diff --git a/modules/openapi-generator/src/main/resources/php/.php_cs b/modules/openapi-generator/src/main/resources/php/.php_cs
index 6b8e23c818a..4fbe53ec5ff 100644
--- a/modules/openapi-generator/src/main/resources/php/.php_cs
+++ b/modules/openapi-generator/src/main/resources/php/.php_cs
@@ -1,18 +1,23 @@
 <?php
 
-return Symfony\CS\Config::create()
-    ->level(Symfony\CS\FixerInterface::PSR2_LEVEL)
+return PhpCsFixer\Config::create()
     ->setUsingCache(true)
-    ->fixers(
-        [
-            'ordered_use',
-            'phpdoc_order',
-            'short_array_syntax',
-            'strict',
-            'strict_param'
-        ]
-    )
-    ->finder(
-        Symfony\CS\Finder\DefaultFinder::create()
-            ->in(__DIR__)
+    ->setRules([
+        '@PSR2' => true,
+        'ordered_imports' => true,
+        'phpdoc_order' => true,
+        'array_syntax' => [ 'syntax' => 'short' ],
+        'strict_comparison' => true,
+        'strict_param' => true,
+        'no_trailing_whitespace' => false,
+        'no_trailing_whitespace_in_comment' => false,
+        'braces' => false,
+        'single_blank_line_at_eof' => false,
+        'blank_line_after_namespace' => false,
+    ])
+    ->setFinder(
+        PhpCsFixer\Finder::create()
+        ->exclude('test')
+        ->exclude('tests')
+        ->in(__DIR__)
     );
diff --git a/modules/openapi-generator/src/main/resources/php/ObjectSerializer.mustache b/modules/openapi-generator/src/main/resources/php/ObjectSerializer.mustache
index 3b526da5fec..a51b202861e 100644
--- a/modules/openapi-generator/src/main/resources/php/ObjectSerializer.mustache
+++ b/modules/openapi-generator/src/main/resources/php/ObjectSerializer.mustache
@@ -58,7 +58,7 @@ class ObjectSerializer
                 if ($value !== null
                     && !in_array($openAPIType, [{{&primitives}}], true)
                     && method_exists($openAPIType, 'getAllowableEnumValues')
-                    && !in_array($value, $openAPIType::getAllowableEnumValues())) {
+                    && !in_array($value, $openAPIType::getAllowableEnumValues(), true)) {
                     $imploded = implode("', '", $openAPIType::getAllowableEnumValues());
                     throw new \InvalidArgumentException("Invalid value for enum '$openAPIType', must be one of: '$imploded'");
                 }
@@ -274,7 +274,7 @@ class ObjectSerializer
 
             return new \SplFileObject($filename, 'r');
         } elseif (method_exists($class, 'getAllowableEnumValues')) {
-            if (!in_array($data, $class::getAllowableEnumValues())) {
+            if (!in_array($data, $class::getAllowableEnumValues(), true)) {
                 $imploded = implode("', '", $class::getAllowableEnumValues());
                 throw new \InvalidArgumentException("Invalid value for enum '$class', must be one of: '$imploded'");
             }
diff --git a/modules/openapi-generator/src/main/resources/php/composer.mustache b/modules/openapi-generator/src/main/resources/php/composer.mustache
index 8d9b8f4674d..308241e0a00 100644
--- a/modules/openapi-generator/src/main/resources/php/composer.mustache
+++ b/modules/openapi-generator/src/main/resources/php/composer.mustache
@@ -30,7 +30,7 @@
     "require-dev": {
         "phpunit/phpunit": "^4.8",
         "squizlabs/php_codesniffer": "~2.6",
-        "friendsofphp/php-cs-fixer": "~1.12"
+        "friendsofphp/php-cs-fixer": "~2.12"
     },
     "autoload": {
         "psr-4": { "{{escapedInvokerPackage}}\\" : "{{srcBasePath}}/" }
diff --git a/modules/openapi-generator/src/main/resources/php/model_generic.mustache b/modules/openapi-generator/src/main/resources/php/model_generic.mustache
index 57f557e75a0..85610c2f572 100644
--- a/modules/openapi-generator/src/main/resources/php/model_generic.mustache
+++ b/modules/openapi-generator/src/main/resources/php/model_generic.mustache
@@ -166,7 +166,7 @@ class {{classname}} {{#parentSchema}}extends {{{parent}}} {{/parentSchema}}{{^pa
         {{#discriminator}}
 
         // Initialize discriminator property with the model name.
-        $discriminator = array_search('{{discriminatorName}}', self::$attributeMap);
+        $discriminator = array_search('{{discriminatorName}}', self::$attributeMap, true);
         $this->container[$discriminator] = static::$openAPIModelName;
         {{/discriminator}}
     }
diff --git a/samples/client/petstore-security-test/php/.openapi-generator/VERSION b/samples/client/petstore-security-test/php/.openapi-generator/VERSION
index dde25ef08e8..14900cee60e 100644
--- a/samples/client/petstore-security-test/php/.openapi-generator/VERSION
+++ b/samples/client/petstore-security-test/php/.openapi-generator/VERSION
@@ -1 +1 @@
-3.1.1-SNAPSHOT
\ No newline at end of file
+3.2.1-SNAPSHOT
\ No newline at end of file
diff --git a/samples/client/petstore-security-test/php/.php_cs b/samples/client/petstore-security-test/php/.php_cs
new file mode 100644
index 00000000000..4fbe53ec5ff
--- /dev/null
+++ b/samples/client/petstore-security-test/php/.php_cs
@@ -0,0 +1,23 @@
+<?php
+
+return PhpCsFixer\Config::create()
+    ->setUsingCache(true)
+    ->setRules([
+        '@PSR2' => true,
+        'ordered_imports' => true,
+        'phpdoc_order' => true,
+        'array_syntax' => [ 'syntax' => 'short' ],
+        'strict_comparison' => true,
+        'strict_param' => true,
+        'no_trailing_whitespace' => false,
+        'no_trailing_whitespace_in_comment' => false,
+        'braces' => false,
+        'single_blank_line_at_eof' => false,
+        'blank_line_after_namespace' => false,
+    ])
+    ->setFinder(
+        PhpCsFixer\Finder::create()
+        ->exclude('test')
+        ->exclude('tests')
+        ->in(__DIR__)
+    );
diff --git a/samples/client/petstore-security-test/php/.travis.yml b/samples/client/petstore-security-test/php/.travis.yml
new file mode 100644
index 00000000000..d77f3825f6f
--- /dev/null
+++ b/samples/client/petstore-security-test/php/.travis.yml
@@ -0,0 +1,10 @@
+language: php
+sudo: false
+php:
+    - 5.4
+    - 5.5
+    - 5.6
+    - 7.0
+    - hhvm
+before_install: "composer install"
+script: "vendor/bin/phpunit"
diff --git a/samples/client/petstore-security-test/php/README.md b/samples/client/petstore-security-test/php/README.md
new file mode 100644
index 00000000000..72e324853a6
--- /dev/null
+++ b/samples/client/petstore-security-test/php/README.md
@@ -0,0 +1,112 @@
+# OpenAPIClient-php
+This spec is mainly for testing Petstore server and contains fake endpoints, models. Please do not use this for any other purpose. Special characters: \" \\  *_/ ' \" =end --
+
+This PHP package is automatically generated by the [OpenAPI Generator](https://openapi-generator.tech) project:
+
+- API version: 1.0.0 *_/ &#39; \&quot; &#x3D;end -- \\r\\n \\n \\r
+- Build package: org.openapitools.codegen.languages.PhpClientCodegen
+
+## Requirements
+
+PHP 5.5 and later
+
+## Installation & Usage
+### Composer
+
+To install the bindings via [Composer](http://getcomposer.org/), add the following to `composer.json`:
+
+```
+{
+  "repositories": [
+    {
+      "type": "git",
+      "url": "https://github.com/GIT_USER_ID/GIT_REPO_ID.git"
+    }
+  ],
+  "require": {
+    "GIT_USER_ID/GIT_REPO_ID": "*@dev"
+  }
+}
+```
+
+Then run `composer install`
+
+### Manual Installation
+
+Download the files and include `autoload.php`:
+
+```php
+    require_once('/path/to/OpenAPIClient-php/vendor/autoload.php');
+```
+
+## Tests
+
+To run the unit tests:
+
+```
+composer install
+./vendor/bin/phpunit
+```
+
+## Getting Started
+
+Please follow the [installation procedure](#installation--usage) and then run the following:
+
+```php
+<?php
+require_once(__DIR__ . '/vendor/autoload.php');
+
+$apiInstance = new OpenAPI\Client\Api\FakeApi(
+    // If you want use custom http client, pass your client which implements `GuzzleHttp\ClientInterface`.
+    // This is optional, `GuzzleHttp\Client` will be used as default.
