SonarSource Rules
  • Products

    In-IDE

    Code Quality and Security in your IDE with SonarQube Ide

    IDE extension that lets you fix coding issues before they exist!

    Discover SonarQube for IDE

    SaaS

    Code Quality and Security in the cloud with SonarQube Cloud

    Setup is effortless and analysis is automatic for most languages

    Discover SonarQube Cloud

    Self-Hosted

    Code Quality and Security Self-Hosted with SonarQube Server

    Fast, accurate analysis; enterprise scalability

    Discover SonarQube Server
  • SecretsSecrets
  • ABAPABAP
  • AnsibleAnsible
  • ApexApex
  • AzureResourceManagerAzureResourceManager
  • CC
  • C#C#
  • C++C++
  • CloudFormationCloudFormation
  • COBOLCOBOL
  • CSSCSS
  • DartDart
  • DockerDocker
  • FlexFlex
  • GitHub ActionsGitHub Actions
  • GoGo
  • HTMLHTML
  • JavaJava
  • JavaScriptJavaScript
  • JSONJSON
  • JCLJCL
  • KotlinKotlin
  • KubernetesKubernetes
  • Objective CObjective C
  • PHPPHP
  • PL/IPL/I
  • PL/SQLPL/SQL
  • PythonPython
  • RPGRPG
  • RubyRuby
  • RustRust
  • ScalaScala
  • ShellShell
  • SwiftSwift
  • TerraformTerraform
  • TextText
  • TypeScriptTypeScript
  • T-SQLT-SQL
  • VB.NETVB.NET
  • VB6VB6
  • XMLXML
  • YAMLYAML
HTML

HTML static code analysis

Unique rules to find Bugs, Security Hotspots, and Code Smells in your HTML code

  • All rules 83
  • Bug23
  • Security Hotspot3
  • Code Smell57
 
Tags
    Impact
      Clean code attribute
        1. Table cells should reference their headers

           Bug
        2. Tables used for layout should not include semantic markup

           Bug
        3. Tables should have headers

           Bug
        4. "<html>" element should have a language attribute

           Bug
        5. <script>...</script> elements should not be nested

           Bug
        6. Labels should be defined in the resource bundle

           Bug
        7. All HTML tags should be closed

           Bug
        8. JSF expressions should be syntactically valid

           Bug
        9. "<th>" tags should have "id" or "scope" attributes

           Bug
        10. "<strong>" and "<em>" tags should be used

           Bug
        11. Image tags should have "width" and "height" attributes

           Bug
        12. "input", "select" and "textarea" tags should be labeled

           Bug
        13. "<title>" should be present in all pages

           Bug
        14. "<!DOCTYPE>" declarations should appear before "<html>" tags

           Bug
        15. "<li>" and "<dt>" item tags should be in "<ul>", "<ol>" or "<dl>" container tags

           Bug
        16. Server-side image maps ("ismap" attribute) should not be used

           Bug
        17. "<frames>" should have a "title" attribute

           Bug
        18. "<fieldset>" tags should contain a "<legend>"

           Bug
        19. Flash animations should be embedded using the window mode

           Bug
        20. Flash animations should be embedded using both "<object>" and "<embed>"

           Bug
        21. "<table>" tags should have a description

           Bug
        22. Elements deprecated in HTML5 should not be used

           Bug
        23. Mouse events should have corresponding keyboard events

           Bug

        "input", "select" and "textarea" tags should be labeled

        Bug
        • accessibility
        • wcag2-a

        Why is this an issue?

        More Info

        The <label> tag defines a label for <input>, <select> and <textarea> elements.

        The <label> tag improves usability for visually impaired users: Screen readers will announce the label text whenever the focus is set on the input field.

        It also improves usability for users with impaired motor control: when the text within the <label> element is clicked, the associated input field is toggled.

        In most cases, for attribute of the <label> tag should be equal to the id attribute of the related element to bind them together.

        Sometimes the field is explained by an icon. In this case the label can be either hidden or the <input>, <select> or <textarea> tags should contain one of the following attributes: aria-label, aria-labelledby. Screen-readers will use those attributes to describe the field.

        The purpose of this rule is to make sure that every input (except submit, button, image, and hidden inputs), select, and textarea field has a label.

        Noncompliant code example

        <input type="text" name="firstname" />               <!-- Non-Compliant - no id -->
        
        <input type="text" name="lastname" id="lastname" />  <!-- Non-Compliant - no matching label for "lastname" -->
        
        <label for="address">Address</label>
        <input type="text" name="address" id="address" />    <!-- Compliant -->
        
        <input type="hidden" name="time" value="...">        <!-- Compliant - "hidden" type is excluded -->
        <input type="submit" value="Send" />                 <!-- Compliant - "submit" type is excluded -->
        

        Compliant solution

        <label for="firstname">First name</label>
        <input type="text" name="firstname" id="firstname" />
        
        <label for="lastname">Last name</label>
        <input type="text" name="lastname" id="lastname" />
        
        <!-- OR -->
        
        <input type="text" name="firstname" aria-label="firstname">
        
        <div id="lastNameId">Last name</div>
        <input type="text" name="lastname"  aria-labelledby="lastNameId"/>
        
        <!-- still compliant -->
        
        <label for="address">Address</label>
        <input type="text" name="address" id="address" />
        
        <input type="hidden" name="time" value="...">
        <input type="submit" value="Send" />
        

        Exceptions

        No issue will be raised on "implicit labels", i.e. <label> tags enclosing an <input>, <select> or <textarea> instead of being referencing via an id. However, note that the support of this technic is not supported by all assistive technologies. Thus it is better to reference them by id.

        <label>
          Name:
          <input type="text" name="name">
        </label>
        
          Available In:
        • SonarQube IdeCatch issues on the fly,
          in your IDE
        • SonarQube CloudDetect issues in your GitHub, Azure DevOps Services, Bitbucket Cloud, GitLab repositories
        • SonarQube Community BuildAnalyze code in your
          on-premise CI
          Available Since
          9.1
        • SonarQube ServerAnalyze code in your
          on-premise CI
          Developer Edition
          Available Since
          9.1

        © 2008-2025 SonarSource SA. All rights reserved.

        Privacy Policy | Cookie Policy | Terms of Use