SonarSource Rules
  • Products

    In-IDE

    Code Quality and Security in your IDE with SonarQube Ide

    IDE extension that lets you fix coding issues before they exist!

    Discover SonarQube for IDE

    SaaS

    Code Quality and Security in the cloud with SonarQube Cloud

    Setup is effortless and analysis is automatic for most languages

    Discover SonarQube Cloud

    Self-Hosted

    Code Quality and Security Self-Hosted with SonarQube Server

    Fast, accurate analysis; enterprise scalability

    Discover SonarQube Server
  • SecretsSecrets
  • ABAPABAP
  • AnsibleAnsible
  • ApexApex
  • AzureResourceManagerAzureResourceManager
  • CC
  • C#C#
  • C++C++
  • CloudFormationCloudFormation
  • COBOLCOBOL
  • CSSCSS
  • DartDart
  • DockerDocker
  • FlexFlex
  • GitHub ActionsGitHub Actions
  • GoGo
  • HTMLHTML
  • JavaJava
  • JavaScriptJavaScript
  • JSONJSON
  • JCLJCL
  • KotlinKotlin
  • KubernetesKubernetes
  • Objective CObjective C
  • PHPPHP
  • PL/IPL/I
  • PL/SQLPL/SQL
  • PythonPython
  • RPGRPG
  • RubyRuby
  • RustRust
  • ScalaScala
  • ShellShell
  • SwiftSwift
  • TerraformTerraform
  • TextText
  • TypeScriptTypeScript
  • T-SQLT-SQL
  • VB.NETVB.NET
  • VB6VB6
  • XMLXML
  • YAMLYAML
PHP

PHP static code analysis

Unique rules to find Bugs, Vulnerabilities, Security Hotspots, and Code Smells in your PHP code

  • All rules 263
  • Vulnerability54
  • Bug51
  • Security Hotspot12
  • Code Smell146
 
Tags
    Impact
      Clean code attribute
        1. The number of arguments passed to a function should match the number of parameters

           Bug
        2. "goto" statement should not be used

           Code Smell
        3. Non-empty statements should change control flow or have at least one side-effect

           Bug
        4. Increment (++) and decrement (--) operators should not be used in a method call or mixed with other operators in an expression

           Code Smell
        5. Variables should be initialized before use

           Bug
        6. Server-side requests should not be vulnerable to traversing attacks

           Vulnerability
        7. Unnecessary parentheses should not be used for constructs

           Code Smell
        8. Credentials should not be hard-coded

           Vulnerability
        9. Secrets should not be hard-coded

           Vulnerability
        10. Character classes in regular expressions should not contain only one character

           Code Smell
        11. Superfluous curly brace quantifiers should be avoided

           Code Smell
        12. Non-capturing groups without quantifier should not be used

           Code Smell
        13. Regular expressions should have valid delimiters

           Bug
        14. Regular expression quantifiers and character classes should be used concisely

           Code Smell
        15. Constructing arguments of system commands from user input is security-sensitive

           Security Hotspot
        16. WordPress option names should not be misspelled

           Code Smell
        17. Prevent unfiltered HTML exposure in WordPress for enhanced security

           Vulnerability
        18. WordPress options should not be defined at the end of "wp-config.php"

           Code Smell
        19. Prevent unauthenticated WordPress database repair for enhanced security

           Vulnerability
        20. External requests should be restricted in WordPress to prevent data leaks and SSRF

           Vulnerability
        21. Constants should not be redefined

           Code Smell
        22. Automatic updates should not be disabled

           Vulnerability
        23. Disable direct file editing in WordPress admin interface

           Vulnerability
        24. Secret keys and salt values should be robust

           Vulnerability
        25. Regular expressions should not contain empty groups

           Code Smell
        26. Replacement strings should reference existing regular expression groups

           Bug
        27. Regular expressions should not contain multiple spaces

           Code Smell
        28. Alternation in regular expressions should not contain empty alternatives

           Bug
        29. Applications should not create session cookies from untrusted input

           Vulnerability
        30. Reflection should not be vulnerable to injection attacks

           Vulnerability
        31. Single-character alternations in regular expressions should be replaced with character classes

           Code Smell
        32. Reluctant quantifiers in regular expressions should be followed by an expression that can't match the empty string

