AI code review checklist for PHP

A one-page checklist for reviewing a PR that came out of an AI assistant. Open it in a tab, open the PR in another, work through. The small grey tag next to each item is the tool that catches it automatically — items without a tag need a human eye.

Progress saves to this browser. Refresh-safe.

Security

• User input goes through Input::get() / equivalent — no raw $_POST / $_GET in app code. audit Rule 02

• Every state-changing form has a CSRF token (tokenHere() on UserSpice). audit Rule 03

• Every state-changing handler verifies the CSRF token with Token::check() / hash_equals(). audit Rule 03

• SQL queries use prepared statements with bound parameters — no string concatenation, no sprintf. Semgrep / Psalm

• Identifiers (table / column names, ORDER BY, LIMIT) are whitelisted, not interpolated from user input. audit Rule 04

• HTML output uses safeReturn() / htmlspecialchars(). JS-context values use safeJsonEncodeForJs(). audit Rule 06

• Redirects from user input use Redirect::sanitized() or a whitelist — never header('Location: ' . $_GET['next']). audit Rule 07

• Random tokens come from random_bytes() / Hash::unique() — never md5(uniqid()) or mt_rand(). audit Rule 08

• Login / register / password-reset endpoints have rate limiting. audit Rule 10

• Every protected page calls securePage() at the top.

• Every restricted page also calls hasPerm() at the top, after securePage().

• AJAX endpoints live in parsers/ and re-check CSRF and auth — they are separate requests. audit Rule 12

• No hardcoded secrets — API keys, DB passwords, signing keys all read from env or a gitignored config. Gitleaks

• No eval() or unserialize() on data the user can influence. Semgrep / Psalm

• No $_SERVER['HTTP_HOST'] direct access used in a security context — use Server::getHost() with trusted proxies. audit Rule 05

Correctness

• $db->insert() / ->update() are not assigned to $newId — they return bool. ID via $db->lastId().

• Input::exists('fieldname') is not used as a presence check — the argument is a type ('post' / 'get'), not a field name.

• The CSRF field name matches between form and handler — UserSpice uses name="csrf", not csrf_token.

• Input::get('x') is compared to '' for "missing", not to false / null.

• AJAX endpoints are inside a parsers/ subfolder — UserSpice's URL rewriter routes around them otherwise.

• Helper signatures match what the framework actually ships — run /userspice-helper-lookup if unsure.

• IN(?,?,?) clauses generate one placeholder per array element — not one placeholder for the whole array.

• No literal ?> inside a single-line // comment — it exits PHP mode and breaks every function defined below.

• Error cases are handled or logged, not silently swallowed with @. PHPStan / Psalm

• Conditionals match the actual API — no $user->hasPermission() (it's the global hasPerm()).

• Form is "sticky" on validation failure — value="<?= safeReturn(Input::get('name')) ?>".

Maintainability

• Internal URLs use <?= $us_url_root ?> — no hardcoded leading slashes, no relative ../ paths.

• Filesystem includes use $abs_us_root . $us_url_root . 'path/...' — not __DIR__, dirname(__FILE__), or hardcoded absolute paths.

• No reassignment of framework globals ($db, $user, $config, $settings) at global scope. audit Rule 11

• Custom files are in usersc/ for overrides, at the project root for new pages — never in users/.

• No duplication of logic that already exists as a framework helper. Check before re-implementing.

• Audit logging exists for security-relevant actions (login, password change, admin actions, permission changes).

• Comments explain why, not what — the diff already shows what.

• No accidental shadowing of framework helpers (usersc/includes/custom_functions.php loads first; functions there silently override core).

• AJAX endpoints return JSON only — Content-Type: application/json, no stray echos before the JSON, no leaked HTML on error.

• The new code passes /userspice-audit with no HIGH findings. /userspice-audit

• The new code passes the scanner (Security Scanner or your existing stack) with no new findings. Semgrep / Psalm

---

That's the list. If anything came up flagged that the AI assistant generated — fix it before merging. The cheapest moment to fix vibe-coded bugs is before they're in the main branch.

If you keep coming back to the same line items, that's signal — the assistant is making the same mistake repeatedly because it lacks context. Push the recurring fixes back into the project's CLAUDE.md (or the AI Prompts plugin's custom_prompts/ folder) so the next prompt has the benefit of the last review.

Want a hands-on review?

We do per-PR and retainer code review for PHP / UserSpice projects. Architecture, security, footguns, performance — explained clearly, not just flagged. Send the repo link below.

Website (leave blank)

Want a senior PHP set of eyes on your repo or pull request? Send the link and we will review it the way we would our own code.

Name * Email *

Company (optional) Timeline — Select — ASAP / urgent Within 2 weeks 1–3 months No rush — exploring

Tell us about your project * Please enter at least 20 characters.

Send inquiry We reply within 1–2 business days.