+    new GuzzleHttp\Client()
+);
+$unknown_base_type = new \OpenAPI\Client\Model\UNKNOWN_BASE_TYPE(); // \OpenAPI\Client\Model\UNKNOWN_BASE_TYPE | 
+
+try {
+    $apiInstance->testCodeInjectEndRnNR($unknown_base_type);
+} catch (Exception $e) {
+    echo 'Exception when calling FakeApi->testCodeInjectEndRnNR: ', $e->getMessage(), PHP_EOL;
+}
+
+?>
+```
+
+## Documentation for API Endpoints
+
+All URIs are relative to *http://petstore.swagger.io *_/ &#39; \&quot; &#x3D;end -- \\r\\n \\n \\r/v2 *_/ &#39; \&quot; &#x3D;end -- \\r\\n \\n \\r*
+
+Class | Method | HTTP request | Description
+------------ | ------------- | ------------- | -------------
+*FakeApi* | [**testCodeInjectEndRnNR**](docs/Api/FakeApi.md#testcodeinjectendrnnr) | **PUT** /fake | To test code injection *_/ &#39; \&quot; &#x3D;end -- \\r\\n \\n \\r
+
+
+## Documentation For Models
+
+ - [ModelReturn](docs/Model/ModelReturn.md)
+
+
+## Documentation For Authorization
+
+
+## api_key
+
+- **Type**: API key
+- **API key parameter name**: api_key  */ ' " =end -- \r\n \n \r
+- **Location**: HTTP header
+
+## petstore_auth
+
+- **Type**: OAuth
+- **Flow**: implicit
+- **Authorization URL**: http://petstore.swagger.io/api/oauth/dialog
+- **Scopes**: 
+ - **write:pets**: modify pets in your account  *_/ ' \" =end -- \\r\\n \\n \\r
+ - **read:pets**: read your pets  *_/ ' \" =end -- \\r\\n \\n \\r
+
+
+## Author
+
+something@something.abc *_/ &#39; \&quot; &#x3D;end -- \\r\\n \\n \\r
+
+
diff --git a/samples/client/petstore-security-test/php/composer.json b/samples/client/petstore-security-test/php/composer.json
new file mode 100644
index 00000000000..834ab01d201
--- /dev/null
+++ b/samples/client/petstore-security-test/php/composer.json
@@ -0,0 +1,38 @@
+{
+    "name": "GIT_USER_ID/GIT_REPO_ID",
+    "description": "",
+    "keywords": [
+        "openapitools",
+        "openapi-generator",
+        "php",
+        "sdk",
+        "rest",
+        "api"
+    ],
+    "homepage": "http://openapi-generator.tech",
+    "license": "proprietary",
+    "authors": [
+        {
+            "name": "OpenAPI-Generator contributors",
+            "homepage": "https://openapi-generator.tech"
+        }
+    ],
+    "require": {
+        "php": ">=5.5",
+        "ext-curl": "*",
+        "ext-json": "*",
+        "ext-mbstring": "*",
+        "guzzlehttp/guzzle": "^6.2"
+    },
+    "require-dev": {
+        "phpunit/phpunit": "^4.8",
+        "squizlabs/php_codesniffer": "~2.6",
+        "friendsofphp/php-cs-fixer": "~2.12"
+    },
+    "autoload": {
+        "psr-4": { "OpenAPI\\Client\\" : "lib/" }
+    },
+    "autoload-dev": {
+        "psr-4": { "OpenAPI\\Client\\" : "test/" }
+    }
+}
diff --git a/samples/client/petstore-security-test/php/docs/Api/FakeApi.md b/samples/client/petstore-security-test/php/docs/Api/FakeApi.md
new file mode 100644
index 00000000000..afee7db1162
--- /dev/null
+++ b/samples/client/petstore-security-test/php/docs/Api/FakeApi.md
@@ -0,0 +1,57 @@
+# OpenAPI\Client\FakeApi
+
+All URIs are relative to *http://petstore.swagger.io *_/ &#39; \&quot; &#x3D;end -- \\r\\n \\n \\r/v2 *_/ &#39; \&quot; &#x3D;end -- \\r\\n \\n \\r*
+
+Method | HTTP request | Description
+------------- | ------------- | -------------
+[**testCodeInjectEndRnNR**](FakeApi.md#testCodeInjectEndRnNR) | **PUT** /fake | To test code injection *_/ &#39; \&quot; &#x3D;end -- \\r\\n \\n \\r
+
+
+# **testCodeInjectEndRnNR**
+> testCodeInjectEndRnNR($unknown_base_type)
+
+To test code injection *_/ ' \" =end -- \\r\\n \\n \\r
+
+To test code injection *_/ ' \" =end -- \\r\\n \\n \\r
+
+### Example
+```php
+<?php
+require_once(__DIR__ . '/vendor/autoload.php');
+
+$apiInstance = new OpenAPI\Client\Api\FakeApi(
+    // If you want use custom http client, pass your client which implements `GuzzleHttp\ClientInterface`.
+    // This is optional, `GuzzleHttp\Client` will be used as default.
+    new GuzzleHttp\Client()
+);
+$unknown_base_type = new \OpenAPI\Client\Model\UNKNOWN_BASE_TYPE(); // \OpenAPI\Client\Model\UNKNOWN_BASE_TYPE | 
+
+try {
+    $apiInstance->testCodeInjectEndRnNR($unknown_base_type);
+} catch (Exception $e) {
+    echo 'Exception when calling FakeApi->testCodeInjectEndRnNR: ', $e->getMessage(), PHP_EOL;
+}
+?>
+```
+
+### Parameters
+
+Name | Type | Description  | Notes
+------------- | ------------- | ------------- | -------------
+ **unknown_base_type** | [**\OpenAPI\Client\Model\UNKNOWN_BASE_TYPE**](../Model/UNKNOWN_BASE_TYPE.md)|  | [optional]
+
+### Return type
+
+void (empty response body)
+
+### Authorization
+
+No authorization required
+
+### HTTP request headers
+
+ - **Content-Type**: application/json, *_/  \" =end --
+ - **Accept**: Not defined
+
+[[Back to top]](#) [[Back to API list]](../../README.md#documentation-for-api-endpoints) [[Back to Model list]](../../README.md#documentation-for-models) [[Back to README]](../../README.md)
+
diff --git a/samples/client/petstore-security-test/php/docs/Model/ModelReturn.md b/samples/client/petstore-security-test/php/docs/Model/ModelReturn.md
new file mode 100644
index 00000000000..efd25fe6d22
--- /dev/null
+++ b/samples/client/petstore-security-test/php/docs/Model/ModelReturn.md
@@ -0,0 +1,10 @@
+# ModelReturn
+
+## Properties
+Name | Type | Description | Notes
+------------ | ------------- | ------------- | -------------
+**return** | **int** | property description  *_/ &#39; \&quot; &#x3D;end -- \\r\\n \\n \\r | [optional] 
+
+[[Back to Model list]](../README.md#documentation-for-models) [[Back to API list]](../README.md#documentation-for-api-endpoints) [[Back to README]](../README.md)
+
+
diff --git a/samples/client/petstore-security-test/php/git_push.sh b/samples/client/petstore-security-test/php/git_push.sh
new file mode 100644
index 00000000000..20057f67ade
--- /dev/null
+++ b/samples/client/petstore-security-test/php/git_push.sh
@@ -0,0 +1,52 @@
+#!/bin/sh
+# ref: https://help.github.com/articles/adding-an-existing-project-to-github-using-the-command-line/
+#
+# Usage example: /bin/sh ./git_push.sh wing328 openapi-pestore-perl "minor update"
+
+git_user_id=$1
+git_repo_id=$2
+release_note=$3
+
+if [ "$git_user_id" = "" ]; then
+    git_user_id="GIT_USER_ID"
+    echo "[INFO] No command line input provided. Set \$git_user_id to $git_user_id"
+fi
+
+if [ "$git_repo_id" = "" ]; then
+    git_repo_id="GIT_REPO_ID"
+    echo "[INFO] No command line input provided. Set \$git_repo_id to $git_repo_id"
+fi
+
+if [ "$release_note" = "" ]; then
+    release_note="Minor update"
+    echo "[INFO] No command line input provided. Set \$release_note to $release_note"
+fi
+
+# Initialize the local directory as a Git repository
+git init
+
+# Adds the files in the local repository and stages them for commit.
+git add .
+
+# Commits the tracked changes and prepares them to be pushed to a remote repository.
+git commit -m "$release_note"
+
+# Sets the new remote
+git_remote=`git remote`
+if [ "$git_remote" = "" ]; then # git remote not defined
+
+    if [ "$GIT_TOKEN" = "" ]; then
+        echo "[INFO] \$GIT_TOKEN (environment variable) is not set. Using the git credential in your environment."
