SonarSource Rules
  • Products

    In-IDE

    Code Quality and Security in your IDE with SonarQube Ide

    IDE extension that lets you fix coding issues before they exist!

    Discover SonarQube for IDE

    SaaS

    Code Quality and Security in the cloud with SonarQube Cloud

    Setup is effortless and analysis is automatic for most languages

    Discover SonarQube Cloud

    Self-Hosted

    Code Quality and Security Self-Hosted with SonarQube Server

    Fast, accurate analysis; enterprise scalability

    Discover SonarQube Server
  • SecretsSecrets
  • ABAPABAP
  • AnsibleAnsible
  • ApexApex
  • AzureResourceManagerAzureResourceManager
  • CC
  • C#C#
  • C++C++
  • CloudFormationCloudFormation
  • COBOLCOBOL
  • CSSCSS
  • DartDart
  • DockerDocker
  • FlexFlex
  • GitHub ActionsGitHub Actions
  • GoGo
  • HTMLHTML
  • JavaJava
  • JavaScriptJavaScript
  • JSONJSON
  • JCLJCL
  • KotlinKotlin
  • KubernetesKubernetes
  • Objective CObjective C
  • PHPPHP
  • PL/IPL/I
  • PL/SQLPL/SQL
  • PythonPython
  • RPGRPG
  • RubyRuby
  • RustRust
  • ScalaScala
  • ShellShell
  • SwiftSwift
  • TerraformTerraform
  • TextText
  • TypeScriptTypeScript
  • T-SQLT-SQL
  • VB.NETVB.NET
  • VB6VB6
  • XMLXML
  • YAMLYAML
PHP

PHP static code analysis

Unique rules to find Bugs, Vulnerabilities, Security Hotspots, and Code Smells in your PHP code

  • All rules 273
  • Vulnerability42
  • Bug51
  • Security Hotspot34
  • Code Smell146
 
Tags
    Impact
      Clean code attribute
        1. "goto" statement should not be used

           Code Smell
        2. Increment (++) and decrement (--) operators should not be used in a method call or mixed with other operators in an expression

           Code Smell
        3. Unnecessary parentheses should not be used for constructs

           Code Smell
        4. Character classes in regular expressions should not contain only one character

           Code Smell
        5. Superfluous curly brace quantifiers should be avoided

           Code Smell
        6. Non-capturing groups without quantifier should not be used

           Code Smell
        7. Regular expression quantifiers and character classes should be used concisely

           Code Smell
        8. WordPress option names should not be misspelled

           Code Smell
        9. WordPress options should not be defined at the end of "wp-config.php"

           Code Smell
        10. Constants should not be redefined

           Code Smell
        11. Regular expressions should not contain empty groups

           Code Smell
        12. Regular expressions should not contain multiple spaces

           Code Smell
        13. Single-character alternations in regular expressions should be replaced with character classes

           Code Smell
        14. Reluctant quantifiers in regular expressions should be followed by an expression that can't match the empty string

           Code Smell
        15. Framework-provided functions should be used to test exceptions

           Code Smell
        16. Test methods should be discoverable

           Code Smell
        17. Character classes in regular expressions should not contain the same character twice

           Code Smell
        18. Unicode-aware versions of character classes should be preferred

           Code Smell
        19. Character classes should be preferred over reluctant quantifiers in regular expressions

           Code Smell
        20. Regular expressions should not be too complicated

           Code Smell
        21. Constants should not be used as conditions

           Code Smell
        22. PHPUnit assertTrue/assertFalse should be simplified to the corresponding dedicated assertion

           Code Smell
        23. A subclass should not be in the same "catch" clause as a parent class

           Code Smell
        24. `str_replace` should be preferred to `preg_replace`

           Code Smell
        25. Use of namespaces should be preferred to "include" or "require" functions

           Code Smell
        26. "default" clauses should be first or last

           Code Smell
        27. Methods should not have identical implementations

           Code Smell
        28. Duplicate values should not be passed as arguments

           Code Smell
        29. A conditionally executed single line should be denoted by indentation

           Code Smell
        30. Conditionals should start on new lines

           Code Smell
        31. Functions should use "return" consistently

           Code Smell
        32. Cognitive Complexity of functions should not be too high

           Code Smell
        33. Jump statements should not be redundant

           Code Smell
        34. Assertion arguments should be passed in the correct order

           Code Smell
        35. Test class names should end with "Test"

