# PHP

The PHP analyser is triggered when a “composer.json” or “composer.lock” is found in the root of the project. 

When operating on a PHP project the analyser will directly load the dependencies from the lock file. If a “composer.json” is found but not the lock, this will be generated using “composer install”. 

When using the [thin client](https://docs.meterian.io/the-client/client), the required tools may have to be installed and configured (composer). This is not required when using the [dockerized client](https://docs.meterian.io/the-client/the-meterian-client-dockerized). 

The scanner works on:

* standard PHP packages from [packagist.org](https://packagist.org/)
* Bower and NPM packages repackaged as native Composer packages from [asset-packagist.org](https://asset-packagist.org/)
* Drupal packages from [drupal.org](https://www.drupal.org/)