+        git remote add origin https://github.com/${git_user_id}/${git_repo_id}.git
+    else
+        git remote add origin https://${git_user_id}:${GIT_TOKEN}@github.com/${git_user_id}/${git_repo_id}.git
+    fi
+
+fi
+
+git pull origin master
+
+# Pushes (Forces) the changes in the local repository up to the remote repository
+echo "Git pushing to https://github.com/${git_user_id}/${git_repo_id}.git"
+git push origin master 2>&1 | grep -v 'To https'
+
diff --git a/samples/client/petstore-security-test/php/lib/Api/FakeApi.php b/samples/client/petstore-security-test/php/lib/Api/FakeApi.php
new file mode 100644
index 00000000000..9908f6d7075
--- /dev/null
+++ b/samples/client/petstore-security-test/php/lib/Api/FakeApi.php
@@ -0,0 +1,321 @@
+<?php
+/**
+ * FakeApi
+ * PHP version 5
+ *
+ * @category Class
+ * @package  OpenAPI\Client
+ * @author   OpenAPI Generator team
+ * @link     https://openapi-generator.tech
+ */
+
+/**
+ * OpenAPI Petstore *_/ ' \" =end -- \\r\\n \\n \\r
+ *
+ * This spec is mainly for testing Petstore server and contains fake endpoints, models. Please do not use this for any other purpose. Special characters: \" \\  *_/ ' \" =end --
+ *
+ * OpenAPI spec version: 1.0.0 *_/ ' \" =end -- \\r\\n \\n \\r
+ * Contact: something@something.abc *_/ ' \" =end -- \\r\\n \\n \\r
+ * Generated by: https://openapi-generator.tech
+ * OpenAPI Generator version: 3.2.1-SNAPSHOT
+ */
+
+/**
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+namespace OpenAPI\Client\Api;
+
+use GuzzleHttp\Client;
+use GuzzleHttp\ClientInterface;
+use GuzzleHttp\Exception\RequestException;
+use GuzzleHttp\Psr7\MultipartStream;
+use GuzzleHttp\Psr7\Request;
+use GuzzleHttp\RequestOptions;
+use OpenAPI\Client\ApiException;
+use OpenAPI\Client\Configuration;
+use OpenAPI\Client\HeaderSelector;
+use OpenAPI\Client\ObjectSerializer;
+
+/**
+ * FakeApi Class Doc Comment
+ *
+ * @category Class
+ * @package  OpenAPI\Client
+ * @author   OpenAPI Generator team
+ * @link     https://openapi-generator.tech
+ */
+class FakeApi
+{
+    /**
+     * @var ClientInterface
+     */
+    protected $client;
+
+    /**
+     * @var Configuration
+     */
+    protected $config;
+
+    /**
+     * @var HeaderSelector
+     */
+    protected $headerSelector;
+
+    /**
+     * @param ClientInterface $client
+     * @param Configuration   $config
+     * @param HeaderSelector  $selector
+     */
+    public function __construct(
+        ClientInterface $client = null,
+        Configuration $config = null,
+        HeaderSelector $selector = null
+    ) {
+        $this->client = $client ?: new Client();
+        $this->config = $config ?: new Configuration();
+        $this->headerSelector = $selector ?: new HeaderSelector();
+    }
+
+    /**
+     * @return Configuration
+     */
+    public function getConfig()
+    {
+        return $this->config;
+    }
+
+    /**
+     * Operation testCodeInjectEndRnNR
+     *
+     * To test code injection *_/ ' \" =end -- \\r\\n \\n \\r
+     *
+     * @param  \OpenAPI\Client\Model\UNKNOWN_BASE_TYPE $unknown_base_type unknown_base_type (optional)
+     *
+     * @throws \OpenAPI\Client\ApiException on non-2xx response
+     * @throws \InvalidArgumentException
+     * @return void
+     */
+    public function testCodeInjectEndRnNR($unknown_base_type = null)
+    {
+        $this->testCodeInjectEndRnNRWithHttpInfo($unknown_base_type);
+    }
+
+    /**
+     * Operation testCodeInjectEndRnNRWithHttpInfo
+     *
+     * To test code injection *_/ ' \" =end -- \\r\\n \\n \\r
+     *
+     * @param  \OpenAPI\Client\Model\UNKNOWN_BASE_TYPE $unknown_base_type (optional)
+     *
+     * @throws \OpenAPI\Client\ApiException on non-2xx response
+     * @throws \InvalidArgumentException
+     * @return array of null, HTTP status code, HTTP response headers (array of strings)
+     */
+    public function testCodeInjectEndRnNRWithHttpInfo($unknown_base_type = null)
+    {
+        $request = $this->testCodeInjectEndRnNRRequest($unknown_base_type);
+
+        try {
+            $options = $this->createHttpClientOption();
+            try {
+                $response = $this->client->send($request, $options);
+            } catch (RequestException $e) {
+                throw new ApiException(
+                    "[{$e->getCode()}] {$e->getMessage()}",
+                    $e->getCode(),
+                    $e->getResponse() ? $e->getResponse()->getHeaders() : null,
+                    $e->getResponse() ? $e->getResponse()->getBody()->getContents() : null
+                );
+            }
+
+            $statusCode = $response->getStatusCode();
+
+            if ($statusCode < 200 || $statusCode > 299) {
+                throw new ApiException(
+                    sprintf(
+                        '[%d] Error connecting to the API (%s)',
+                        $statusCode,
+                        $request->getUri()
+                    ),
+                    $statusCode,
+                    $response->getHeaders(),
+                    $response->getBody()
+                );
+            }
+
+            return [null, $statusCode, $response->getHeaders()];
+
+        } catch (ApiException $e) {
+            switch ($e->getCode()) {
+            }
+            throw $e;
+        }
+    }
+
+    /**
+     * Operation testCodeInjectEndRnNRAsync
+     *
+     * To test code injection *_/ ' \" =end -- \\r\\n \\n \\r
+     *
+     * @param  \OpenAPI\Client\Model\UNKNOWN_BASE_TYPE $unknown_base_type (optional)
+     *
+     * @throws \InvalidArgumentException
+     * @return \GuzzleHttp\Promise\PromiseInterface
+     */
+    public function testCodeInjectEndRnNRAsync($unknown_base_type = null)
+    {
+        return $this->testCodeInjectEndRnNRAsyncWithHttpInfo($unknown_base_type)
+            ->then(
+                function ($response) {
+                    return $response[0];
+                }
+            );
+    }
+
+    /**
+     * Operation testCodeInjectEndRnNRAsyncWithHttpInfo
+     *
+     * To test code injection *_/ ' \" =end -- \\r\\n \\n \\r
+     *
+     * @param  \OpenAPI\Client\Model\UNKNOWN_BASE_TYPE $unknown_base_type (optional)
+     *
+     * @throws \InvalidArgumentException
+     * @return \GuzzleHttp\Promise\PromiseInterface
+     */
+    public function testCodeInjectEndRnNRAsyncWithHttpInfo($unknown_base_type = null)
+    {
+        $returnType = '';
+        $request = $this->testCodeInjectEndRnNRRequest($unknown_base_type);
+
+        return $this->client
+            ->sendAsync($request, $this->createHttpClientOption())
+            ->then(
+                function ($response) use ($returnType) {
+                    return [null, $response->getStatusCode(), $response->getHeaders()];
+                },
+                function ($exception) {
+                    $response = $exception->getResponse();
+                    $statusCode = $response->getStatusCode();
+                    throw new ApiException(
+                        sprintf(
+                            '[%d] Error connecting to the API (%s)',
+                            $statusCode,
+                            $exception->getRequest()->getUri()
+                        ),
+                        $statusCode,
+                        $response->getHeaders(),
+                        $response->getBody()
+                    );
+                }
+            );
+    }
+
+    /**
+     * Create request for operation 'testCodeInjectEndRnNR'
+     *
+     * @param  \OpenAPI\Client\Model\UNKNOWN_BASE_TYPE $unknown_base_type (optional)
+     *
+     * @throws \InvalidArgumentException
+     * @return \GuzzleHttp\Psr7\Request
+     */
+    protected function testCodeInjectEndRnNRRequest($unknown_base_type = null)
+    {
+
+        $resourcePath = '/fake';
+        $formParams = [];
+        $queryParams = [];
+        $headerParams = [];
+        $httpBody = '';
+        $multipart = false;
+
+
+
+        // body params
+        $_tempBody = null;
+        if (isset($unknown_base_type)) {
+            $_tempBody = $unknown_base_type;
+        }
+
+        if ($multipart) {
+            $headers = $this->headerSelector->selectHeadersForMultipart(
+                []
+            );
+        } else {
+            $headers = $this->headerSelector->selectHeaders(
+                [],
+                ['application/json', '*_/  \" =end --']
+            );
+        }
+
+        // for model (json/xml)
+        if (isset($_tempBody)) {
+            // $_tempBody is the method argument, if present
+            $httpBody = $_tempBody;
+            // \stdClass has no __toString(), so we should encode it manually
+            if ($httpBody instanceof \stdClass && $headers['Content-Type'] === 'application/json') {
+                $httpBody = \GuzzleHttp\json_encode($httpBody);
+            }
+        } elseif (count($formParams) > 0) {
+            if ($multipart) {
+                $multipartContents = [];
+                foreach ($formParams as $formParamName => $formParamValue) {
+                    $multipartContents[] = [
+                        'name' => $formParamName,
+                        'contents' => $formParamValue
+                    ];
+                }
+                // for HTTP post (form)
+                $httpBody = new MultipartStream($multipartContents);
+
+            } elseif ($headers['Content-Type'] === 'application/json') {
+                $httpBody = \GuzzleHttp\json_encode($formParams);
+
+            } else {
+                // for HTTP post (form)
+                $httpBody = \GuzzleHttp\Psr7\build_query($formParams);
+            }
+        }
+
+
+        $defaultHeaders = [];
+        if ($this->config->getUserAgent()) {
+            $defaultHeaders['User-Agent'] = $this->config->getUserAgent();
+        }
+
+        $headers = array_merge(
+            $defaultHeaders,
+            $headerParams,
+            $headers
+        );
+
+        $query = \GuzzleHttp\Psr7\build_query($queryParams);
+        return new Request(
+            'PUT',
+            $this->config->getHost() . $resourcePath . ($query ? "?{$query}" : ''),
+            $headers,
+            $httpBody
+        );
+    }
+
+    /**
+     * Create http client option
+     *
+     * @throws \RuntimeException on file opening failure
+     * @return array of http client options
+     */
+    protected function createHttpClientOption()
+    {
+        $options = [];
+        if ($this->config->getDebug()) {
+            $options[RequestOptions::DEBUG] = fopen($this->config->getDebugFile(), 'a');
+            if (!$options[RequestOptions::DEBUG]) {
+                throw new \RuntimeException('Failed to open the debug file: ' . $this->config->getDebugFile());
+            }
+        }
+
+        return $options;
+    }
+}
diff --git a/samples/client/petstore-security-test/php/lib/ApiException.php b/samples/client/petstore-security-test/php/lib/ApiException.php
new file mode 100644
index 00000000000..06960702b35
--- /dev/null
+++ b/samples/client/petstore-security-test/php/lib/ApiException.php
@@ -0,0 +1,121 @@
+<?php
+/**
+ * ApiException
+ * PHP version 5
+ *
+ * @category Class
+ * @package  OpenAPI\Client
+ * @author   OpenAPI Generator team
+ * @link     https://openapi-generator.tech
+ */
+
+/**
+ * OpenAPI Petstore *_/ ' \" =end -- \\r\\n \\n \\r
+ *
+ * This spec is mainly for testing Petstore server and contains fake endpoints, models. Please do not use this for any other purpose. Special characters: \" \\  *_/ ' \" =end --
+ *
+ * OpenAPI spec version: 1.0.0 *_/ ' \" =end -- \\r\\n \\n \\r
+ * Contact: something@something.abc *_/ ' \" =end -- \\r\\n \\n \\r
+ * Generated by: https://openapi-generator.tech
+ * OpenAPI Generator version: 3.2.1-SNAPSHOT
+ */
+
+/**
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+namespace OpenAPI\Client;
+
+use \Exception;
+
+/**
+ * ApiException Class Doc Comment
+ *
+ * @category Class
+ * @package  OpenAPI\Client
+ * @author   OpenAPI Generator team
+ * @link     https://openapi-generator.tech
+ */
+class ApiException extends Exception
+{
+
+    /**
+     * The HTTP body of the server response either as Json or string.
+     *
+     * @var mixed
+     */
+    protected $responseBody;
+
+    /**
+     * The HTTP header of the server response.