           Code Smell
        36. Ternary operators should not be nested

           Code Smell
        37. Reflection should not be used to increase accessibility of classes, methods, or fields

           Code Smell
        38. Configuration should not be changed dynamically

           Code Smell
        39. Class constructors should not create other objects

           Code Smell
        40. "catch" clauses should do more than rethrow

           Code Smell
        41. Literal boolean values and nulls should not be used in equality assertions

           Code Smell
        42. Tests should include assertions

           Code Smell
        43. Multiline blocks should be enclosed in curly braces

           Code Smell
        44. PHP parser failure

           Code Smell
        45. Parameters should be passed in the correct order

           Code Smell
        46. TestCases should contain tests

           Code Smell
        47. Classes named like "Exception" should extend "Exception" or a subclass

           Code Smell
        48. Alias functions should not be used

           Code Smell
        49. The names of methods with boolean return values should start with "is" or "has"

           Code Smell
        50. Perl-style comments should not be used

           Code Smell
        51. "php_sapi_name()" should not be used

           Code Smell
        52. Superglobals should not be accessed directly

           Code Smell
        53. Classes should not have too many lines of code

           Code Smell
        54. Parentheses should not be used for calls to "echo"

           Code Smell
        55. Colors should be defined in upper case

           Code Smell
        56. "global" should not be used

           Code Smell
        57. "&&" and "||" should be used

           Code Smell
        58. Functions and variables should not be defined outside of classes

           Code Smell
        59. String literals should not be concatenated

           Code Smell
        60. Functions should not be nested too deeply

           Code Smell
        61. Deprecated features should not be used

           Code Smell
        62. References should not be passed to function calls

           Code Smell
        63. Files should not contain inline HTML

           Code Smell
        64. Files should contain only one top-level class or interface each

           Code Smell
        65. "final" should not be used redundantly

           Code Smell
        66. Boolean checks should not be inverted

           Code Smell
        67. Two branches in a conditional structure should not have exactly the same implementation

           Code Smell
        68. Unused assignments should be removed

           Code Smell
        69. "switch" statements should not be nested

           Code Smell
        70. Classes should not have too many fields

           Code Smell
        71. Source code should comply with formatting standards

           Code Smell
        72. "elseif" keyword should be used in place of "else if" keywords

           Code Smell
        73. Method arguments with default values should be last

           Code Smell
        74. PHP keywords and constants "true", "false", "null" should be lower case

           Code Smell
        75. Closing tag "?>" should be omitted on files containing only PHP

           Code Smell
        76. Only LF character (Unix-like) should be used to end lines

           Code Smell
        77. More than one property should not be declared per statement

           Code Smell
        78. The "var" keyword should not be used

           Code Smell
        79. "<?php" and "<?=" tags should be used

           Code Smell
        80. A reason should be provided when skipping a test

           Code Smell
        81. "__construct" functions should not make PHP 4-style calls to parent constructors

           Code Smell
        82. Deprecated constructor declarations should not be used

           Code Smell
        83. Deprecated predefined variables should not be used

           Code Smell
        84. Variable variables should not be used

           Code Smell
        85. File names should comply with a naming convention

           Code Smell
        86. Cyclomatic Complexity of functions should not be too high

           Code Smell
        87. Local variables should not be declared and then immediately returned or thrown

           Code Smell
        88. Unused local variables should be removed

           Code Smell
        89. "switch" statements should not have too many "case" clauses

           Code Smell
        90. Track lack of copyright and license headers

           Code Smell
        91. Classes should not have too many methods

           Code Smell
        92. Comments should not be located at the end of lines of code

           Code Smell
        93. Functions should not have too many lines of code

           Code Smell
        94. Control flow statements "if", "for", "while", "switch" and "try" should not be nested too deeply

           Code Smell
        95. Octal values should not be used

           Code Smell
        96. Cyclomatic Complexity of classes should not be too high

           Code Smell
        97. "switch" statements should have "default" clauses

           Code Smell
        98. "switch" statements should have at least 3 "case" clauses

           Code Smell
        99. Track uses of "NOSONAR" comments

           Code Smell
        100. Switch cases should end with an unconditional "break" statement

           Code Smell
        101. "for" loop stop conditions should be invariant

           Code Smell
        102. A "while" loop should be used instead of a "for" loop

           Code Smell
        103. "if ... else if" constructs should end with "else" clauses

