Control Statement Braces
ID |
php.control_statement_braces |
Severity |
info |
Remediation Complexity |
medium |
Remediation Risk |
low |
Remediation Effort |
medium |
Resource |
Code Smell |
Language |
Php |
Tags |
code_smell, readability |
Description
Reports an if, elseif, else, while, for, foreach or do statement whose body is a
single statement written without surrounding braces. PHP’s alternative syntax
(if (…): … endif;, while (…): … endwhile;, …) is an explicitly delimited style and
is not flagged.
Rationale
A braceless control-statement body binds only the next single statement to the condition or loop. When a second line is later added and indented to look like part of the body, it actually runs unconditionally — the classic "goto fail" defect. Braces make the body boundary explicit, keep diffs clean when statements are added, and line debug stepping up with the control flow.
<?php
// FLAW — braceless body; adding logSkip() later would run unconditionally
if ($user->isBanned()) denyAccess();
// OK — braced body keeps the boundary explicit
if ($user->isBanned()) {
denyAccess();
}
// OK — alternative syntax is explicitly delimited
if ($user->isBanned()):
denyAccess();
endif;