+     *
+     * @var string[]|null
+     */
+    protected $responseHeaders;
+
+    /**
+     * The deserialized response object
+     *
+     * @var $responseObject;
+     */
+    protected $responseObject;
+
+    /**
+     * Constructor
+     *
+     * @param string        $message         Error message
+     * @param int           $code            HTTP status code
+     * @param string[]|null $responseHeaders HTTP response header
+     * @param mixed         $responseBody    HTTP decoded body of the server response either as \stdClass or string
+     */
+    public function __construct($message = "", $code = 0, $responseHeaders = [], $responseBody = null)
+    {
+        parent::__construct($message, $code);
+        $this->responseHeaders = $responseHeaders;
+        $this->responseBody = $responseBody;
+    }
+
+    /**
+     * Gets the HTTP response header
+     *
+     * @return string[]|null HTTP response header
+     */
+    public function getResponseHeaders()
+    {
+        return $this->responseHeaders;
+    }
+
+    /**
+     * Gets the HTTP body of the server response either as Json or string
+     *
+     * @return mixed HTTP body of the server response either as \stdClass or string
+     */
+    public function getResponseBody()
+    {
+        return $this->responseBody;
+    }
+
+    /**
+     * Sets the deseralized response object (during deserialization)
+     *
+     * @param mixed $obj Deserialized response object
+     *
+     * @return void
+     */
+    public function setResponseObject($obj)
+    {
+        $this->responseObject = $obj;
+    }
+
+    /**
+     * Gets the deseralized response object (during deserialization)
+     *
+     * @return mixed the deserialized response object
+     */
+    public function getResponseObject()
+    {
+        return $this->responseObject;
+    }
+}
diff --git a/samples/client/petstore-security-test/php/lib/Configuration.php b/samples/client/petstore-security-test/php/lib/Configuration.php
new file mode 100644
index 00000000000..1e2b013ccf0
--- /dev/null
+++ b/samples/client/petstore-security-test/php/lib/Configuration.php
@@ -0,0 +1,429 @@
+<?php
+/**
+ * Configuration
+ * PHP version 5
+ *
+ * @category Class
+ * @package  OpenAPI\Client
+ * @author   OpenAPI Generator team
+ * @link     https://openapi-generator.tech
+ */
+
+/**
+ * OpenAPI Petstore *_/ ' \" =end -- \\r\\n \\n \\r
+ *
+ * This spec is mainly for testing Petstore server and contains fake endpoints, models. Please do not use this for any other purpose. Special characters: \" \\  *_/ ' \" =end --
+ *
+ * OpenAPI spec version: 1.0.0 *_/ ' \" =end -- \\r\\n \\n \\r
+ * Contact: something@something.abc *_/ ' \" =end -- \\r\\n \\n \\r
+ * Generated by: https://openapi-generator.tech
+ * OpenAPI Generator version: 3.2.1-SNAPSHOT
+ */
+
+/**
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+namespace OpenAPI\Client;
+
+/**
+ * Configuration Class Doc Comment
+ * PHP version 5
+ *
+ * @category Class
+ * @package  OpenAPI\Client
+ * @author   OpenAPI Generator team
+ * @link     https://openapi-generator.tech
+ */
+class Configuration
+{
+    private static $defaultConfiguration;
+
+    /**
+     * Associate array to store API key(s)
+     *
+     * @var string[]
+     */
+    protected $apiKeys = [];
+
+    /**
+     * Associate array to store API prefix (e.g. Bearer)
+     *
+     * @var string[]
+     */
+    protected $apiKeyPrefixes = [];
+
+    /**
+     * Access token for OAuth
+     *
+     * @var string
+     */
+    protected $accessToken = '';
+
+    /**
+     * Username for HTTP basic authentication
+     *
+     * @var string
+     */
+    protected $username = '';
+
+    /**
+     * Password for HTTP basic authentication
+     *
+     * @var string
+     */
+    protected $password = '';
+
+    /**
+     * The host
+     *
+     * @var string
+     */
+    protected $host = 'http://petstore.swagger.io *_/ &#39; \&quot; &#x3D;end -- \\r\\n \\n \\r/v2 *_/ &#39; \&quot; &#x3D;end -- \\r\\n \\n \\r';
+
+    /**
+     * User agent of the HTTP request, set to "OpenAPI-Generator/{version}/PHP" by default
+     *
+     * @var string
+     */
+    protected $userAgent = 'OpenAPI-Generator/1.0.0/PHP';
+
+    /**
+     * Debug switch (default set to false)
+     *
+     * @var bool
+     */
+    protected $debug = false;
+
+    /**
+     * Debug file location (log to STDOUT by default)
+     *
+     * @var string
+     */
+    protected $debugFile = 'php://output';
+
+    /**
+     * Debug file location (log to STDOUT by default)
+     *
+     * @var string
+     */
+    protected $tempFolderPath;
+
+    /**
+     * Constructor
+     */
+    public function __construct()
+    {
+        $this->tempFolderPath = sys_get_temp_dir();
+    }
+
+    /**
+     * Sets API key
+     *
+     * @param string $apiKeyIdentifier API key identifier (authentication scheme)
+     * @param string $key              API key or token
+     *
+     * @return $this
+     */
+    public function setApiKey($apiKeyIdentifier, $key)
+    {
+        $this->apiKeys[$apiKeyIdentifier] = $key;
+        return $this;
+    }
+
+    /**
+     * Gets API key
+     *
+     * @param string $apiKeyIdentifier API key identifier (authentication scheme)
+     *
+     * @return string API key or token
+     */
+    public function getApiKey($apiKeyIdentifier)
+    {
+        return isset($this->apiKeys[$apiKeyIdentifier]) ? $this->apiKeys[$apiKeyIdentifier] : null;
+    }
+
+    /**
+     * Sets the prefix for API key (e.g. Bearer)
+     *
+     * @param string $apiKeyIdentifier API key identifier (authentication scheme)
+     * @param string $prefix           API key prefix, e.g. Bearer
+     *
+     * @return $this
+     */
+    public function setApiKeyPrefix($apiKeyIdentifier, $prefix)
+    {
+        $this->apiKeyPrefixes[$apiKeyIdentifier] = $prefix;
+        return $this;
+    }
+
+    /**
+     * Gets API key prefix
+     *
+     * @param string $apiKeyIdentifier API key identifier (authentication scheme)
+     *
+     * @return string
+     */
+    public function getApiKeyPrefix($apiKeyIdentifier)
+    {
+        return isset($this->apiKeyPrefixes[$apiKeyIdentifier]) ? $this->apiKeyPrefixes[$apiKeyIdentifier] : null;
+    }
+
+    /**
+     * Sets the access token for OAuth
+     *
+     * @param string $accessToken Token for OAuth
+     *
+     * @return $this
+     */
+    public function setAccessToken($accessToken)
+    {
+        $this->accessToken = $accessToken;
+        return $this;
+    }
+
+    /**
+     * Gets the access token for OAuth
+     *
+     * @return string Access token for OAuth
+     */
+    public function getAccessToken()
+    {
+        return $this->accessToken;
+    }
+
+    /**
+     * Sets the username for HTTP basic authentication
+     *
+     * @param string $username Username for HTTP basic authentication
+     *
+     * @return $this
+     */
+    public function setUsername($username)
+    {
+        $this->username = $username;
+        return $this;
+    }
+
+    /**
+     * Gets the username for HTTP basic authentication
+     *
+     * @return string Username for HTTP basic authentication
+     */
+    public function getUsername()
+    {
+        return $this->username;
+    }
+
+    /**
+     * Sets the password for HTTP basic authentication
+     *
+     * @param string $password Password for HTTP basic authentication
+     *
+     * @return $this
+     */
+    public function setPassword($password)
+    {
+        $this->password = $password;
+        return $this;
+    }
+
+    /**
+     * Gets the password for HTTP basic authentication
+     *
+     * @return string Password for HTTP basic authentication
+     */
+    public function getPassword()
+    {
+        return $this->password;
+    }
+
+    /**
+     * Sets the host
+     *
+     * @param string $host Host
+     *
+     * @return $this
+     */
+    public function setHost($host)
+    {
+        $this->host = $host;
+        return $this;
+    }
+
+    /**
+     * Gets the host
+     *
+     * @return string Host
+     */
+    public function getHost()
+    {
+        return $this->host;
+    }
+
+    /**
+     * Sets the user agent of the api client
+     *
+     * @param string $userAgent the user agent of the api client
+     *
+     * @throws \InvalidArgumentException
+     * @return $this
+     */
+    public function setUserAgent($userAgent)
+    {
+        if (!is_string($userAgent)) {
+            throw new \InvalidArgumentException('User-agent must be a string.');
+        }
+
+        $this->userAgent = $userAgent;
+        return $this;
+    }
+
+    /**
+     * Gets the user agent of the api client
+     *
+     * @return string user agent
+     */
+    public function getUserAgent()
+    {
+        return $this->userAgent;
+    }
+
+    /**
+     * Sets debug flag
+     *
+     * @param bool $debug Debug flag
+     *
+     * @return $this
+     */
+    public function setDebug($debug)
+    {
+        $this->debug = $debug;
+        return $this;
+    }
+
+    /**
+     * Gets the debug flag
+     *
+     * @return bool
+     */
+    public function getDebug()
+    {
+        return $this->debug;
+    }
+
+    /**
+     * Sets the debug file
+     *
+     * @param string $debugFile Debug file
+     *
+     * @return $this
+     */
+    public function setDebugFile($debugFile)
+    {
+        $this->debugFile = $debugFile;
+        return $this;
+    }
+
+    /**
+     * Gets the debug file
+     *
+     * @return string
+     */
+    public function getDebugFile()
+    {
+        return $this->debugFile;
+    }
+
+    /**
+     * Sets the temp folder path
+     *
+     * @param string $tempFolderPath Temp folder path
+     *
+     * @return $this
+     */
+    public function setTempFolderPath($tempFolderPath)
+    {
+        $this->tempFolderPath = $tempFolderPath;
+        return $this;
+    }
+
+    /**
+     * Gets the temp folder path
+     *
+     * @return string Temp folder path
+     */
+    public function getTempFolderPath()
+    {
+        return $this->tempFolderPath;
+    }
+
+    /**
+     * Gets the default configuration instance
+     *
+     * @return Configuration
+     */
+    public static function getDefaultConfiguration()
+    {
+        if (self::$defaultConfiguration === null) {
+            self::$defaultConfiguration = new Configuration();
+        }
+
+        return self::$defaultConfiguration;
+    }
+
+    /**
+     * Sets the detault configuration instance
+     *
+     * @param Configuration $config An instance of the Configuration Object
+     *
+     * @return void
+     */
+    public static function setDefaultConfiguration(Configuration $config)
+    {
+        self::$defaultConfiguration = $config;
+    }
+
+    /**
+     * Gets the essential information for debugging