           Code Smell
        104. Sections of code should not be commented out

           Code Smell
        105. Statements should be on separate lines

           Code Smell
        106. Control structures should use curly braces

           Code Smell
        107. Classes should not be coupled to too many other classes

           Code Smell
        108. String literals should not be duplicated

           Code Smell
        109. Methods should not be empty

           Code Smell
        110. Overriding methods should do more than simply call the same method in the super class

           Code Smell
        111. Unused function parameters should be removed

           Code Smell
        112. Local variable and function parameter names should comply with a naming convention

           Code Smell
        113. Field names should comply with a naming convention

           Code Smell
        114. "empty()" should be used to test for emptiness

           Code Smell
        115. "switch case" clauses should not have too many lines of code

           Code Smell
        116. Constant names should comply with a naming convention

           Code Smell
        117. Unused "private" methods should be removed

           Code Smell
        118. Functions should not contain too many return statements

           Code Smell
        119. Interface names should comply with a naming convention

           Code Smell
        120. Track uses of "TODO" tags

           Code Smell
        121. Track uses of "FIXME" tags

           Code Smell
        122. Lines should not end with trailing whitespaces

           Code Smell
        123. Files should end with a newline

           Code Smell
        124. Return of boolean expressions should not be wrapped into an "if-then-else" statement

           Code Smell
        125. Boolean literals should not be redundant

           Code Smell
        126. Modifiers should be declared in the correct order

           Code Smell
        127. Assignments should not be made from within sub-expressions

           Code Smell
        128. Generic exceptions ErrorException, RuntimeException and Exception should not be thrown

           Code Smell
        129. Local variables should not have the same name as class fields

           Code Smell
        130. Empty statements should be removed

           Code Smell
        131. Redundant pairs of parentheses should be removed

           Code Smell
        132. A close curly brace should be located at the beginning of a line

           Code Smell
        133. An open curly brace should be located at the beginning of a line

           Code Smell
        134. An open curly brace should be located at the end of a line

           Code Smell
        135. Inheritance tree of classes should not be too deep

           Code Smell
        136. Nested blocks of code should not be left empty

           Code Smell
        137. URIs should not be hardcoded

           Code Smell
        138. Functions should not have too many parameters

           Code Smell
        139. Unused "private" fields should be removed

           Code Smell
        140. Expressions should not be too complex

           Code Smell
        141. Mergeable "if" statements should be combined

           Code Smell
        142. Tabulation characters should not be used

           Code Smell
        143. Files should not have too many lines of code

           Code Smell
        144. Lines should not be too long

           Code Smell
        145. Class names should comply with a naming convention

           Code Smell
        146. Function names should comply with a naming convention

           Code Smell

        TestCases should contain tests

        adaptability - tested
        maintainability
        Code Smell
        • tests
        • unused
        • confusing

        Why is this an issue?

        There’s no point in having a PHPUnit test case without any test methods. Similarly, you shouldn’t have a file in the tests directory which extends PHPUnit\Framework\TestCase but no tests in the file. Doing either of these things may lead someone to think that uncovered classes have been tested. Add some test method or make the class abstract if it is used by a real test case class.

        Noncompliant code example

        use PHPUnit\Framework\TestCase;
        
        class MyTest extends TestCase {
        
          protected function setUp() {
            doSomethind();
          }
        
        
          private function doSomethind() {
            //...
          }
        }
        

        Compliant solution

        use PHPUnit\Framework\TestCase;
        
        class MyTest extends TestCase {
        
          public function testBehaviour() {
           //...
          }
        
          //...
        } 
        
        // or
        
        abstract class MyAbstractTest extends TestCase {
        
         protected function setUp() {
           doSomethind();
         }
        
        
         private function doSomethind() {
           //...
         }
        }
        
          Available In:
        • SonarQube IdeCatch issues on the fly,
          in your IDE
        • SonarQube CloudDetect issues in your GitHub, Azure DevOps Services, Bitbucket Cloud, GitLab repositories
        • SonarQube Community BuildAnalyze code in your
          on-premise CI
          Available Since
          9.1
        • SonarQube ServerAnalyze code in your
          on-premise CI
          Developer Edition
          Available Since
          9.1

        © 2008-2025 SonarSource SA. All rights reserved.

        Privacy Policy | Cookie Policy | Terms of Use