PHP Closing Tags

[ckhicks]

I feel like we need to discuss this again sometime: http://php.net/manual/en/language.basic-syntax.phptags.php

If a file is pure PHP code, it is preferable to omit the PHP closing tag at the end of the file. This prevents accidental whitespace or new lines being added after the PHP closing tag, which may cause unwanted effects because PHP will start output buffering when there is no intention from the programmer to send any output at that point in the script.

From the PSR-2 page:

2.2. Files - All PHP files MUST use the Unix LF (linefeed) line ending. All PHP files MUST end with a single blank line. The closing ?> tag MUST be omitted from files containing only PHP.

These seem to be in conflict and/or we don't really do 100% either direction. While we often mix HTML/PHP, the ending declaration is most likely PHP, yet our files have a lot of newlines, closing tags, or mixture of both.

Can we standardize this a bit for security's sake?

[brandoncash]

I wouldn't be concerned with anything security-wise here. Premature output I could see causing some issues, but likely only if you were working with a framework or something that has the potential of sending headers before the output needs to go out.

It's important to note that this recommendation is only for pure-PHP files; not those with PHP embedded into markup. So in a WordPress site, I would mostly expect to see the ending ?> in a template; in something like Laravel I would never expect to see it.

I would be okay with standardizing (if we follow it) but likely the standard should be to exclude it in pure-PHP files and include it in embedded PHP. I say we should include it in the embedded ones because it will be more obvious that PHP is ending and markup is beginning, plus you're already outputting to the buffer so there's no worries about prematurely sending any data.

And in lieu of having two standards for both uses, excluding the ending tag is always safer.