+     *
+     * @return string The report for debugging
+     */
+    public static function toDebugReport()
+    {
+        $report  = 'PHP SDK (OpenAPI\Client) Debug Report:' . PHP_EOL;
+        $report .= '    OS: ' . php_uname() . PHP_EOL;
+        $report .= '    PHP Version: ' . PHP_VERSION . PHP_EOL;
+        $report .= '    OpenAPI Spec Version: 1.0.0 *_/ &#39; \&quot; &#x3D;end -- \\r\\n \\n \\r' . PHP_EOL;
+        $report .= '    Temp Folder Path: ' . self::getDefaultConfiguration()->getTempFolderPath() . PHP_EOL;
+
+        return $report;
+    }
+
+    /**
+     * Get API key (with prefix if set)
+     *
+     * @param  string $apiKeyIdentifier name of apikey
+     *
+     * @return string API key with the prefix
+     */
+    public function getApiKeyWithPrefix($apiKeyIdentifier)
+    {
+        $prefix = $this->getApiKeyPrefix($apiKeyIdentifier);
+        $apiKey = $this->getApiKey($apiKeyIdentifier);
+
+        if ($apiKey === null) {
+            return null;
+        }
+
+        if ($prefix === null) {
+            $keyWithPrefix = $apiKey;
+        } else {
+            $keyWithPrefix = $prefix . ' ' . $apiKey;
+        }
+
+        return $keyWithPrefix;
+    }
+}
diff --git a/samples/client/petstore-security-test/php/lib/HeaderSelector.php b/samples/client/petstore-security-test/php/lib/HeaderSelector.php
new file mode 100644
index 00000000000..fac0c0df7d8
--- /dev/null
+++ b/samples/client/petstore-security-test/php/lib/HeaderSelector.php
@@ -0,0 +1,110 @@
+<?php
+/**
+ * ApiException
+ * PHP version 5
+ *
+ * @category Class
+ * @package  OpenAPI\Client
+ * @author   OpenAPI Generator team
+ * @link     https://openapi-generator.tech
+ */
+
+/**
+ * OpenAPI Petstore *_/ ' \" =end -- \\r\\n \\n \\r
+ *
+ * This spec is mainly for testing Petstore server and contains fake endpoints, models. Please do not use this for any other purpose. Special characters: \" \\  *_/ ' \" =end --
+ *
+ * OpenAPI spec version: 1.0.0 *_/ ' \" =end -- \\r\\n \\n \\r
+ * Contact: something@something.abc *_/ ' \" =end -- \\r\\n \\n \\r
+ * Generated by: https://openapi-generator.tech
+ * OpenAPI Generator version: 3.2.1-SNAPSHOT
+ */
+
+/**
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+namespace OpenAPI\Client;
+
+use \Exception;
+
+/**
+ * ApiException Class Doc Comment
+ *
+ * @category Class
+ * @package  OpenAPI\Client
+ * @author   OpenAPI Generator team
+ * @link     https://openapi-generator.tech
+ */
+class HeaderSelector
+{
+
+    /**
+     * @param string[] $accept
+     * @param string[] $contentTypes
+     * @return array
+     */
+    public function selectHeaders($accept, $contentTypes)
+    {
+        $headers = [];
+
+        $accept = $this->selectAcceptHeader($accept);
+        if ($accept !== null) {
+            $headers['Accept'] = $accept;
+        }
+
+        $headers['Content-Type'] = $this->selectContentTypeHeader($contentTypes);
+        return $headers;
+    }
+
+    /**
+     * @param string[] $accept
+     * @return array
+     */
+    public function selectHeadersForMultipart($accept)
+    {
+        $headers = $this->selectHeaders($accept, []);
+
+        unset($headers['Content-Type']);
+        return $headers;
+    }
+
+    /**
+     * Return the header 'Accept' based on an array of Accept provided
+     *
+     * @param string[] $accept Array of header
+     *
+     * @return string Accept (e.g. application/json)
+     */
+    private function selectAcceptHeader($accept)
+    {
+        if (count($accept) === 0 || (count($accept) === 1 && $accept[0] === '')) {
+            return null;
+        } elseif (preg_grep("/application\/json/i", $accept)) {
+            return 'application/json';
+        } else {
+            return implode(',', $accept);
+        }
+    }
+
+    /**
+     * Return the content type based on an array of content-type provided
+     *
+     * @param string[] $contentType Array fo content-type
+     *
+     * @return string Content-Type (e.g. application/json)
+     */
+    private function selectContentTypeHeader($contentType)
+    {
+        if (count($contentType) === 0 || (count($contentType) === 1 && $contentType[0] === '')) {
+            return 'application/json';
+        } elseif (preg_grep("/application\/json/i", $contentType)) {
+            return 'application/json';
+        } else {
+            return implode(',', $contentType);
+        }
+    }
+}
+
diff --git a/samples/client/petstore-security-test/php/lib/Model/ModelInterface.php b/samples/client/petstore-security-test/php/lib/Model/ModelInterface.php
new file mode 100644
index 00000000000..b1bff06abb2
--- /dev/null
+++ b/samples/client/petstore-security-test/php/lib/Model/ModelInterface.php
@@ -0,0 +1,96 @@
+<?php
+/**
+ * ModelInterface
+ *
+ * PHP version 5
+ *
+ * @category Class
+ * @package  OpenAPI\Client\Model
+ * @author   OpenAPI Generator team
+ * @link     https://openapi-generator.tech
+ */
+
+/**
+ * OpenAPI Petstore *_/ ' \" =end -- \\r\\n \\n \\r
+ *
+ * This spec is mainly for testing Petstore server and contains fake endpoints, models. Please do not use this for any other purpose. Special characters: \" \\  *_/ ' \" =end --
+ *
+ * OpenAPI spec version: 1.0.0 *_/ ' \" =end -- \\r\\n \\n \\r
+ * Contact: something@something.abc *_/ ' \" =end -- \\r\\n \\n \\r
+ * Generated by: https://openapi-generator.tech
+ * OpenAPI Generator version: 3.2.1-SNAPSHOT
+ */
+
+/**
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+namespace OpenAPI\Client\Model;
+
+/**
+ * Interface abstracting model access.
+ *
+ * @package OpenAPI\Client\Model
+ * @author  OpenAPI Generator team
+ */
+interface ModelInterface
+{
+    /**
+     * The original name of the model.
+     *
+     * @return string
+     */
+    public function getModelName();
+
+    /**
+     * Array of property to type mappings. Used for (de)serialization
+     *
+     * @return array
+     */
+    public static function openAPITypes();
+
+    /**
+     * Array of property to format mappings. Used for (de)serialization
+     *
+     * @return array
+     */
+    public static function openAPIFormats();
+
+    /**
+     * Array of attributes where the key is the local name, and the value is the original name
+     *
+     * @return array
+     */
+    public static function attributeMap();
+
+    /**
+     * Array of attributes to setter functions (for deserialization of responses)
+     *
+     * @return array
+     */
+    public static function setters();
+
+    /**
+     * Array of attributes to getter functions (for serialization of requests)
+     *
+     * @return array
+     */
+    public static function getters();
+
+    /**
+     * Show all the invalid properties with reasons.
+     *
+     * @return array
+     */
+    public function listInvalidProperties();
+
+    /**
+     * Validate all the properties in the model
+     * return true if all passed
+     *
+     * @return bool
+     */
+    public function valid();
+}
diff --git a/samples/client/petstore-security-test/php/lib/Model/ModelReturn.php b/samples/client/petstore-security-test/php/lib/Model/ModelReturn.php
new file mode 100644
index 00000000000..bbf4b3f5ef9
--- /dev/null
+++ b/samples/client/petstore-security-test/php/lib/Model/ModelReturn.php
@@ -0,0 +1,298 @@
+<?php
+/**
+ * ModelReturn
+ *
+ * PHP version 5
+ *
+ * @category Class
+ * @package  OpenAPI\Client
+ * @author   OpenAPI Generator team
+ * @link     https://openapi-generator.tech
+ */
+
+/**
+ * OpenAPI Petstore *_/ ' \" =end -- \\r\\n \\n \\r
+ *
+ * This spec is mainly for testing Petstore server and contains fake endpoints, models. Please do not use this for any other purpose. Special characters: \" \\  *_/ ' \" =end --
+ *
+ * OpenAPI spec version: 1.0.0 *_/ ' \" =end -- \\r\\n \\n \\r
+ * Contact: something@something.abc *_/ ' \" =end -- \\r\\n \\n \\r
+ * Generated by: https://openapi-generator.tech
+ * OpenAPI Generator version: 3.2.1-SNAPSHOT
+ */
+
+/**
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+namespace OpenAPI\Client\Model;
+
+use \ArrayAccess;
+use \OpenAPI\Client\ObjectSerializer;
+
+/**
+ * ModelReturn Class Doc Comment
+ *
+ * @category Class
+ * @description Model for testing reserved words  *_/ &#39; \&quot; &#x3D;end -- \\r\\n \\n \\r
+ * @package  OpenAPI\Client
+ * @author   OpenAPI Generator team
+ * @link     https://openapi-generator.tech
+ */
+class ModelReturn implements ModelInterface, ArrayAccess
+{
+    const DISCRIMINATOR = null;
+
+    /**
+      * The original name of the model.
+      *
+      * @var string
+      */
+    protected static $openAPIModelName = 'Return';
+
+    /**
+      * Array of property to type mappings. Used for (de)serialization
+      *
+      * @var string[]
+      */
+    protected static $openAPITypes = [
+        'return' => 'int'
+    ];
+
+    /**
+      * Array of property to format mappings. Used for (de)serialization
+      *
+      * @var string[]
+      */
+    protected static $openAPIFormats = [
+        'return' => 'int32'
+    ];
+
+    /**
+     * Array of property to type mappings. Used for (de)serialization
+     *
+     * @return array
+     */
+    public static function openAPITypes()
+    {
+        return self::$openAPITypes;
+    }
+
+    /**
+     * Array of property to format mappings. Used for (de)serialization
+     *
+     * @return array
+     */
+    public static function openAPIFormats()
+    {
+        return self::$openAPIFormats;
+    }
+
+    /**
+     * Array of attributes where the key is the local name,
+     * and the value is the original name
+     *
+     * @var string[]
+     */
+    protected static $attributeMap = [
+        'return' => 'return'
+    ];
+
+    /**
+     * Array of attributes to setter functions (for deserialization of responses)
+     *
+     * @var string[]
+     */
+    protected static $setters = [
+        'return' => 'setReturn'
+    ];
+
+    /**
+     * Array of attributes to getter functions (for serialization of requests)
+     *
+     * @var string[]
+     */
+    protected static $getters = [
+        'return' => 'getReturn'
+    ];
+
+    /**
+     * Array of attributes where the key is the local name,
+     * and the value is the original name
+     *
+     * @return array
+     */
+    public static function attributeMap()
+    {
+        return self::$attributeMap;
+    }
+
+    /**
+     * Array of attributes to setter functions (for deserialization of responses)
+     *
+     * @return array
+     */
+    public static function setters()
+    {
+        return self::$setters;
+    }
+
+    /**
+     * Array of attributes to getter functions (for serialization of requests)
+     *
+     * @return array
+     */
+    public static function getters()
+    {
+        return self::$getters;
+    }
+
+    /**
+     * The original name of the model.
