SonarSource Rules
  • Products

    In-IDE

    Code Quality and Security in your IDE with SonarQube Ide

    IDE extension that lets you fix coding issues before they exist!

    Discover SonarQube for IDE

    SaaS

    Code Quality and Security in the cloud with SonarQube Cloud

    Setup is effortless and analysis is automatic for most languages

    Discover SonarQube Cloud

    Self-Hosted

    Code Quality and Security Self-Hosted with SonarQube Server

    Fast, accurate analysis; enterprise scalability

    Discover SonarQube Server
  • SecretsSecrets
  • ABAPABAP
  • AnsibleAnsible
  • ApexApex
  • AzureResourceManagerAzureResourceManager
  • CC
  • C#C#
  • C++C++
  • CloudFormationCloudFormation
  • COBOLCOBOL
  • CSSCSS
  • DartDart
  • DockerDocker
  • FlexFlex
  • GitHub ActionsGitHub Actions
  • GoGo
  • HTMLHTML
  • JavaJava
  • JavaScriptJavaScript
  • JSONJSON
  • JCLJCL
  • KotlinKotlin
  • KubernetesKubernetes
  • Objective CObjective C
  • PHPPHP
  • PL/IPL/I
  • PL/SQLPL/SQL
  • PythonPython
  • RPGRPG
  • RubyRuby
  • RustRust
  • ScalaScala
  • ShellShell
  • SwiftSwift
  • TerraformTerraform
  • TextText
  • TypeScriptTypeScript
  • T-SQLT-SQL
  • VB.NETVB.NET
  • VB6VB6
  • XMLXML
  • YAMLYAML
PHP

PHP static code analysis

Unique rules to find Bugs, Vulnerabilities, Security Hotspots, and Code Smells in your PHP code

  • All rules 273
  • Vulnerability42
  • Bug51
  • Security Hotspot34
  • Code Smell146
 
Tags
    Impact
      Clean code attribute
        1. The number of arguments passed to a function should match the number of parameters

           Bug
        2. Non-empty statements should change control flow or have at least one side-effect

           Bug
        3. Variables should be initialized before use

           Bug
        4. Regular expressions should have valid delimiters

           Bug
        5. Replacement strings should reference existing regular expression groups

           Bug
        6. Alternation in regular expressions should not contain empty alternatives

           Bug
        7. Regex lookahead assertions should not be contradictory

           Bug
        8. Back references in regular expressions should only refer to capturing groups that are matched before the reference

           Bug
        9. Regex boundaries should not be used in a way that can never be matched

           Bug
        10. Regex patterns following a possessive quantifier should not always fail

           Bug
        11. Assertions should not be made at the end of blocks expecting an exception

           Bug
        12. Class of caught exception should be defined

           Bug
        13. Unicode Grapheme Clusters should be avoided inside regex character classes

           Bug
        14. Assertions should not compare an object to itself

           Bug
        15. Regular expressions should be syntactically valid

           Bug
        16. Regex alternatives should not be redundant

           Bug
        17. Alternatives in regular expressions should be grouped when used with anchors

           Bug
        18. Repeated patterns in regular expressions should not match the empty string

           Bug
        19. Only one method invocation is expected when testing exceptions

           Bug
        20. Assertion failure exceptions should not be ignored

           Bug
        21. Caught Exceptions must derive from Throwable

           Bug
        22. Raised Exceptions must derive from Throwable

           Bug
        23. References used in "foreach" loops should be "unset"

           Bug
        24. Array values should not be replaced unconditionally

           Bug
        25. Exceptions should not be created without being thrown

           Bug
        26. Array or Countable object count comparisons should make sense

           Bug
        27. All branches in a conditional structure should not have exactly the same implementation

           Bug
        28. The output of functions that don't return anything should not be used

           Bug
        29. Unary prefix operators should not be repeated

           Bug
        30. Non-existent operators like "=+" should not be used

           Bug
        31. A "for" loop update clause should move the counter in the right direction

           Bug
        32. Return values from functions without side effects should not be ignored

           Bug
        33. Values should not be uselessly incremented

           Bug
        34. Static members should be referenced with "static::"

           Bug
        35. Files that define symbols should not cause side-effects

           Bug
        36. "$this" should not be used in a static context

           Bug
        37. "require_once" and "include_once" should be used instead of "require" and "include"

           Bug
        38. Errors should not be silenced

           Bug
        39. Files should not contain characters before "<?php"

           Bug
        40. Related "if/else if" statements and "cases" in a "switch" should not have the same condition

           Bug
        41. Objects should not be created to be dropped immediately without being used

           Bug
        42. "exit(...)" and "die(...)" statements should not be used

           Bug
        43. Method visibility should be explicitly declared

           Bug
        44. Identical expressions should not be used on both sides of a binary operator

           Bug
        45. All code should be reachable

           Bug
        46. Loops with at most one iteration should be refactored

           Bug
        47. Short-circuit logic should be used to prevent null pointer dereferences in conditionals

           Bug
        48. Variables should not be self-assigned

           Bug
        49. Function and method parameters' initial values should not be ignored

           Bug
        50. Useless "if(true) {...}" and "if(false){...}" blocks should be removed

           Bug
        51. All "catch" blocks should be able to catch exceptions

           Bug

        Raised Exceptions must derive from Throwable

        intentionality - logical
        reliability
        Bug

          Why is this an issue?

          Instances of classes that do not derive from the "Throwable" interface cannot be used in a PHP "throw" statement.

          Many built-in exceptions such as "Exception" and the SPL exception classes do implement the "Throwable" interface and can be extended when creating custom exceptions.

          This rule raises an issue when an instance of a class that does not implement the "Throwable" interface is used in a "throw" statement .

          Noncompliant code example

          class NoThrowable {}
          
          throw new NoThrowable(); // Noncompliant
          

          Compliant solution

          <?php
          
          class SomeThrowable implements Throwable {
              // Implementation of the Throwable methods
          }
          
          throw new SomeThrowable(); // Compliant
          
          class SomeCustomException extends Exception {}
          
          throw new SomeCustomException(); // Compliant{code}
          
            Available In:
          • SonarQube IdeCatch issues on the fly,
            in your IDE
          • SonarQube CloudDetect issues in your GitHub, Azure DevOps Services, Bitbucket Cloud, GitLab repositories
          • SonarQube Community BuildAnalyze code in your
            on-premise CI
            Available Since
            9.1
          • SonarQube ServerAnalyze code in your
            on-premise CI
            Developer Edition
            Available Since
            9.1

          © 2008-2025 SonarSource SA. All rights reserved.

          Privacy Policy | Cookie Policy | Terms of Use