Code Review in PHP: What to Check and How to Give Feedback to Beginners

Code Review in PHP: What to Check and How to Give Feedback

Code review is not just a formality, but a powerful tool for team growth and improving code quality. For beginner PHP developers, the review process often seems daunting: "What if I miss a bug?", "How do I tell a colleague their code is bad?". In this article, we will break down what to look for when reviewing PHP code and how to give feedback that is helpful, not hurtful.

1. What to Check in PHP Code: A Checklist for the Beginner Reviewer

Let's start with the technical side. Here are the main categories to check during a PHP project code review:

\n
• Security — the most critical area. Check for SQL injections, XSS vulnerabilities, and unprotected input data.
\n
• Coding Standards Compliance — PSR-1, PSR-12 (or your team's standards). This ensures readability and consistency.
\n
• Performance — avoid unnecessary database queries, suboptimal loops, and heavy operations inside loops.
\n
• Architecture and Logic — adherence to SOLID, DRY, KISS principles. Is code duplicated? Is the logic overly complex?
\n
• Error Handling — are there try-catch blocks? Are exceptions logged correctly? Are errors being suppressed?
\n
• Typing and Strictness — does the code use strict_types? Are argument and return types correctly specified?
\n

Here is an example of bad and good code from a security perspective:

<?php\n// BAD: vulnerable to SQL injection\n$query = "SELECT * FROM users WHERE id = " . $_GET['id'];\n$result = mysqli_query($conn, $query);\n\n// GOOD: using prepared statements\n$stmt = $conn->prepare("SELECT * FROM users WHERE id = ?");\n$stmt->bind_param("i", $id);\n$id = (int)$_GET['id'];\n$stmt->execute();\n$result = $stmt->get_result();\n?>

2. How to Give Feedback: Principles of Constructive Review

The technical part is only half the battle. The other half is the ability to communicate your comments in a way that makes the code author want to fix them, rather than feeling offended or defensive.

Basic rules for feedback:

\n
• Talk about the code, not the person. Instead of "You wrote terrible code," say "There is a potential vulnerability here, let's discuss how to fix it."
\n
• Use "I" statements. "I see that an error could occur here because..." sounds softer than "You made a mistake."
\n
• Explain the "why". Not just "Use prepared statements," but "Prepared statements protect against SQL injections because they separate data from the query code."
\n
• Offer alternatives. Instead of "This is bad," show how it could be done better.
\n
• Praise the good. Don't forget to note successful solutions: "Great idea to extract validation into a separate class!"
\n

Example of a constructive comment:

<!-- BAD comment -->\n<!-- Why aren't you using strict typing? That's basic! -->\n\n<!-- GOOD comment -->\n<!-- I suggest adding declare(strict_types=1) at the beginning of the file. \nThis will force PHP to check types strictly and prevent accidental \nimplicit conversions that could lead to bugs. -->

3. Common PHP Code Mistakes to Look for During Review

Here is a list of frequent issues found in beginner PHP developers' code. Pay special attention to these:

\n
• Lack of input validation. Never trust $_GET, $_POST, $_REQUEST, $_FILES.
\n
• Global variables and superglobal arrays inside functions. This breaks encapsulation and com