+     *
+     * @return string
+     */
+    public function getModelName()
+    {
+        return self::$openAPIModelName;
+    }
+
+    
+
+    
+
+    /**
+     * Associative array for storing property values
+     *
+     * @var mixed[]
+     */
+    protected $container = [];
+
+    /**
+     * Constructor
+     *
+     * @param mixed[] $data Associated array of property values
+     *                      initializing the model
+     */
+    public function __construct(array $data = null)
+    {
+        $this->container['return'] = isset($data['return']) ? $data['return'] : null;
+    }
+
+    /**
+     * Show all the invalid properties with reasons.
+     *
+     * @return array invalid properties with reasons
+     */
+    public function listInvalidProperties()
+    {
+        $invalidProperties = [];
+
+        return $invalidProperties;
+    }
+
+    /**
+     * Validate all the properties in the model
+     * return true if all passed
+     *
+     * @return bool True if all properties are valid
+     */
+    public function valid()
+    {
+        return count($this->listInvalidProperties()) === 0;
+    }
+
+
+    /**
+     * Gets return
+     *
+     * @return int|null
+     */
+    public function getReturn()
+    {
+        return $this->container['return'];
+    }
+
+    /**
+     * Sets return
+     *
+     * @param int|null $return property description  *_/ ' \" =end -- \\r\\n \\n \\r
+     *
+     * @return $this
+     */
+    public function setReturn($return)
+    {
+        $this->container['return'] = $return;
+
+        return $this;
+    }
+    /**
+     * Returns true if offset exists. False otherwise.
+     *
+     * @param integer $offset Offset
+     *
+     * @return boolean
+     */
+    public function offsetExists($offset)
+    {
+        return isset($this->container[$offset]);
+    }
+
+    /**
+     * Gets offset.
+     *
+     * @param integer $offset Offset
+     *
+     * @return mixed
+     */
+    public function offsetGet($offset)
+    {
+        return isset($this->container[$offset]) ? $this->container[$offset] : null;
+    }
+
+    /**
+     * Sets value based on offset.
+     *
+     * @param integer $offset Offset
+     * @param mixed   $value  Value to be set
+     *
+     * @return void
+     */
+    public function offsetSet($offset, $value)
+    {
+        if (is_null($offset)) {
+            $this->container[] = $value;
+        } else {
+            $this->container[$offset] = $value;
+        }
+    }
+
+    /**
+     * Unsets offset.
+     *
+     * @param integer $offset Offset
+     *
+     * @return void
+     */
+    public function offsetUnset($offset)
+    {
+        unset($this->container[$offset]);
+    }
+
+    /**
+     * Gets the string presentation of the object
+     *
+     * @return string
+     */
+    public function __toString()
+    {
+        return json_encode(
+            ObjectSerializer::sanitizeForSerialization($this),
+            JSON_PRETTY_PRINT
+        );
+    }
+}
+
+
diff --git a/samples/client/petstore-security-test/php/lib/ObjectSerializer.php b/samples/client/petstore-security-test/php/lib/ObjectSerializer.php
new file mode 100644
index 00000000000..4cc6b43e564
--- /dev/null
+++ b/samples/client/petstore-security-test/php/lib/ObjectSerializer.php
@@ -0,0 +1,317 @@
+<?php
+/**
+ * ObjectSerializer
+ *
+ * PHP version 5
+ *
+ * @category Class
+ * @package  OpenAPI\Client
+ * @author   OpenAPI Generator team
+ * @link     https://openapi-generator.tech
+ */
+
+/**
+ * OpenAPI Petstore *_/ ' \" =end -- \\r\\n \\n \\r
+ *
+ * This spec is mainly for testing Petstore server and contains fake endpoints, models. Please do not use this for any other purpose. Special characters: \" \\  *_/ ' \" =end --
+ *
+ * OpenAPI spec version: 1.0.0 *_/ ' \" =end -- \\r\\n \\n \\r
+ * Contact: something@something.abc *_/ ' \" =end -- \\r\\n \\n \\r
+ * Generated by: https://openapi-generator.tech
+ * OpenAPI Generator version: 3.2.1-SNAPSHOT
+ */
+
+/**
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+namespace OpenAPI\Client;
+
+/**
+ * ObjectSerializer Class Doc Comment
+ *
+ * @category Class
+ * @package  OpenAPI\Client
+ * @author   OpenAPI Generator team
+ * @link     https://openapi-generator.tech
+ */
+class ObjectSerializer
+{
+    /**
+     * Serialize data
+     *
+     * @param mixed  $data   the data to serialize
+     * @param string $type   the OpenAPIToolsType of the data
+     * @param string $format the format of the OpenAPITools type of the data
+     *
+     * @return string|object serialized form of $data
+     */
+    public static function sanitizeForSerialization($data, $type = null, $format = null)
+    {
+        if (is_scalar($data) || null === $data) {
+            return $data;
+        } elseif ($data instanceof \DateTime) {
+            return ($format === 'date') ? $data->format('Y-m-d') : $data->format(\DateTime::ATOM);
+        } elseif (is_array($data)) {
+            foreach ($data as $property => $value) {
+                $data[$property] = self::sanitizeForSerialization($value);
+            }
+            return $data;
+        } elseif (is_object($data)) {
+            $values = [];
+            $formats = $data::openAPIFormats();
+            foreach ($data::openAPITypes() as $property => $openAPIType) {
+                $getter = $data::getters()[$property];
+                $value = $data->$getter();
+                if ($value !== null
+                    && !in_array($openAPIType, ['DateTime', 'bool', 'boolean', 'byte', 'double', 'float', 'int', 'integer', 'mixed', 'number', 'object', 'string', 'void'], true)
+                    && method_exists($openAPIType, 'getAllowableEnumValues')
+                    && !in_array($value, $openAPIType::getAllowableEnumValues(), true)) {
+                    $imploded = implode("', '", $openAPIType::getAllowableEnumValues());
+                    throw new \InvalidArgumentException("Invalid value for enum '$openAPIType', must be one of: '$imploded'");
+                }
+                if ($value !== null) {
+                    $values[$data::attributeMap()[$property]] = self::sanitizeForSerialization($value, $openAPIType, $formats[$property]);
+                }
+            }
+            return (object)$values;
+        } else {
+            return (string)$data;
+        }
+    }
+
+    /**
+     * Sanitize filename by removing path.
+     * e.g. ../../sun.gif becomes sun.gif
+     *
+     * @param string $filename filename to be sanitized
+     *
+     * @return string the sanitized filename
+     */
+    public static function sanitizeFilename($filename)
+    {
+        if (preg_match("/.*[\/\\\\](.*)$/", $filename, $match)) {
+            return $match[1];
+        } else {
+            return $filename;
+        }
+    }
+
+    /**
+     * Take value and turn it into a string suitable for inclusion in
+     * the path, by url-encoding.
+     *
+     * @param string $value a string which will be part of the path
+     *
+     * @return string the serialized object
+     */
+    public static function toPathValue($value)
+    {
+        return rawurlencode(self::toString($value));
+    }
+
+    /**
+     * Take value and turn it into a string suitable for inclusion in
+     * the query, by imploding comma-separated if it's an object.
+     * If it's a string, pass through unchanged. It will be url-encoded
+     * later.
+     *
+     * @param string[]|string|\DateTime $object an object to be serialized to a string
+     *
+     * @return string the serialized object
+     */
+    public static function toQueryValue($object)
+    {
+        if (is_array($object)) {
+            return implode(',', $object);
+        } else {
+            return self::toString($object);
+        }
+    }
+
+    /**
+     * Take value and turn it into a string suitable for inclusion in
+     * the header. If it's a string, pass through unchanged
+     * If it's a datetime object, format it in ISO8601
+     *
+     * @param string $value a string which will be part of the header
+     *
+     * @return string the header string
+     */
+    public static function toHeaderValue($value)
+    {
+        return self::toString($value);
+    }
+
+    /**
+     * Take value and turn it into a string suitable for inclusion in
+     * the http body (form parameter). If it's a string, pass through unchanged
+     * If it's a datetime object, format it in ISO8601
+     *
+     * @param string|\SplFileObject $value the value of the form parameter
+     *
+     * @return string the form string
+     */
+    public static function toFormValue($value)
+    {
+        if ($value instanceof \SplFileObject) {
+            return $value->getRealPath();
+        } else {
+            return self::toString($value);
+        }
+    }
+
+    /**
+     * Take value and turn it into a string suitable for inclusion in
+     * the parameter. If it's a string, pass through unchanged
+     * If it's a datetime object, format it in ISO8601
+     *
+     * @param string|\DateTime $value the value of the parameter
+     *
+     * @return string the header string
+     */
+    public static function toString($value)
+    {
+        if ($value instanceof \DateTime) { // datetime in ISO8601 format
+            return $value->format(\DateTime::ATOM);
+        } else {
+            return $value;
+        }
+    }
+
+    /**
+     * Serialize an array to a string.
+     *
+     * @param array  $collection                 collection to serialize to a string
+     * @param string $collectionFormat           the format use for serialization (csv,
+     * ssv, tsv, pipes, multi)
+     * @param bool   $allowCollectionFormatMulti allow collection format to be a multidimensional array
+     *
+     * @return string
+     */
+    public static function serializeCollection(array $collection, $collectionFormat, $allowCollectionFormatMulti = false)
+    {
+        if ($allowCollectionFormatMulti && ('multi' === $collectionFormat)) {
+            // http_build_query() almost does the job for us. We just
+            // need to fix the result of multidimensional arrays.
