How to Use SonarLint for Real‑Time PHP Code Quality Checks

SonarLint is a free open‑source IDE extension that detects quality and security problems while you write code, offering real‑time feedback and clear remediation guidance.

Installation

You can install SonarLint directly from the plugin marketplace of popular IDEs, for example PHPStorm.

After installation, restart the IDE to activate the plugin.

Usage

1. Problem code example

<?php
$a = 2024;

if ($a) return ['year' => 2024];

Press ctrl +shift+s to scan the current file, or use the right‑click context menu.

Scan results

Solution

<?php
$a = 2024;

if ($a) {
    return ['year' => 2024];
}

2. For‑loop stop condition should be invariant

Non‑compliant code

for ($i = 0; $i < 10; $i++) {
  echo $i;
  if (condition) {
    $i = 20;
  }
}

Scan results

Solution

for ($i = 0; $i < 10; $i++) {
    echo $i;
}

3. All catch blocks must be reachable

In some cases a catch block becomes dead code because it can never catch an exception. This happens when a base‑class handler precedes a derived‑class handler, or when multiple catch blocks target the same exception type.

If a handler for a base class appears before a handler for a subclass, the subclass handler is never executed.

When several catch blocks try to catch the same exception class, only the first one runs.

Non‑compliant example

class MyException extends Exception {}
class MySubException extends MyException {}

try {
  doSomething();
} catch (MyException $e) {
  echo $e;
} catch (MySubException $e) { // Noncompliant: MySubException is a subclass of MyException
  echo "Never executed";
}

Compliant solution

class MyException extends Exception {}
class MySubException extends MyException {}

try {
  doSomething();
} catch (MySubException $e) {
  echo "Executed";
} catch (MyException $e) {
  echo $e;
}

4. Switch statements should include a default clause

Defensive programming requires a default clause to handle unexpected values, even when all current enum cases are covered, because the enum may be extended later.

Non‑compliant example

switch ($param) {  // missing default clause
  case 0:
    do_something();
    break;
  case 1:
    do_something_else();
    break;
}

Compliant solution

switch ($param) {
  case 0:
    do_something();
    break;
  case 1:
    do_something_else();
    break;
  default:
    error();
    break;
}