           Code Smell
        33. Regex lookahead assertions should not be contradictory

           Bug
        34. Back references in regular expressions should only refer to capturing groups that are matched before the reference

           Bug
        35. Regex boundaries should not be used in a way that can never be matched

           Bug
        36. Regex patterns following a possessive quantifier should not always fail

           Bug
        37. Framework-provided functions should be used to test exceptions

           Code Smell
        38. Assertions should not be made at the end of blocks expecting an exception

           Bug
        39. Class of caught exception should be defined

           Bug
        40. Test methods should be discoverable

           Code Smell
        41. OS commands should not be vulnerable to argument injection attacks

           Vulnerability
        42. A new session should be created during user authentication

           Vulnerability
        43. Character classes in regular expressions should not contain the same character twice

           Code Smell
        44. Unicode Grapheme Clusters should be avoided inside regex character classes

           Bug
        45. Unicode-aware versions of character classes should be preferred

           Code Smell
        46. Assertions should not compare an object to itself

           Bug
        47. Character classes should be preferred over reluctant quantifiers in regular expressions

           Code Smell
        48. Regular expressions should be syntactically valid

           Bug
        49. Regex alternatives should not be redundant

           Bug
        50. Alternatives in regular expressions should be grouped when used with anchors

           Bug
        51. Regular expressions should not be too complicated

           Code Smell
        52. Repeated patterns in regular expressions should not match the empty string

           Bug
        53. Authorizations should be based on strong decisions

           Vulnerability
        54. Constants should not be used as conditions

           Code Smell
        55. PHPUnit assertTrue/assertFalse should be simplified to the corresponding dedicated assertion

           Code Smell
        56. Only one method invocation is expected when testing exceptions

           Bug
        57. Assertion failure exceptions should not be ignored

           Bug
        58. A subclass should not be in the same "catch" clause as a parent class

           Code Smell
        59. Caught Exceptions must derive from Throwable

           Bug
        60. Allowing requests with excessive content length is security-sensitive

           Security Hotspot
        61. Raised Exceptions must derive from Throwable

           Bug
        62. Cipher algorithms should be robust

           Vulnerability
        63. Encryption algorithms should be used with secure mode and padding scheme

           Vulnerability
        64. Server hostnames should be verified during SSL/TLS connections

           Vulnerability
        65. `str_replace` should be preferred to `preg_replace`

           Code Smell
        66. Include expressions should not be vulnerable to injection attacks

           Vulnerability
        67. Dynamic code execution should not be vulnerable to injection attacks

           Vulnerability
        68. Using clear-text protocols is security-sensitive

           Security Hotspot
        69. Session IDs must be securely generated and not user-specified

           Vulnerability
        70. HTTP request redirections should not be open to forging attacks

           Vulnerability
        71. Logging should not be vulnerable to injection attacks

           Vulnerability
        72. Server-side requests should not be vulnerable to forging attacks

           Vulnerability
        73. Deserialization should not be vulnerable to injection attacks

           Vulnerability
        74. Endpoints should not be vulnerable to reflected cross-site scripting (XSS) attacks

           Vulnerability
        75. Avoid overly permissive Cross-Origin Resource Sharing (CORS) policies to enhance security

           Vulnerability
        76. Expanding archive files without controlling resource consumption is security-sensitive

           Security Hotspot
        77. Use of namespaces should be preferred to "include" or "require" functions

           Code Smell
        78. Server certificates should be verified during SSL/TLS connections

           Vulnerability
        79. Signaling processes is security-sensitive

           Security Hotspot
        80. References used in "foreach" loops should be "unset"

           Bug
        81. Using weak hashing algorithms is security-sensitive

           Security Hotspot
        82. "default" clauses should be first or last

           Code Smell
        83. Deactivate debugging features before deploying to production

           Vulnerability
        84. Disabling CSRF protections is security-sensitive

           Security Hotspot
        85. LDAP connections should be authenticated

           Vulnerability
        86. Cryptographic keys should be robust

           Vulnerability
        87. Weak SSL/TLS protocols should not be used

           Vulnerability
        88. Methods should not have identical implementations

           Code Smell
        89. Array values should not be replaced unconditionally

           Bug
        90. Duplicate values should not be passed as arguments

           Code Smell
        91. Exceptions should not be created without being thrown

           Bug
        92. Array or Countable object count comparisons should make sense

           Bug
        93. A conditionally executed single line should be denoted by indentation

