0

I recently found a couple of PHP server where short_open_tag is set to off. I would like to know if there is any security reason to set short_open_tag off.

2

There are security reasons for never using short tags in your code.

Your code could easily end up on a server with short tags off, through a migration or perhaps some misconfiguration. If you have been using short tags to mark what is PHP code and what is not, suddenly your PHP will be interpreted as content and served as is. That could leak all sorts of secrets.

But does this mean you should turn the feature off? On the one hand, it's a great way of stopping your developers from using them. On the other hand, if you move in code from somewhere else it exposes you to the problem mentioned above.

There is discussion within the PHP community about deprecating short tags.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.