SonarSource Rules
  • Products

    In-IDE

    Code Quality and Security in your IDE with SonarQube Ide

    IDE extension that lets you fix coding issues before they exist!

    Discover SonarQube for IDE

    SaaS

    Code Quality and Security in the cloud with SonarQube Cloud

    Setup is effortless and analysis is automatic for most languages

    Discover SonarQube Cloud

    Self-Hosted

    Code Quality and Security Self-Hosted with SonarQube Server

    Fast, accurate analysis; enterprise scalability

    Discover SonarQube Server
  • SecretsSecrets
  • ABAPABAP
  • AnsibleAnsible
  • ApexApex
  • AzureResourceManagerAzureResourceManager
  • CC
  • C#C#
  • C++C++
  • CloudFormationCloudFormation
  • COBOLCOBOL
  • CSSCSS
  • DartDart
  • DockerDocker
  • FlexFlex
  • GitHub ActionsGitHub Actions
  • GoGo
  • GroovyGroovy
  • HTMLHTML
  • JavaJava
  • JavaScriptJavaScript
  • JSONJSON
  • JCLJCL
  • KotlinKotlin
  • KubernetesKubernetes
  • Objective CObjective C
  • PHPPHP
  • PL/IPL/I
  • PL/SQLPL/SQL
  • PythonPython
  • RPGRPG
  • RubyRuby
  • RustRust
  • ScalaScala
  • ShellShell
  • SwiftSwift
  • TerraformTerraform
  • TextText
  • TypeScriptTypeScript
  • T-SQLT-SQL
  • VB.NETVB.NET
  • VB6VB6
  • XMLXML
  • YAMLYAML
PL/SQL

PL/SQL static code analysis

Unique rules to find Bugs, Vulnerabilities, Security Hotspots, and Code Smells in your PL/SQL code

  • All rules 189
  • Vulnerability4
  • Bug45
  • Security Hotspot2
  • Code Smell138
Filtered: 17 rules found
pitfall
    Impact
      Clean code attribute
        1. GOTO should not be used to jump backwards

           Code Smell
        2. Labels should not be reused in inner scopes

           Code Smell
        3. Output parameters should be assigned

           Bug
        4. "FUNCTIONS" should not have "OUT" parameters

           Code Smell
        5. Column aliases should be defined using "AS"

           Code Smell
        6. Quoted identifiers should not be used

           Code Smell
        7. "END" statements of labeled loops should be labeled

           Code Smell
        8. In labeled loops "EXIT" should exit the label

           Code Smell
        9. Whitespace and control characters in string literals should be explicit

           Code Smell
        10. Large item lists should not be used with "IN" clauses

           Code Smell
        11. "GOTO" should not be used within loops

           Code Smell
        12. Functions should end with "RETURN" statements

           Bug
        13. "FULL OUTER JOINS" should be used with caution

           Code Smell
        14. "LOOP ... END LOOP;" constructs should be avoided

           Code Smell
        15. Boolean checks should not be inverted

           Code Smell
        16. Related "IF/ELSIF" statements and "WHEN" clauses in a "CASE" should not have the same condition

           Bug
        17. Variables should not be shadowed

           Code Smell

        Quoted identifiers should not be used

        Code Smell
        • pitfall

        Why is this an issue?

        Quoted identifiers are confusing to many programmers, as they look similar to string literals. Moreover, for maximum portability, identifiers should be self-descriptive and should not contain accents. Quoted identifiers can contain any character, which can be confusing.

        Noncompliant code example

        SET SERVEROUTPUT ON
        
        DECLARE
          "x + y" PLS_INTEGER := 0; -- Noncompliant, quoted identifiers are confusing
          x PLS_INTEGER := 40;
          y PLS_INTEGER := 2;
          "hello" VARCHAR2(42) := 'world';  -- Noncompliant
        
        BEGIN
          DBMS_OUTPUT.PUT_LINE("x + y"); -- Noncompliant, displays 0
          DBMS_OUTPUT.PUT_LINE("hello"); -- Noncompliant, confusing, displays "world" and not "hello"
        END;
        /
        

        Compliant solution

        SET SERVEROUTPUT ON
        
        DECLARE
          my_int PLS_INTEGER := 0;
          x PLS_INTEGER := 40;
          y PLS_INTEGER := 2;
          greeting VARCHAR2(42) := 'hello';
        BEGIN
          DBMS_OUTPUT.PUT_LINE(my_int);
          DBMS_OUTPUT.PUT_LINE(x + y); -- Compliant, displays 42
        
          DBMS_OUTPUT.PUT_LINE(greeting);
        END;
        /
        
          Available In:
        • SonarQube IdeCatch issues on the fly,
          in your IDE
        • SonarQube CloudDetect issues in your GitHub, Azure DevOps Services, Bitbucket Cloud, GitLab repositories
        • SonarQube ServerAnalyze code in your
          on-premise CI
          Developer Edition
          Available Since
          9.1

        © 2026 SonarSource Sàrl. All rights reserved.

        Privacy Policy | Cookie Policy | Terms of Use