Code review in PHP: what to check and how to give feedback

Online Python Trainer for Beginners

Learn Python easily without overwhelming theory. Solve practical tasks with automatic checking, get hints in Russian, and write code directly in your browser — no installation required.

Start Course

Introduction: Why Code Review is Not About "Finding Bugs"

Code review is one of the most effective tools for improving the quality of a software product. In the PHP community, where legacy "spaghetti code" and a mix of procedural and OOP styles are common, a competent review becomes especially important. However, many developers perceive it as a "bug hunt" or, worse, as a way to assert themselves. In reality, the goal of code review is to transfer knowledge, ensure codebase consistency, and prevent potential problems before they reach production.

In this article, we will break down exactly what to look for when reviewing PHP code, and how to give feedback in a way that strengthens the team rather than causing offense.

1. What to Check in PHP Code: A Reviewer's Checklist

To make the review systematic rather than chaotic, use the following checklist. It is divided into key categories.

1.1. Security

PHP is a language where security mistakes are costly. Check for:

SQL Injection: Are prepared statements (PDO or MySQLi) used? String concatenation in queries is forbidden.
XSS (Cross-Site Scripting): Is all user output escaped using htmlspecialchars() or template engines (Twig, Blade)?
CSRF Protection: Are there tokens in forms?
Server-Side Validation: Do not rely solely on client-side validation.

<?php// BAD: SQL Injection$query = "SELECT * FROM users WHERE id = " . $_GET['id'];

// GOOD: PDO with prepared statement$stmt = $pdo->prepare("SELECT * FROM users WHERE id = :id");$stmt->execute(['id' => $_GET['id']]);?>

1.2. Compliance with PSR Standards

PHP-FIG (Framework Interop Group) has developed standards that most modern projects follow. Check for:

PSR-12: Indentation (4 spaces), braces, naming conventions (camelCase for methods, snake_case for variables).
PSR-4: Autoloading classes and namespaces.

Use automated tools (PHP CodeSniffer, PHP-CS-Fixer) to avoid spending time on manual formatting.

1.3. Architecture and SOLID

Even in a small project, SOLID principles help avoid a "big ball of mud." Pay attention to:

Single Responsibility: One method/class — one task. If a method does 3 things, it's a reason for refactoring.
Dependency Injection: Do not use new inside classes; pass dependencies through the constructor.
Absence of "God Objects": A class should not know everything about the system.

1.4. Performance

Don't optimize prematurely, but obvious anti-patterns should be highlighted:

Queries inside loops (N+1 problem).
Using mysql_* functions (they were removed in PHP 7+).
Lack of database indexes for frequent queries.

2. How to Give Feedback: The Art of Constructive Criticism

Even the most correct list of comments won't be useful if the feedback sounds like "this code is terrible, rewrite it." Here are a few rules.

2.1. The "Sandwich" Rule

Start with a positive, then the comment, then support.

Positive: "Great use of interfaces, the code has become more flexible."
Comment: "But there's a potential XSS vulnerability here — let's escape the output."
Support: "Otherwise, the logic is correct. After the fix, it can be merged."