PHP Linter Online — Check PHP Syntax & Code Issues
Paste your PHP code and get instant heuristic checks: likely missing semicolons, unbalanced brackets, short open tags, deprecated mysql_* calls, eval() risks and style issues — with severity levels and exact line numbers. Nothing is uploaded; everything runs in your browser.
1Paste your PHP code
2Lint results
3Try an example
Each example loads real PHP code into the editor and runs the linter — the badge shows what the linter is expected to find.
4Lint rules reference
The eight checks this linter performs, each with a severity level and the exact line where the problem was spotted.
| Rule | Severity | What it checks |
|---|---|---|
| short-open-tag | error | <? instead of <?php — breaks on servers with short_open_tag=Off. |
| missing-semicolon | error | Heuristic: a line that looks like a complete statement but lacks a trailing ;. |
| unbalanced-delimiter | error | Mismatched or unclosed {} () [] — strings and comments are ignored. |
| deprecated-mysql | warning | mysql_* functions — removed entirely in PHP 7.0; use mysqli or PDO. |
| eval-usage | warning | eval() executes a string as code — a code-injection risk. |
| error-reporting-off | warning | error_reporting(0) hides every error, warning and notice. |
| closing-tag | info | Closing ?> at the end of a pure-PHP file — PSR-12 says omit it. |
| mixed-indentation | warning | Tabs and spaces mixed for indentation in the same file. |
5Frequently asked questions
No. This is a heuristic, pattern-based linter that runs entirely in your browser. It catches common mistakes (missing semicolons, unbalanced brackets, short open tags, deprecated mysql_* calls, eval() usage), but it does not parse PHP like the real engine does. Always confirm with php -l on your server before deploying, and use PHPStan or Psalm for deep static analysis.
Eight rules: (1) short open tags <? that may be disabled on the server, (2) likely missing semicolons at the end of statements, (3) unbalanced or mismatched braces, parentheses and square brackets, (4) deprecated mysql_* functions removed in PHP 7, (5) eval() calls which are a code-injection risk, (6) error_reporting(0) which hides all errors, (7) a closing ?> tag at the end of pure-PHP files (PSR-12 recommends omitting it), and (8) mixed tab/space indentation.
Never. The linter only reads your source code as text and matches patterns against it. No PHP is executed, no code is evaluated, and nothing is sent to any server. It is 100% static analysis running locally in your browser via JavaScript.
Yes, especially the missing-semicolon rule, which is a heuristic: it flags lines that look like complete statements without a trailing semicolon. Unusual but valid formatting (for example, a line ending without a semicolon right before a closing ?> tag) can be misread. Treat each finding as a hint, inspect the flagged line, and dismiss it if your code is intentional.
No. Everything happens locally in your browser tab using JavaScript. Your code is never uploaded, logged, stored, or transmitted anywhere. You can even disconnect from the internet after the page loads and the linter keeps working.
PSR-12 (the PHP coding standard) recommends omitting the closing ?> tag in files that contain only PHP. A stray ?> followed by an accidental newline or space sends output to the browser, which causes the classic Cannot modify header information - headers already sent error when you later call header() or session_start().
The short open tag <? only works when the short_open_tag setting is enabled in php.ini, and it is disabled on many shared hosts by default. Code written with <? may render as plain text on such servers. The full <?php tag always works, and <?= (short echo) has been always available since PHP 5.4, so neither is flagged.
Free tool by NRTechStudio