Hi!

According to the official documentation, Semgrep is a lightweight, open-source, static analysis tool for finding bugs and enforcing code standards. It supports many different languages and can find bug variants with patterns that look like source code. Together with the tool, a collection of pre-written rules is provided.

Semgrep is a simple yet powerful tool. It can be considered as the grep Unix tool on steroids, because it understands the syntax of the analyzed language (but it offers many more functionalities and it evolves continuously). Support for many languages is mature, but for others like PHP it is still experimental. Many rules are created by the community and the resulting rulesets are more complete for some languages than for others.

At the time of this writing, public rules available for the PHP language are only a few, and some of them make use of taint tracking. Speaking for example of SQL Injection, there are only tainted rules that during an assessment I was involved in could not find much.