+            return preg_replace('/%5B[0-9]+%5D=/', '=', http_build_query($collection, '', '&'));
+        }
+        switch ($collectionFormat) {
+            case 'pipes':
+                return implode('|', $collection);
+
+            case 'tsv':
+                return implode("\t", $collection);
+
+            case 'ssv':
+                return implode(' ', $collection);
+
+            case 'csv':
+                // Deliberate fall through. CSV is default format.
+            default:
+                return implode(',', $collection);
+        }
+    }
+
+    /**
+     * Deserialize a JSON string into an object
+     *
+     * @param mixed    $data          object or primitive to be deserialized
+     * @param string   $class         class name is passed as a string
+     * @param string[] $httpHeaders   HTTP headers
+     * @param string   $discriminator discriminator if polymorphism is used
+     *
+     * @return object|array|null a single or an array of $class instances
+     */
+    public static function deserialize($data, $class, $httpHeaders = null)
+    {
+        if (null === $data) {
+            return null;
+        } elseif (substr($class, 0, 4) === 'map[') { // for associative array e.g. map[string,int]
+            $inner = substr($class, 4, -1);
+            $deserialized = [];
+            if (strrpos($inner, ",") !== false) {
+                $subClass_array = explode(',', $inner, 2);
+                $subClass = $subClass_array[1];
+                foreach ($data as $key => $value) {
+                    $deserialized[$key] = self::deserialize($value, $subClass, null);
+                }
+            }
+            return $deserialized;
+        } elseif (strcasecmp(substr($class, -2), '[]') === 0) {
+            $subClass = substr($class, 0, -2);
+            $values = [];
+            foreach ($data as $key => $value) {
+                $values[] = self::deserialize($value, $subClass, null);
+            }
+            return $values;
+        } elseif ($class === 'object') {
+            settype($data, 'array');
+            return $data;
+        } elseif ($class === '\DateTime') {
+            // Some API's return an invalid, empty string as a
+            // date-time property. DateTime::__construct() will return
+            // the current time for empty input which is probably not
+            // what is meant. The invalid empty string is probably to
+            // be interpreted as a missing field/value. Let's handle
+            // this graceful.
+            if (!empty($data)) {
+                return new \DateTime($data);
+            } else {
+                return null;
+            }
+        } elseif (in_array($class, ['DateTime', 'bool', 'boolean', 'byte', 'double', 'float', 'int', 'integer', 'mixed', 'number', 'object', 'string', 'void'], true)) {
+            settype($data, $class);
+            return $data;
+        } elseif ($class === '\SplFileObject') {
+            /** @var \Psr\Http\Message\StreamInterface $data */
+
+            // determine file name
+            if (array_key_exists('Content-Disposition', $httpHeaders) &&
+                preg_match('/inline; filename=[\'"]?([^\'"\s]+)[\'"]?$/i', $httpHeaders['Content-Disposition'], $match)) {
+                $filename = Configuration::getDefaultConfiguration()->getTempFolderPath() . DIRECTORY_SEPARATOR . self::sanitizeFilename($match[1]);
+            } else {
+                $filename = tempnam(Configuration::getDefaultConfiguration()->getTempFolderPath(), '');
+            }
+
+            $file = fopen($filename, 'w');
+            while ($chunk = $data->read(200)) {
+                fwrite($file, $chunk);
+            }
+            fclose($file);
+
+            return new \SplFileObject($filename, 'r');
+        } elseif (method_exists($class, 'getAllowableEnumValues')) {
+            if (!in_array($data, $class::getAllowableEnumValues(), true)) {
+                $imploded = implode("', '", $class::getAllowableEnumValues());
+                throw new \InvalidArgumentException("Invalid value for enum '$class', must be one of: '$imploded'");
+            }
+            return $data;
+        } else {
+            // If a discriminator is defined and points to a valid subclass, use it.
+            $discriminator = $class::DISCRIMINATOR;
+            if (!empty($discriminator) && isset($data->{$discriminator}) && is_string($data->{$discriminator})) {
+                $subclass = '\OpenAPI\Client\Model\\' . $data->{$discriminator};
+                if (is_subclass_of($subclass, $class)) {
+                    $class = $subclass;
+                }
+            }
+            $instance = new $class();
+            foreach ($instance::openAPITypes() as $property => $type) {
+                $propertySetter = $instance::setters()[$property];
+
+                if (!isset($propertySetter) || !isset($data->{$instance::attributeMap()[$property]})) {
+                    continue;
+                }
+
+                $propertyValue = $data->{$instance::attributeMap()[$property]};
+                if (isset($propertyValue)) {
+                    $instance->$propertySetter(self::deserialize($propertyValue, $type, null));
+                }
+            }
+            return $instance;
+        }
+    }
+}
diff --git a/samples/client/petstore-security-test/php/phpunit.xml.dist b/samples/client/petstore-security-test/php/phpunit.xml.dist
new file mode 100644
index 00000000000..c12ee148477
--- /dev/null
+++ b/samples/client/petstore-security-test/php/phpunit.xml.dist
@@ -0,0 +1,21 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<phpunit bootstrap="./vendor/autoload.php"
+         colors="true"
+         convertErrorsToExceptions="true"
+         convertNoticesToExceptions="true"
+         convertWarningsToExceptions="true"
+         stopOnFailure="false">
+    <testsuites>
+        <testsuite>
+            <directory>./test/Api</directory>
+            <directory>./test/Model</directory>
+        </testsuite>
+    </testsuites>
+
+    <filter>
+        <whitelist processUncoveredFilesFromWhitelist="true">
+            <directory suffix=".php">./lib/Api</directory>
+            <directory suffix=".php">./lib/Model</directory>
+        </whitelist>
+    </filter>
+</phpunit>
diff --git a/samples/client/petstore-security-test/php/test/Api/FakeApiTest.php b/samples/client/petstore-security-test/php/test/Api/FakeApiTest.php
new file mode 100644
index 00000000000..07057cd8a7f
--- /dev/null
+++ b/samples/client/petstore-security-test/php/test/Api/FakeApiTest.php
@@ -0,0 +1,83 @@
+<?php
+/**
+ * FakeApiTest
+ * PHP version 5
+ *
+ * @category Class
+ * @package  OpenAPI\Client
+ * @author   OpenAPI Generator team
+ * @link     https://openapi-generator.tech
+ */
+
+/**
+ * OpenAPI Petstore *_/ ' \" =end -- \\r\\n \\n \\r
+ *
+ * This spec is mainly for testing Petstore server and contains fake endpoints, models. Please do not use this for any other purpose. Special characters: \" \\  *_/ ' \" =end --
+ *
+ * OpenAPI spec version: 1.0.0 *_/ ' \" =end -- \\r\\n \\n \\r
+ * Contact: something@something.abc *_/ ' \" =end -- \\r\\n \\n \\r
+ * Generated by: https://openapi-generator.tech
+ * OpenAPI Generator version: 3.2.1-SNAPSHOT
+ */
+
+/**
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Please update the test case below to test the endpoint.
+ */
+
+namespace OpenAPI\Client;
+
+use \OpenAPI\Client\Configuration;
+use \OpenAPI\Client\ApiException;
+use \OpenAPI\Client\ObjectSerializer;
+
+/**
+ * FakeApiTest Class Doc Comment
+ *
+ * @category Class
+ * @package  OpenAPI\Client
+ * @author   OpenAPI Generator team
+ * @link     https://openapi-generator.tech
+ */
+class FakeApiTest extends \PHPUnit_Framework_TestCase
+{
+
+    /**
+     * Setup before running any test cases
+     */
+    public static function setUpBeforeClass()
+    {
+    }
+
+    /**
+     * Setup before running each test case
+     */
+    public function setUp()
+    {
+    }
+
+    /**
+     * Clean up after running each test case
+     */
+    public function tearDown()
+    {
+    }
+
+    /**
+     * Clean up after running all test cases
+     */
+    public static function tearDownAfterClass()
+    {
+    }
+
+    /**
+     * Test case for testCodeInjectEndRnNR
+     *
+     * To test code injection *_/ ' \" =end -- \\r\\n \\n \\r.
+     *
+     */
+    public function testTestCodeInjectEndRnNR()
+    {
+    }
+}
diff --git a/samples/client/petstore-security-test/php/test/Model/ModelReturnTest.php b/samples/client/petstore-security-test/php/test/Model/ModelReturnTest.php
new file mode 100644
index 00000000000..e86b57428de
--- /dev/null
+++ b/samples/client/petstore-security-test/php/test/Model/ModelReturnTest.php
@@ -0,0 +1,85 @@
+<?php
+/**
+ * ModelReturnTest
+ *
+ * PHP version 5
+ *
+ * @category Class
+ * @package  OpenAPI\Client
+ * @author   OpenAPI Generator team
+ * @link     https://openapi-generator.tech
+ */
+
+/**
+ * OpenAPI Petstore *_/ ' \" =end -- \\r\\n \\n \\r
+ *
+ * This spec is mainly for testing Petstore server and contains fake endpoints, models. Please do not use this for any other purpose. Special characters: \" \\  *_/ ' \" =end --
+ *
+ * OpenAPI spec version: 1.0.0 *_/ ' \" =end -- \\r\\n \\n \\r
+ * Contact: something@something.abc *_/ ' \" =end -- \\r\\n \\n \\r
+ * Generated by: https://openapi-generator.tech
+ * OpenAPI Generator version: 3.2.1-SNAPSHOT
+ */
+
+/**
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Please update the test case below to test the model.
