Demonstration code for PHP_CodeSniffer rules for WordPress.

ArrayDeclarationFail.php

<?php

$query_vars = array_merge(
	array('post_type' => 'food'),
	// ...
	array(
		'post_status' => 'private',
		'orderby' => 'title'
	)
);
$query = new WP_Query($query_vars);

DiscouragedFunctionsFail.php

<?php

query_posts('post_type=attachment');
while( have_posts() ){ the_post();
	// ...
}
wp_reset_query();

DoubleQuoteUsageFail.php

<p>
	<?php _e("Save the cheerleader *\0/*", "heroes") ?>
</p>

EscapeOutputFail.php

<form method="get">
	<?php echo get_avatar($comment) ?>
	<script>
	var city = "<?php echo get_query_var('city') ?>";
	</script>
	<p>
		<label for=city>City: </label>
		<input type=text name=city id=city
			value="<?php echo $_GET['city'] ?>">
	</p>
	<p><button type=submit>View</button></p>
	<?php echo sprintf(__('Now is %d'), time()); ?>
</form>

EscapeOutputWin.php

<form method="get">
	<?php echo get_avatar($comment) ?>
	<script>
	var city = <?php
		echo json_encode(get_query_var('city'))
	?>;
	</script>
	<p>
		<label for=city>City: </label>
		<input type=text name=city id=city
			value="<?php echo esc_attr($_GET['city']) ?>">
	</p>
	<p><button type=submit>View</button></p>
	<?php echo sprintf(__('Now is %d'), time()); // xss ok ?>
</form>

lint

#!/bin/bash
# Run php files in the repo through phpcs
# By @westonruter

status_filter='^.M'
status_filter_description="Linting modified files only"

while getopts ":sa" opt; do
    case $opt in
        s)
            status_filter='^M'
            status_filter_description="Linting staged files only"
            ;;
        a)
            status_filter=''
            status_filter_description="Linting everything"
            ;;
    esac
done
echo $status_filter_description

shift $((OPTIND-1))

if [ $# == 0 ]; then
    paths=$(pwd)
else
    paths=$@
fi

echo "Linting path(s) $paths"

if [ -z $status_filter ]; then
    php_files=$(find $paths -type f -name '*.php')
else
    php_files=$(
        git status --porcelain -s $paths |
        grep -E "$status_filter" |
        cut -c4- |
        grep -E '\.php$'
    )
fi

if [ -n "$php_files" ]; then
    exec phpcs --standard=$(dirname $0)/ruleset.xml $php_files
else
    echo "Nothing to lint"
fi

lint-staged

#!/bin/bash

php_files=$(
    git status --porcelain |
    grep -E "^M" |
    cut -c4- |
    grep -E '\.php$'
)

if [ -n "$php_files" ]; then
    exec phpcs --standard=ruleset.xml $php_files
else
    echo "Nothing to run through phpcs"
fi

OperatorSpacingFail.php

<?php

for ($month=0; $month<12; $month+=1) {
	// ...
}

PhpIndentFail.php

<?php

/**
 * Get our wp_nav_menu() fallback, wp_page_menu(), to show a home link.
 */
function twentyeleven_page_menu_args( $args ) {					
		if ( ! isset( $args['show_home'] ) )
	    $args['show_home'] = true;
    return $args;
}
add_filter( 'wp_page_menu_args', 'twentyeleven_page_menu_args' );      

ruleset.xml

<?xml version="1.0"?>
<ruleset name="My WordPress Project">
	<!-- The documentation for how to http://pear.php.net/manual/en/package.php.php-codesniffer.annotated-ruleset.php -->
	<description>A custom set of rules to specific to the current WordPress project</description>

	<exclude-pattern>*.xml</exclude-pattern>

	<!-- Non-WordPress rules to include -->
	<rule ref="Squiz.PHP.CommentedOutCode"/>
	<rule ref="Squiz.WhiteSpace.SuperfluousWhitespace"/>
	<rule ref="Generic.CodeAnalysis.UnusedFunctionParameter"/>
	<rule ref="Generic.Commenting.Todo"/>
	<rule ref="Generic.PHP.DisallowShortOpenTag"/>

	<!-- Inclusion of WordPress rules -->
	<rule ref="WordPress">
		<exclude name="WordPress.Files.FileName" /> <!-- We need files like single-acme_news.php -->
		<exclude name="WordPress.Formatting.MultipleStatementAlignment" />
		<exclude name="WordPress.WhiteSpace.ControlStructureSpacing" />
		<exclude name="WordPress.Functions.FunctionCallSignature" />
		<exclude name="WordPress.Objects.ObjectInstantiation" />
	</rule>
</ruleset>