Psalm and PHPStan disagree, and both are right

The two analysers have different defaults and different opinions about the same code, and running both is rarely worth it.

PHPStan   levels 0-9, one axis. a baseline. extensions
          for every framework. easier to adopt.

Psalm     per-issue configuration, taint analysis, and
          a much stronger generics story. steeper start.

both      duplicated configuration, contradictory
          findings, and two baselines to maintain.

pick one. the second one's marginal findings are not
worth the second configuration file.

Psalm’s taint analysis is the one genuinely differentiating feature and matters for code handling untrusted input — it tracks a value from source to sink and reports the ones that reach a query unescaped. That is worth a second tool for a specific audit rather than as a permanent fixture. For everyday use the choice is mostly about which one the team will actually keep at a high level.