           Code Smell
        94. Conditionals should start on new lines

           Code Smell
        95. All branches in a conditional structure should not have exactly the same implementation

           Bug
        96. Functions should use "return" consistently

           Code Smell
        97. Cognitive Complexity of functions should not be too high

           Code Smell
        98. The output of functions that don't return anything should not be used

           Bug
        99. Database queries should not be vulnerable to injection attacks

           Vulnerability
        100. Jump statements should not be redundant

           Code Smell
        101. Assertion arguments should be passed in the correct order

           Code Smell
        102. Test class names should end with "Test"

           Code Smell
        103. Ternary operators should not be nested

           Code Smell
        104. "file_uploads" should be disabled

           Vulnerability
        105. "enable_dl" should be disabled

           Vulnerability
        106. "session.use_trans_sid" should not be enabled

           Vulnerability
        107. "cgi.force_redirect" should be enabled

           Vulnerability
        108. "allow_url_fopen" and "allow_url_include" should be disabled

           Vulnerability
        109. "open_basedir" should limit file access

           Vulnerability
        110. Session-management cookies should not be persistent

           Vulnerability
        111. Creating cookies without the "HttpOnly" flag is security-sensitive

           Security Hotspot
        112. Reflection should not be used to increase accessibility of classes, methods, or fields

           Code Smell
        113. "sleep" should not be called

           Vulnerability
        114. Configuration should not be changed dynamically

           Code Smell
        115. Class constructors should not create other objects

           Code Smell
        116. Unary prefix operators should not be repeated

           Bug
        117. Non-existent operators like "=+" should not be used

           Bug
        118. XML parsers should not be vulnerable to XXE attacks

           Vulnerability
        119. "catch" clauses should do more than rethrow

           Code Smell
        120. Literal boolean values and nulls should not be used in equality assertions

           Code Smell
        121. Tests should include assertions

           Code Smell
        122. Multiline blocks should be enclosed in curly braces

           Code Smell
        123. Regular expressions should not be vulnerable to Denial of Service attacks

           Vulnerability
        124. Avoid overly permissive POSIX file permissions to enhance security

           Vulnerability
        125. Neither DES (Data Encryption Standard) nor DESede (3DES) should be used

           Vulnerability
        126. Cryptographic RSA algorithms should always incorporate OAEP (Optimal Asymmetric Encryption Padding)

           Vulnerability
        127. PHP parser failure

           Code Smell
        128. A "for" loop update clause should move the counter in the right direction

           Bug
        129. Using pseudorandom number generators (PRNGs) is security-sensitive

           Security Hotspot
        130. Parameters should be passed in the correct order

           Code Smell
        131. Return values from functions without side effects should not be ignored

           Bug
        132. TestCases should contain tests

           Code Smell
        133. Classes named like "Exception" should extend "Exception" or a subclass

           Code Smell
        134. Values should not be uselessly incremented

           Bug
        135. A secure password should be used when connecting to a database

           Vulnerability
        136. Creating cookies without the "secure" flag is security-sensitive

           Security Hotspot
        137. XPath expressions should not be vulnerable to injection attacks

           Vulnerability
        138. I/O function calls should not be vulnerable to path injection attacks

           Vulnerability
        139. LDAP queries should not be vulnerable to injection attacks

           Vulnerability
        140. Use prepared statements to securely construct SQL queries

           Vulnerability
        141. OS commands should not be vulnerable to command injection attacks

           Vulnerability
        142. SHA-1 and Message-Digest hash algorithms should not be used in secure contexts

           Vulnerability
        143. Credentials should not be hard-coded

           Vulnerability
        144. Password hashing functions should use an unpredictable salt

           Vulnerability
        145. Alias functions should not be used

           Code Smell
        146. The names of methods with boolean return values should start with "is" or "has"

           Code Smell
        147. Perl-style comments should not be used

           Code Smell
        148. "php_sapi_name()" should not be used

           Code Smell
        149. Superglobals should not be accessed directly

           Code Smell
        150. Classes should not have too many lines of code

           Code Smell
        151. Parentheses should not be used for calls to "echo"

