Short name	Level	Default	Quick-fix	Section
XoopsAllowlistAnchor	Warning	on	yes	Security
XoopsAttributeEscape	Warning	on	yes	Security
XoopsCsrf	Warning	on	yes	Security
XoopsDynamicCode	Error	on	no	Security
XoopsGuestUser	Warning	on	yes	Security
XoopsLegacySuperglobal	Error	on	yes	Security
XoopsOrderBy	Warning	on	no	Security
XoopsPathContainment	Warning	on	no	Security
XoopsSmartyRequestEscape	Warning	on	yes	Security
XoopsSqlConcat	Warning	on	no	Security
XoopsSuperglobal	Weak warning	on	yes	Security
XoopsUnserialize	Warning	on	yes	Security
XoopsWeakToken	Warning	on	yes	Security
XoopsDeprecatedDbApi	Warning	on	yes	Database
XoopsInstallSql	Warning	on	no	Database
XoopsQueryExec	Warning	on	yes	Database
XoopsResultSetGuard	Weak warning	on	yes	Database
XoopsSqlComment	Error	on	yes	Database
XoopsSqlFileComment	Error	on	yes	Database
XoopsUpdateCreatesTable	Warning	on	no	Database
XoopsByRefArgument	Warning	on	no	Module files and bootstrap
XoopsDoubleCpHeader	Error	on	Alt+Enter only	Module files and bootstrap
XoopsFileHeader	Weak warning	on	yes	Module files and bootstrap
XoopsFormLoader	Warning	on	yes	Module files and bootstrap
XoopsHandlerSignature	Error	on	no	Module files and bootstrap
XoopsHttpStatus	Weak warning	on	yes	Module files and bootstrap
XoopsIncludeOnceHeader	Weak warning	on	yes	Module files and bootstrap
XoopsIsFileAsset	Weak warning	on	yes	Module files and bootstrap
XoopsLocalXoopsOption	Warning	on	yes	Module files and bootstrap
XoopsMenuAutoload	Error	on	yes	Module files and bootstrap
XoopsPreloadGlobal	Warning	on	no	Module files and bootstrap
XoopsRootPathGuard	Weak warning	on	yes	Module files and bootstrap
XoopsSetcookie	Weak warning	on	yes	Module files and bootstrap
XoopsStrictCalendarCast	Warning	on	yes	Module files and bootstrap
XoopsUnlink	Weak warning	on	no	Module files and bootstrap
XoopsMissingRegisteredTemplate	Warning	on	yes	Templates and Smarty
XoopsSmarty5Api	Warning	on	yes	Templates and Smarty
XoopsSmarty5TemplatePrep	Weak warning	off	no	Templates and Smarty
XoopsSmartyBlockShorthand	Warning	on	yes	Templates and Smarty
XoopsSmartyDateFormatStrftime	Warning	on	yes	Templates and Smarty
XoopsSmartyForeachItemShadowsFrom	Error	on	yes	Templates and Smarty
XoopsSmartyRemovedTag	Error	on	yes	Templates and Smarty
XoopsSmartyUnquotedPluginArg	Error	on	yes	Templates and Smarty
XoopsUnregisteredTemplate	Weak warning	on	Alt+Enter only	Templates and Smarty
XoopsWrongSmartyDelimiter	Error	on	yes	Templates and Smarty
XoopsDuplicateDefine	Warning	on	yes	Language files
XoopsLanguageLoad	Weak warning	off	no	Language files
XoopsLanguageRole	Weak warning	on	no	Language files
XoopsLocaleConstant	Warning	on	no	Language files
XoopsThemeConstant	Weak warning	on	no	Language files
XoopsDeprecatedCoreApi	Warning	on	yes	Deprecated APIs
XoopsDoubleEncodedAmp	Error	on	yes	Deprecated APIs

All the inspections are just suggestions, so you can select only those that you're interested in and ignore the others, so they are not creating any extra noise for you.

nevertheless, great plugin

Hi

thanks for the detailed explanaition :)
but for me then it is no problem, because I use my MigrateHelper class in my modules. This class automatically compares current module tables with mysql.sql. If in mysql.sql there is a new table, or a new column in one of the existing tables the MigrateHelper automatically apply all changes to the module tables ;)

Example: https://github.com/XoopsModules27x/wgholiday/blob/main/class/Common/MigrateHelper.php

Tutorial for work with xStyles:
https://github.com/XoopsModules27x/cssholmes/blob/master/docs/TUTORIAL-xStyles.md

Meet cssHolmes 3.3.0 Alpha 1: See it. Style it. Compare it.

Improving a XOOPS theme often means finding the right page, locating an element, changing CSS and checking the result again. cssHolmes 3.3.0 Alpha 1 brings inspection, visual editing and comparison into one workflow, helping you spend more time improving your theme and less time switching between tools.

From inspection to improvement

Select an element and explore its styles, design tokens and estimated text contrast. Adjust colors, typography, spacing and supported layout properties with live preview. Undo and redo make it easy to explore alternatives. Your draft stays private until you choose Save to theme; published overrides are stored separately from the theme's original stylesheets.

Better together with xStyles

With the matching xStyles integration update, common headings, tables, forms and other elements become your theme-testing workspace:

- Find inconsistencies faster: inspect and edit examples directly from the gallery.
- Compare before publishing: view the published appearance beside your draft.
- Check responsive designs: preview your draft at 360, 768 and 1280 pixels together.
- Reuse good ideas: save named style sets and import or export alternatives without publishing them.

