SonarSource Rules
  • Products

    In-IDE

    Code Quality and Security in your IDE with SonarQube Ide

    IDE extension that lets you fix coding issues before they exist!

    Discover SonarQube for IDE

    SaaS

    Code Quality and Security in the cloud with SonarQube Cloud

    Setup is effortless and analysis is automatic for most languages

    Discover SonarQube Cloud

    Self-Hosted

    Code Quality and Security Self-Hosted with SonarQube Server

    Fast, accurate analysis; enterprise scalability

    Discover SonarQube Server
  • SecretsSecrets
  • ABAPABAP
  • AnsibleAnsible
  • ApexApex
  • AzureResourceManagerAzureResourceManager
  • CC
  • C#C#
  • C++C++
  • CloudFormationCloudFormation
  • COBOLCOBOL
  • CSSCSS
  • DartDart
  • DockerDocker
  • FlexFlex
  • GitHub ActionsGitHub Actions
  • GoGo
  • HTMLHTML
  • JavaJava
  • JavaScriptJavaScript
  • JSONJSON
  • JCLJCL
  • KotlinKotlin
  • KubernetesKubernetes
  • Objective CObjective C
  • PHPPHP
  • PL/IPL/I
  • PL/SQLPL/SQL
  • PythonPython
  • RPGRPG
  • RubyRuby
  • RustRust
  • ScalaScala
  • ShellShell
  • SwiftSwift
  • TerraformTerraform
  • TextText
  • TypeScriptTypeScript
  • T-SQLT-SQL
  • VB.NETVB.NET
  • VB6VB6
  • XMLXML
  • YAMLYAML
PHP

PHP static code analysis

Unique rules to find Bugs, Vulnerabilities, Security Hotspots, and Code Smells in your PHP code

  • All rules 273
  • Vulnerability42
  • Bug51
  • Security Hotspot34
  • Code Smell146
 
Tags
    Impact
      Clean code attribute
        1. The number of arguments passed to a function should match the number of parameters

           Bug
        2. Non-empty statements should change control flow or have at least one side-effect

           Bug
        3. Variables should be initialized before use

           Bug
        4. Regular expressions should have valid delimiters

           Bug
        5. Replacement strings should reference existing regular expression groups

           Bug
        6. Alternation in regular expressions should not contain empty alternatives

           Bug
        7. Regex lookahead assertions should not be contradictory

           Bug
        8. Back references in regular expressions should only refer to capturing groups that are matched before the reference

           Bug
        9. Regex boundaries should not be used in a way that can never be matched

           Bug
        10. Regex patterns following a possessive quantifier should not always fail

           Bug
        11. Assertions should not be made at the end of blocks expecting an exception

           Bug
        12. Class of caught exception should be defined

           Bug
        13. Unicode Grapheme Clusters should be avoided inside regex character classes

           Bug
        14. Assertions should not compare an object to itself

           Bug
        15. Regular expressions should be syntactically valid

           Bug
        16. Regex alternatives should not be redundant

           Bug
        17. Alternatives in regular expressions should be grouped when used with anchors

           Bug
        18. Repeated patterns in regular expressions should not match the empty string

           Bug
        19. Only one method invocation is expected when testing exceptions

           Bug
        20. Assertion failure exceptions should not be ignored

           Bug
        21. Caught Exceptions must derive from Throwable

           Bug
        22. Raised Exceptions must derive from Throwable

           Bug
        23. References used in "foreach" loops should be "unset"

           Bug
        24. Array values should not be replaced unconditionally

           Bug
        25. Exceptions should not be created without being thrown

           Bug
        26. Array or Countable object count comparisons should make sense

           Bug
        27. All branches in a conditional structure should not have exactly the same implementation

           Bug
        28. The output of functions that don't return anything should not be used

           Bug
        29. Unary prefix operators should not be repeated

           Bug
        30. Non-existent operators like "=+" should not be used

           Bug
        31. A "for" loop update clause should move the counter in the right direction

           Bug
        32. Return values from functions without side effects should not be ignored

           Bug
        33. Values should not be uselessly incremented

           Bug
        34. Static members should be referenced with "static::"

           Bug
        35. Files that define symbols should not cause side-effects

           Bug
        36. "$this" should not be used in a static context

           Bug
        37. "require_once" and "include_once" should be used instead of "require" and "include"

           Bug
        38. Errors should not be silenced

           Bug
        39. Files should not contain characters before "<?php"

           Bug
        40. Related "if/else if" statements and "cases" in a "switch" should not have the same condition

           Bug
        41. Objects should not be created to be dropped immediately without being used

           Bug
        42. "exit(...)" and "die(...)" statements should not be used

           Bug
        43. Method visibility should be explicitly declared

           Bug
        44. Identical expressions should not be used on both sides of a binary operator

           Bug
        45. All code should be reachable

           Bug
        46. Loops with at most one iteration should be refactored

           Bug
        47. Short-circuit logic should be used to prevent null pointer dereferences in conditionals

           Bug
        48. Variables should not be self-assigned

           Bug
        49. Function and method parameters' initial values should not be ignored

           Bug
        50. Useless "if(true) {...}" and "if(false){...}" blocks should be removed

           Bug
        51. All "catch" blocks should be able to catch exceptions

           Bug

        All code should be reachable

        intentionality - logical
        reliability
        Bug
        • cwe
        • unused

        Once control flow has been moved out of the current code block, any subsequent statements become effectively unreachable.

        Why is this an issue?

        More Info

        Some statements (return, break, continue, goto, switch) and throw expressions move control flow out of the current code block. So any unlabeled statements that come after such a jump are unreachable, and either this dead code should be removed, or the logic should be corrected.

        Noncompliant code example

        function fun($a) {
          $i = 10;
          return $i + $a;
          $i++;             // dead code
        }
        

        Compliant solution

        function fun($a) {
          $i = 10;
          return $i + $a;
        }
        
          Available In:
        • SonarQube IdeCatch issues on the fly,
          in your IDE
        • SonarQube CloudDetect issues in your GitHub, Azure DevOps Services, Bitbucket Cloud, GitLab repositories
        • SonarQube Community BuildAnalyze code in your
          on-premise CI
          Available Since
          9.1
        • SonarQube ServerAnalyze code in your
          on-premise CI
          Developer Edition
          Available Since
          9.1

        © 2008-2025 SonarSource SA. All rights reserved.

        Privacy Policy | Cookie Policy | Terms of Use