Products
In-IDE
IDE extension that lets you fix coding issues before they exist!
Discover SonarQube for IDE
SaaS
Setup is effortless and analysis is automatic for most languages
Discover SonarQube Cloud
Self-Hosted
Fast, accurate analysis; enterprise scalability
Discover SonarQube Server

Secrets
ABAP
Ansible
Apex
AzureResourceManager
C
C#
C++
CloudFormation
COBOL
CSS
Dart
Docker
Flex
GitHub Actions
Go
HTML
Java
JavaScript
JSON
JCL
Kotlin
Kubernetes
Objective C
PHP
PL/I
PL/SQL
Python
RPG
Ruby
Rust
Scala
Shell
Swift
Terraform
Text
TypeScript
T-SQL
VB.NET
VB6
XML
YAML

PHP static code analysis

Unique rules to find Bugs, Vulnerabilities, Security Hotspots, and Code Smells in your PHP code

Filtered: 70 rules found

cwe

Impact

Clean code attribute

The number of arguments passed to a function should match the number of parameters
Bug
Non-empty statements should change control flow or have at least one side-effect
Bug
Variables should be initialized before use
Bug
Server-side requests should not be vulnerable to traversing attacks
Vulnerability
Credentials should not be hard-coded
Vulnerability
Secrets should not be hard-coded
Vulnerability
Constructing arguments of system commands from user input is security-sensitive
Security Hotspot
Prevent unfiltered HTML exposure in WordPress for enhanced security
Vulnerability
External requests should be restricted in WordPress to prevent data leaks and SSRF
Vulnerability
Disable direct file editing in WordPress admin interface
Vulnerability
Applications should not create session cookies from untrusted input
Vulnerability
Reflection should not be vulnerable to injection attacks
Vulnerability
OS commands should not be vulnerable to argument injection attacks
Vulnerability
A new session should be created during user authentication
Vulnerability
Authorizations should be based on strong decisions
Vulnerability
Allowing requests with excessive content length is security-sensitive
Security Hotspot
Cipher algorithms should be robust
Vulnerability
Encryption algorithms should be used with secure mode and padding scheme
Vulnerability
Server hostnames should be verified during SSL/TLS connections
Vulnerability
Include expressions should not be vulnerable to injection attacks
Vulnerability
Dynamic code execution should not be vulnerable to injection attacks
Vulnerability
Using clear-text protocols is security-sensitive
Security Hotspot
Session IDs must be securely generated and not user-specified
Vulnerability
HTTP request redirections should not be open to forging attacks
Vulnerability
Logging should not be vulnerable to injection attacks
Vulnerability
Server-side requests should not be vulnerable to forging attacks
Vulnerability
Deserialization should not be vulnerable to injection attacks
Vulnerability
Endpoints should not be vulnerable to reflected cross-site scripting (XSS) attacks
Vulnerability
Avoid overly permissive Cross-Origin Resource Sharing (CORS) policies to enhance security
Vulnerability
Expanding archive files without controlling resource consumption is security-sensitive
Security Hotspot
Server certificates should be verified during SSL/TLS connections
Vulnerability
Signaling processes is security-sensitive
Security Hotspot
Using weak hashing algorithms is security-sensitive
Security Hotspot
Deactivate debugging features before deploying to production
Vulnerability
Disabling CSRF protections is security-sensitive
Security Hotspot
LDAP connections should be authenticated
Vulnerability
Cryptographic keys should be robust
Vulnerability
Weak SSL/TLS protocols should not be used
Vulnerability
Database queries should not be vulnerable to injection attacks
Vulnerability
"cgi.force_redirect" should be enabled
Vulnerability
"allow_url_fopen" and "allow_url_include" should be disabled
Vulnerability
"open_basedir" should limit file access
Vulnerability
Creating cookies without the "HttpOnly" flag is security-sensitive
Security Hotspot
XML parsers should not be vulnerable to XXE attacks
Vulnerability
Multiline blocks should be enclosed in curly braces
Code Smell
Regular expressions should not be vulnerable to Denial of Service attacks
Vulnerability
Avoid overly permissive POSIX file permissions to enhance security
Vulnerability
Neither DES (Data Encryption Standard) nor DESede (3DES) should be used
Vulnerability
Cryptographic RSA algorithms should always incorporate OAEP (Optimal Asymmetric Encryption Padding)
Vulnerability
Using pseudorandom number generators (PRNGs) is security-sensitive
Security Hotspot
A secure password should be used when connecting to a database
Vulnerability
Creating cookies without the "secure" flag is security-sensitive
Security Hotspot
XPath expressions should not be vulnerable to injection attacks
Vulnerability
I/O function calls should not be vulnerable to path injection attacks
Vulnerability
LDAP queries should not be vulnerable to injection attacks
Vulnerability
Use prepared statements to securely construct SQL queries
Vulnerability
OS commands should not be vulnerable to command injection attacks
Vulnerability
Credentials should not be hard-coded
Vulnerability
Password hashing functions should use an unpredictable salt
Vulnerability
References should not be passed to function calls
Code Smell
Unused assignments should be removed
Code Smell
All code should be reachable
Bug
Dynamically executing code is security-sensitive
Security Hotspot
"switch" statements should have "default" clauses
Code Smell
Switch cases should end with an unconditional "break" statement
Code Smell
Useless "if(true) {...}" and "if(false){...}" blocks should be removed
Bug
Track uses of "TODO" tags
Code Smell
Track uses of "FIXME" tags
Code Smell
Assignments should not be made from within sub-expressions
Code Smell
Generic exceptions ErrorException, RuntimeException and Exception should not be thrown
Code Smell

Avoid overly permissive POSIX file permissions to enhance security

consistency - conventional

security

Vulnerability

Why is this an issue?

How can I fix it?

More Info

In Unix file system permissions, the "others" category refers to all users except the owner of the file system resource and the members of the group assigned to this resource.

Granting permissions to this category can lead to unintended access to files or directories that could allow attackers to obtain sensitive information, disrupt services or elevate privileges.

Available In:

Catch issues on the fly,
in your IDE

Detect issues in your GitHub, Azure DevOps Services, Bitbucket Cloud, GitLab repositories

Analyze code in your
on-premise CI

Available Since
9.1

Analyze code in your
on-premise CI

Developer Edition
Available Since
9.1

In-IDE

SaaS

Self-Hosted