           Code Smell
        152. Colors should be defined in upper case

           Code Smell
        153. Static members should be referenced with "static::"

           Bug
        154. Files that define symbols should not cause side-effects

           Bug
        155. "$this" should not be used in a static context

           Bug
        156. "global" should not be used

           Code Smell
        157. "&&" and "||" should be used

           Code Smell
        158. Functions and variables should not be defined outside of classes

           Code Smell
        159. String literals should not be concatenated

           Code Smell
        160. Functions should not be nested too deeply

           Code Smell
        161. "require_once" and "include_once" should be used instead of "require" and "include"

           Bug
        162. Errors should not be silenced

           Bug
        163. Deprecated features should not be used

           Code Smell
        164. Files should not contain characters before "<?php"

           Bug
        165. References should not be passed to function calls

           Code Smell
        166. Files should not contain inline HTML

           Code Smell
        167. Files should contain only one top-level class or interface each

           Code Smell
        168. "final" should not be used redundantly

           Code Smell
        169. Boolean checks should not be inverted

           Code Smell
        170. Two branches in a conditional structure should not have exactly the same implementation

           Code Smell
        171. Related "if/else if" statements and "cases" in a "switch" should not have the same condition

           Bug
        172. Unused assignments should be removed

           Code Smell
        173. Objects should not be created to be dropped immediately without being used

           Bug
        174. "switch" statements should not be nested

           Code Smell
        175. Classes should not have too many fields

           Code Smell
        176. Source code should comply with formatting standards

           Code Smell
        177. "exit(...)" and "die(...)" statements should not be used

           Bug
        178. "elseif" keyword should be used in place of "else if" keywords

           Code Smell
        179. Method arguments with default values should be last

           Code Smell
        180. Method visibility should be explicitly declared

           Bug
        181. PHP keywords and constants "true", "false", "null" should be lower case

           Code Smell
        182. Closing tag "?>" should be omitted on files containing only PHP

           Code Smell
        183. Only LF character (Unix-like) should be used to end lines

           Code Smell
        184. More than one property should not be declared per statement

           Code Smell
        185. The "var" keyword should not be used

           Code Smell
        186. Identical expressions should not be used on both sides of a binary operator

           Bug
        187. All code should be reachable

           Bug
        188. "<?php" and "<?=" tags should be used

           Code Smell
        189. Loops with at most one iteration should be refactored

           Bug
        190. Short-circuit logic should be used to prevent null pointer dereferences in conditionals

           Bug
        191. Variables should not be self-assigned

           Bug
        192. A reason should be provided when skipping a test

           Code Smell
        193. "__construct" functions should not make PHP 4-style calls to parent constructors

           Code Smell
        194. Deprecated constructor declarations should not be used

           Code Smell
        195. Deprecated predefined variables should not be used

           Code Smell
        196. Variable variables should not be used

           Code Smell
        197. File names should comply with a naming convention

           Code Smell
        198. Cyclomatic Complexity of functions should not be too high

           Code Smell
        199. Dynamically executing code is security-sensitive

           Security Hotspot
        200. Local variables should not be declared and then immediately returned or thrown

           Code Smell
        201. Unused local variables should be removed

           Code Smell
        202. "switch" statements should not have too many "case" clauses

           Code Smell
        203. Track lack of copyright and license headers

           Code Smell
        204. Classes should not have too many methods

           Code Smell
        205. Comments should not be located at the end of lines of code

           Code Smell
        206. Functions should not have too many lines of code

           Code Smell
        207. Control flow statements "if", "for", "while", "switch" and "try" should not be nested too deeply

           Code Smell
        208. Octal values should not be used

           Code Smell
        209. Using hardcoded IP addresses is security-sensitive

           Security Hotspot
        210. Cyclomatic Complexity of classes should not be too high

           Code Smell
        211. "switch" statements should have "default" clauses

           Code Smell
        212. "switch" statements should have at least 3 "case" clauses

           Code Smell
        213. Track uses of "NOSONAR" comments

           Code Smell
        214. Switch cases should end with an unconditional "break" statement