Theme and template diagnostics help you investigate problems, while previous-save restoration provides a way back after publishing.

Try the workflow on a staging site and help shape the next release. This is an alpha for testing and feedback, requiring PHP 8.4 or newer. Start with the included illustrated cssHolmes + xStyles tutorial, then check your changes on representative site pages before publishing.

DOWNLOAD: https://github.com/XoopsModules27x/cssholmes/releases

Source and issues: XoopsModules27x/cssholmes.

XOOPS Support Plugin for PhpStorm: Alpha 5 is here

XOOPS Support Plugin brings XOOPS CMS knowledge into PhpStorm and IntelliJ IDEA: it finds the mistakes that break XOOPS modules and fixes most of them with one Alt+Enter. It covers XOOPS 2.5, 2.7, and the upcoming XOOPS 2.8 and 4.0, for Core and module development.

Fewer false positives, found on three newbb trees, each checked against the module source and pinned with a fixture.

1. InstallSql and SqlFileComment check only the file the installer runs: the one an active $modversion['sqlfile'] entry names, or sql/mysql.sql when none is named. Database dumps and old upgrade scripts beside it are no longer reported, and an entry set to false switches the check off.
2. DeprecatedCoreApi no longer reports a module handler's own synchronization().
3. Unlink accepts an SplFileInfo check (isFile() before getRealPath() / getPathname(), isLink() before getPathname()).
4. UnregisteredTemplate and MissingRegisteredTemplate skip test trees.
5. MenuAutoload inserts the require above declare(strict_types=1) and leaves a bootstrap.php that already loads the autoloader alone.
6. New INSPECTIONS.md lists all 52 inspections with default level, quick-fix and when each stays silent. The UpdateCreatesTable description is rewritten in plain words.

Getting started

Install the plugin and open a XOOPS project. Detection is automatic. You can set the Core Version and other options under Settings → Languages & Frameworks → XOOPS Support, and the inspections are listed under Settings → Editor → Inspections → XOOPS. The plugin installs and updates without an IDE restart.

Source, documentation and issues on GitHub

XOOPS runs sql/mysql.sql only once, on a fresh install. When a site updates a module that's already installed, that file is never run again. Any new table has to be created by the module's update code instead, usually in onupdate.php or include/update.php.

The problem the inspection guards against:

1. Version 1.0 of a module ships with tables a and b.
2. In version 1.1 you add table c to mysql.sql.
3. New sites that install 1.1 get a, b and c.
4. Sites updating from 1.0 to 1.1 still have only a and b, because mysql.sql isn't run on update.
5. The first page that uses c fails with MySQL error 1146: Table doesn't exist.

The inspection looks at each CREATE TABLE in mysql.sql and checks whether the update code mentions that table anywhere. If it doesn't, you get this note: "updating sites might never get this table."

Why it's only a weak note:

The plugin can't tell whether the table is new or old. It only sees the current code, not which tables earlier releases shipped.

- If the table has existed since the module's first release, every site already has it and nothing needs to be done. The note is harmless.
- If the table was added in a later version, updating sites are missing it, and you need to add creation code to the update script.

Only the author knows which case applies, so the plugin reports it quietly instead of calling it an error.

What to do when you see it:

- If the table was there from the start, ignore it.
- If you added the table after a release, make the update script create it when it's missing. For example, use CREATE TABLE IF NOT EXISTS in your update callback, or use XMF's migrate or table-loading tools.


Here are two good examples, each adds a table in sql/mysql.sql for new installs, and its update script also creates that table for sites updating from an older version.

1. xnewsletter: modules/xnewsletter/include/onupdate.php

This is the clearest one, because each release that added a table has its own step:

- Version 1.03 added the import table. xoops_module_update_xnewsletter_103() runs CREATE TABLE mod_xnewsletter_import (line 332).
- Version 1.04 added the task table. ..._104() runs CREATE TABLE mod_xnewsletter_task (line 296).
- Version 1.30 added templates. ..._130() runs CREATE TABLE xnewsletter_template (line 193).

A site still on 1.02 gets all three tables when it updates. A fresh install gets them straight from mysql.sql.

2. news: modules/news/include/onupdate.php

It does the same for news_stories_votedata at line 173. It checks whether the table exists first, so running it twice does no harm.

In both modules, the table appears in two places, in sql/mysql.sql for new installs and in the update script for sites that already have the module. If you add a table to mysql.sql and don't add the matching block to the update script, every site that updates will hit "Table doesn't exist" (error 1146). That's exactly what the inspection warns about. For these tables the warning doesn't appear, because the update script mentions them.

hi
tested , works fine, found again some issues in my code.

But only one thing I do not understand:
"A CREATE TABLE in sql/mysql.sql that no update path mentions is never created for a module that is already installed. If a released version shipped without the table, sites updating from it fail with error 1146 on first use. Whether such a version exists cannot be told from the tree, and a table as old as the module needs no update path, so this is a weak note."

I do not understand what this means. Can someone explain for dummies?

As next, I'll work on an integration of xStyles and cssHolmes, incl. a Theme Designer, that you could use to customize some of the elements of the current theme, like colors, font size, etc.