+ */
+
+namespace OpenAPI\Client;
+
+/**
+ * ModelReturnTest Class Doc Comment
+ *
+ * @category    Class
+ * @description Model for testing reserved words  *_/ &#39; \&quot; &#x3D;end -- \\r\\n \\n \\r
+ * @package     OpenAPI\Client
+ * @author      OpenAPI Generator team
+ * @link        https://openapi-generator.tech
+ */
+class ModelReturnTest extends \PHPUnit_Framework_TestCase
+{
+
+    /**
+     * Setup before running any test case
+     */
+    public static function setUpBeforeClass()
+    {
+    }
+
+    /**
+     * Setup before running each test case
+     */
+    public function setUp()
+    {
+    }
+
+    /**
+     * Clean up after running each test case
+     */
+    public function tearDown()
+    {
+    }
+
+    /**
+     * Clean up after running all test cases
+     */
+    public static function tearDownAfterClass()
+    {
+    }
+
+    /**
+     * Test "ModelReturn"
+     */
+    public function testModelReturn()
+    {
+    }
+
+    /**
+     * Test attribute "return"
+     */
+    public function testPropertyReturn()
+    {
+    }
+}
diff --git a/samples/client/petstore/php/OpenAPIClient-php/.php_cs b/samples/client/petstore/php/OpenAPIClient-php/.php_cs
index 6b8e23c818a..4fbe53ec5ff 100644
--- a/samples/client/petstore/php/OpenAPIClient-php/.php_cs
+++ b/samples/client/petstore/php/OpenAPIClient-php/.php_cs
@@ -1,18 +1,23 @@
 <?php
 
-return Symfony\CS\Config::create()
-    ->level(Symfony\CS\FixerInterface::PSR2_LEVEL)
+return PhpCsFixer\Config::create()
     ->setUsingCache(true)
-    ->fixers(
-        [
-            'ordered_use',
-            'phpdoc_order',
-            'short_array_syntax',
-            'strict',
-            'strict_param'
-        ]
-    )
-    ->finder(
-        Symfony\CS\Finder\DefaultFinder::create()
-            ->in(__DIR__)
+    ->setRules([
+        '@PSR2' => true,
+        'ordered_imports' => true,
+        'phpdoc_order' => true,
+        'array_syntax' => [ 'syntax' => 'short' ],
+        'strict_comparison' => true,
+        'strict_param' => true,
+        'no_trailing_whitespace' => false,
+        'no_trailing_whitespace_in_comment' => false,
+        'braces' => false,
+        'single_blank_line_at_eof' => false,
+        'blank_line_after_namespace' => false,
+    ])
+    ->setFinder(
+        PhpCsFixer\Finder::create()
+        ->exclude('test')
+        ->exclude('tests')
+        ->in(__DIR__)
     );
diff --git a/samples/client/petstore/php/OpenAPIClient-php/composer.json b/samples/client/petstore/php/OpenAPIClient-php/composer.json
index 65d3c935fb8..834ab01d201 100644
--- a/samples/client/petstore/php/OpenAPIClient-php/composer.json
+++ b/samples/client/petstore/php/OpenAPIClient-php/composer.json
@@ -27,7 +27,7 @@
     "require-dev": {
         "phpunit/phpunit": "^4.8",
         "squizlabs/php_codesniffer": "~2.6",
-        "friendsofphp/php-cs-fixer": "~1.12"
+        "friendsofphp/php-cs-fixer": "~2.12"
     },
     "autoload": {
         "psr-4": { "OpenAPI\\Client\\" : "lib/" }
diff --git a/samples/client/petstore/php/OpenAPIClient-php/lib/Model/Animal.php b/samples/client/petstore/php/OpenAPIClient-php/lib/Model/Animal.php
index e82b58735b2..9fb1b1f0dbd 100644
--- a/samples/client/petstore/php/OpenAPIClient-php/lib/Model/Animal.php
+++ b/samples/client/petstore/php/OpenAPIClient-php/lib/Model/Animal.php
@@ -186,7 +186,7 @@ class Animal implements ModelInterface, ArrayAccess
         $this->container['color'] = isset($data['color']) ? $data['color'] : 'red';
 
         // Initialize discriminator property with the model name.
-        $discriminator = array_search('className', self::$attributeMap);
+        $discriminator = array_search('className', self::$attributeMap, true);
         $this->container[$discriminator] = static::$openAPIModelName;
     }
 
diff --git a/samples/client/petstore/php/OpenAPIClient-php/lib/ObjectSerializer.php b/samples/client/petstore/php/OpenAPIClient-php/lib/ObjectSerializer.php
index 36d3d8fd425..52cd983335e 100644
--- a/samples/client/petstore/php/OpenAPIClient-php/lib/ObjectSerializer.php
+++ b/samples/client/petstore/php/OpenAPIClient-php/lib/ObjectSerializer.php
@@ -68,7 +68,7 @@ class ObjectSerializer
                 if ($value !== null
                     && !in_array($openAPIType, ['DateTime', 'bool', 'boolean', 'byte', 'double', 'float', 'int', 'integer', 'mixed', 'number', 'object', 'string', 'void'], true)
                     && method_exists($openAPIType, 'getAllowableEnumValues')
-                    && !in_array($value, $openAPIType::getAllowableEnumValues())) {
+                    && !in_array($value, $openAPIType::getAllowableEnumValues(), true)) {
                     $imploded = implode("', '", $openAPIType::getAllowableEnumValues());
                     throw new \InvalidArgumentException("Invalid value for enum '$openAPIType', must be one of: '$imploded'");
                 }
@@ -284,7 +284,7 @@ class ObjectSerializer
 
             return new \SplFileObject($filename, 'r');
         } elseif (method_exists($class, 'getAllowableEnumValues')) {
-            if (!in_array($data, $class::getAllowableEnumValues())) {
+            if (!in_array($data, $class::getAllowableEnumValues(), true)) {
                 $imploded = implode("', '", $class::getAllowableEnumValues());
                 throw new \InvalidArgumentException("Invalid value for enum '$class', must be one of: '$imploded'");
             }
diff --git a/samples/openapi3/client/petstore/php/OpenAPIClient-php/.php_cs b/samples/openapi3/client/petstore/php/OpenAPIClient-php/.php_cs
index 6b8e23c818a..4fbe53ec5ff 100644
--- a/samples/openapi3/client/petstore/php/OpenAPIClient-php/.php_cs
+++ b/samples/openapi3/client/petstore/php/OpenAPIClient-php/.php_cs
@@ -1,18 +1,23 @@
 <?php
 
-return Symfony\CS\Config::create()
-    ->level(Symfony\CS\FixerInterface::PSR2_LEVEL)
+return PhpCsFixer\Config::create()
     ->setUsingCache(true)
-    ->fixers(
-        [
-            'ordered_use',
-            'phpdoc_order',
-            'short_array_syntax',
-            'strict',
-            'strict_param'
-        ]
-    )
-    ->finder(
-        Symfony\CS\Finder\DefaultFinder::create()
-            ->in(__DIR__)
+    ->setRules([
+        '@PSR2' => true,
+        'ordered_imports' => true,
+        'phpdoc_order' => true,
+        'array_syntax' => [ 'syntax' => 'short' ],
+        'strict_comparison' => true,
+        'strict_param' => true,
+        'no_trailing_whitespace' => false,
+        'no_trailing_whitespace_in_comment' => false,
+        'braces' => false,
+        'single_blank_line_at_eof' => false,
+        'blank_line_after_namespace' => false,
+    ])
+    ->setFinder(
+        PhpCsFixer\Finder::create()
+        ->exclude('test')
+        ->exclude('tests')
+        ->in(__DIR__)
     );
diff --git a/samples/openapi3/client/petstore/php/OpenAPIClient-php/composer.json b/samples/openapi3/client/petstore/php/OpenAPIClient-php/composer.json
index 65d3c935fb8..834ab01d201 100644
--- a/samples/openapi3/client/petstore/php/OpenAPIClient-php/composer.json
+++ b/samples/openapi3/client/petstore/php/OpenAPIClient-php/composer.json
@@ -27,7 +27,7 @@
     "require-dev": {
         "phpunit/phpunit": "^4.8",
         "squizlabs/php_codesniffer": "~2.6",
-        "friendsofphp/php-cs-fixer": "~1.12"
+        "friendsofphp/php-cs-fixer": "~2.12"
     },
     "autoload": {
         "psr-4": { "OpenAPI\\Client\\" : "lib/" }
diff --git a/samples/openapi3/client/petstore/php/OpenAPIClient-php/lib/Model/Animal.php b/samples/openapi3/client/petstore/php/OpenAPIClient-php/lib/Model/Animal.php
index e82b58735b2..9fb1b1f0dbd 100644
--- a/samples/openapi3/client/petstore/php/OpenAPIClient-php/lib/Model/Animal.php
+++ b/samples/openapi3/client/petstore/php/OpenAPIClient-php/lib/Model/Animal.php
@@ -186,7 +186,7 @@ class Animal implements ModelInterface, ArrayAccess
         $this->container['color'] = isset($data['color']) ? $data['color'] : 'red';
 
         // Initialize discriminator property with the model name.
-        $discriminator = array_search('className', self::$attributeMap);
+        $discriminator = array_search('className', self::$attributeMap, true);
         $this->container[$discriminator] = static::$openAPIModelName;
     }
 
diff --git a/samples/openapi3/client/petstore/php/OpenAPIClient-php/lib/ObjectSerializer.php b/samples/openapi3/client/petstore/php/OpenAPIClient-php/lib/ObjectSerializer.php
index 36d3d8fd425..52cd983335e 100644
--- a/samples/openapi3/client/petstore/php/OpenAPIClient-php/lib/ObjectSerializer.php
+++ b/samples/openapi3/client/petstore/php/OpenAPIClient-php/lib/ObjectSerializer.php
@@ -68,7 +68,7 @@ class ObjectSerializer
                 if ($value !== null
                     && !in_array($openAPIType, ['DateTime', 'bool', 'boolean', 'byte', 'double', 'float', 'int', 'integer', 'mixed', 'number', 'object', 'string', 'void'], true)
                     && method_exists($openAPIType, 'getAllowableEnumValues')
-                    && !in_array($value, $openAPIType::getAllowableEnumValues())) {
+                    && !in_array($value, $openAPIType::getAllowableEnumValues(), true)) {
                     $imploded = implode("', '", $openAPIType::getAllowableEnumValues());
                     throw new \InvalidArgumentException("Invalid value for enum '$openAPIType', must be one of: '$imploded'");
                 }
@@ -284,7 +284,7 @@ class ObjectSerializer
 
             return new \SplFileObject($filename, 'r');
         } elseif (method_exists($class, 'getAllowableEnumValues')) {
-            if (!in_array($data, $class::getAllowableEnumValues())) {
+            if (!in_array($data, $class::getAllowableEnumValues(), true)) {
                 $imploded = implode("', '", $class::getAllowableEnumValues());
                 throw new \InvalidArgumentException("Invalid value for enum '$class', must be one of: '$imploded'");
             }