           Code Smell
        215. "for" loop stop conditions should be invariant

           Code Smell
        216. A "while" loop should be used instead of a "for" loop

           Code Smell
        217. "if ... else if" constructs should end with "else" clauses

           Code Smell
        218. Sections of code should not be commented out

           Code Smell
        219. Function and method parameters' initial values should not be ignored

           Bug
        220. Statements should be on separate lines

           Code Smell
        221. Control structures should use curly braces

           Code Smell
        222. Classes should not be coupled to too many other classes

           Code Smell
        223. String literals should not be duplicated

           Code Smell
        224. Methods should not be empty

           Code Smell
        225. Overriding methods should do more than simply call the same method in the super class

           Code Smell
        226. Unused function parameters should be removed

           Code Smell
        227. Local variable and function parameter names should comply with a naming convention

           Code Smell
        228. Field names should comply with a naming convention

           Code Smell
        229. "empty()" should be used to test for emptiness

           Code Smell
        230. "switch case" clauses should not have too many lines of code

           Code Smell
        231. Constant names should comply with a naming convention

           Code Smell
        232. Useless "if(true) {...}" and "if(false){...}" blocks should be removed

           Bug
        233. Unused "private" methods should be removed

           Code Smell
        234. Functions should not contain too many return statements

           Code Smell
        235. Interface names should comply with a naming convention

           Code Smell
        236. Track uses of "TODO" tags

           Code Smell
        237. Track uses of "FIXME" tags

           Code Smell
        238. Lines should not end with trailing whitespaces

           Code Smell
        239. Files should end with a newline

           Code Smell
        240. Return of boolean expressions should not be wrapped into an "if-then-else" statement

           Code Smell
        241. Boolean literals should not be redundant

           Code Smell
        242. Modifiers should be declared in the correct order

           Code Smell
        243. Assignments should not be made from within sub-expressions

           Code Smell
        244. Generic exceptions ErrorException, RuntimeException and Exception should not be thrown

           Code Smell
        245. Local variables should not have the same name as class fields

           Code Smell
        246. Empty statements should be removed

           Code Smell
        247. Redundant pairs of parentheses should be removed

           Code Smell
        248. A close curly brace should be located at the beginning of a line

           Code Smell
        249. An open curly brace should be located at the beginning of a line

           Code Smell
        250. An open curly brace should be located at the end of a line

           Code Smell
        251. Inheritance tree of classes should not be too deep

           Code Smell
        252. Nested blocks of code should not be left empty

           Code Smell
        253. URIs should not be hardcoded

           Code Smell
        254. Functions should not have too many parameters

           Code Smell
        255. Unused "private" fields should be removed

           Code Smell
        256. Expressions should not be too complex

           Code Smell
        257. Mergeable "if" statements should be combined

           Code Smell
        258. Tabulation characters should not be used

           Code Smell
        259. All "catch" blocks should be able to catch exceptions

           Bug
        260. Files should not have too many lines of code

           Code Smell
        261. Lines should not be too long

           Code Smell
        262. Class names should comply with a naming convention

           Code Smell
        263. Function names should comply with a naming convention

           Code Smell

        Unused assignments should be removed

        intentionality - logical
        maintainability
        Code Smell
        • cwe
        • unused

        Why is this an issue?

        How can I fix it?

        More Info

        Dead stores refer to assignments made to local variables that are subsequently never used or immediately overwritten. Such assignments are unnecessary and don’t contribute to the functionality or clarity of the code. They may even negatively impact performance. Removing them enhances code cleanliness and readability. Even if the unnecessary operations do not do any harm in terms of the program’s correctness, they are - at best - a waste of computing resources.

        Exceptions

        This rule ignores initializations to -1, 0, 1, null, true, false, "", [] and array().

          Available In:
        • SonarQube IdeCatch issues on the fly,
          in your IDE
        • SonarQube CloudDetect issues in your GitHub, Azure DevOps Services, Bitbucket Cloud, GitLab repositories
        • SonarQube Community BuildAnalyze code in your
          on-premise CI
          Available Since
          9.1
        • SonarQube ServerAnalyze code in your
          on-premise CI
          Developer Edition
          Available Since
          9.1

        © 2025 SonarSource Sàrl. All rights reserved.

        Privacy Policy | Cookie Policy | Terms of Use