Rule
Avoid use of goto.
The goto statement creates unstructured control 
flow that makes code difficult to follow and maintain.

Supported languages: 45+

Introduction

goto jumps directly to arbitrary points in code, breaking the natural flow of execution. This makes reasoning about state, error handling, and performance very difficult. Maintaining code with goto increases risk of subtle bugs and unintended behavior. Structured alternatives produce predictable, readable, and maintainable code.

Why it matters

Security implications: Unstructured jumps can bypass validation or authorization checks, potentially exposing sensitive operations.

Performance impact: Complex goto chains make profiling and optimization harder, increasing the risk of inefficient execution paths.

Code maintainability: goto creates spaghetti-like control flow that is difficult to refactor or extend safely.

Attack surface: Improper jumps can unintentionally expose unsafe code paths or skip security-critical sections.

Code examples

❌ Non-compliant:

<?php
for ($i = 0; $i < 10; $i++) {
    if ($i == 3) {
        goto end;
    }
    echo "$i\n";
}

end:
echo "Jumped out!";
?>

Why it’s wrong: The goto statements create unstructured loops, making it hard to reason about flow or insert additional logic safely.

✅ Compliant:

<?php
for ($i = 0; $i < 10; $i++) {
    if ($i == 3) {
        break;
    }
    echo "$i\n";
}

echo "Jumped out!";
?>

Why this matters: Using a for loop makes the control flow explicit, predictable, and maintainable while preserving identical behavior.

❌ Non-compliant:

function process(items) {
    for (const item of items) {
        if (!item) {
            console.error('Invalid item detected');
            return false;
        }
    }
    return true;
}

Why it’s wrong: goto jumps obscure the error path and normal execution, making it difficult to follow or extend.

✅ Compliant:

function process(items) {
    for (const item of items) {
        if (!item) {
            console.error('Invalid item detected');
            return false;
        }
    }
    return true;
}

Why this matters: Structured loops and early returns make the logic clear, error handling explicit, and maintenance easier.

Conclusion

Avoid goto to maintain structured, readable, and secure code. Use loops, functions, and early returns for predictable control flow. This reduces maintenance cost, prevents subtle bugs, and ensures safe execution paths.