf391671e67b128bfc8ae1c779ff7b" -H "Content-Type: multipart/form-data" -F "file=@./phpcs.json" -F "product_name=Product1" -F "product_type=Application" -F "scanner_name=PHPCodeSniffer" -F "branch=dev" -F "repository=git@gitlab.com:whitespots-public/appsec-portal.git" ``` {% endcode %} In this command, the following parameters are used: 1. `-X POST`: specifies the HTTP method to be used (in this case, POST) 2. `-H "Authorization: Token "`: specifies the [**authorization token**](https://docs.whitespots.io/appsec-portal/features/importing-reports-from-scanners-to-appsec-portal#authorization-token) obtained from AppSec Portal. 3. `-H "Content-Type: multipart/form-data"`: specifies the content type of the request. 4. `-F "file=@"`: specifies the **path to the report file** generated by the scanner. 5. `-F "product_name="`: specifies the **name of the product** being scanned. 6. `-F "product_type="`: specifies the **type of the product** being scanned. 7. `-F "scanner_name="`: specifies the **name of the scanner** used to generate the report (PHPCodeSniffer) 8. `-F "branch="`: (*optional*) specifies the name of the branch in the source code repository (if applicable) This parameter is particularly useful when you want to associate the scan results with a specific branch in your repository. If not provided, the scan will be associated with the default branch Asset information, if an [auditor ](https://docs.whitespots.io/auditor)is used 9. `-F "repository="`: If your product is **code** in a repository enter the address of your **repository** in a specific format, for example: :whitespots-public/appsec-portal.git 10. `-F "docker_image="`: If your product is **image** enter the address of the **registry** where your product is located, for example: registry.gitlab.com/whitespots-public/appsec-portal/back/auto\_validator:latest 11. `-F "domain="`: If your product is **web** enter the **domain name** of your product, for example: whitespots.io 12. `-F "host="`: If your product is **web** enter the **IP address** of your product, for example: 0.0.0.0 **Report example:** ``` $ phpcs /path/to/code/myfile.php FILE: /path/to/code/myfile.php -------------------------------------------------------------------------------- FOUND 5 ERROR(S) AFFECTING 2 LINE(S) -------------------------------------------------------------------------------- 2 | ERROR | Missing file doc comment 20 | ERROR | PHP keywords must be lowercase; expected "false" but found "FALSE" 47 | ERROR | Line not indented correctly; expected 4 spaces but found 1 51 | ERROR | Missing function doc comment 88 | ERROR | Line not indented correctly; expected 9 spaces but found 6 -------------------------------------------------------------------------------- ```