Currently, the WordPress Coding Standard explicitly forbids the use of the PHP short echo tag (<?=) along with the PHP The web scripting language in which WordPress is primarily architected. WordPress requires PHP 7.4 or higher short tag A directory in Subversion. WordPress uses tags to store a single snapshot of a version (3.6, 3.6.1, etc.), the common convention of tags in version control systems. (Not to be confused with post tags.) (<?). This post proposes modifying this rule to allow the use of the short echo tag for single statements.
Motivation
Prior to PHP 5.4, it was possible to disable the PHP short echo tag (<?=) using the PHP short_open_tag ini directive. This meant that scripts using this tag could not be used in code that must work across different PHP installations, because the content within those tags may be printed instead of executed, which could lead to code exposure. For this reason, the WordPress Coding Standards The Accessibility, PHP, JavaScript, CSS, HTML, etc. coding standards as published in the WordPress Coding Standards Handbook.
May also refer to The collection of PHP_CodeSniffer rules (sniffs) used to format and validate PHP code developed for WordPress according to the PHP coding standards. forbid its use.
Since PHP 5.4, the short echo tag is always available, and changing the short_open_tag directive no longer affects it. WordPress dropped support for versions prior to PHP 5.6 in 2019, and since then raised the minimum supported PHP version to 7.2. Currently, according to WordPress.org stats, the percentage of active WP installs using PHP < 5.4 is 0.4% and the percentage of sites still using WP < 5.2 is 4.0%. Therefore, it is now safe to allow the use of short echo tags.
This tag is useful as it provides a more concise syntax for outputting values in template files. WordPress developers should be allowed to use it. An issue requesting this change is the most liked issue in the WPCS A public benefit corporation and a subsidiary of the WordPress Foundation, established in 2016. repository, indicating community support.
This proposal is about allowing the use of the short echo tag for single statements, not encouraging its use, so no immediate changes are required. In practice, this means that:
- Existing open patches for Core Core is the set of software required to run WordPress. The Core Development Team builds WordPress. are not affected as either style is allowed.
- Existing WP Core code and code in official WP themes should not be updated, as both styles are permitted. A patch A special text file that describes changes to code, by identifying the files and lines which are added, removed, and altered. It may also be referred to as a diff. A patch can be applied to a codebase for testing. to enforce the use of short echo tags in all possible places will NOT be accepted.
- However, a new official theme could choose to use short echo tags if desired.
Suggested change to the handbook
The suggestion is to modify the rule titled “No Shorthand PHP Tags” as follows:
New title: No PHP short open tag
Content:
Important: Never use the PHP short open tag (`<?`). Always use the full PHP open tag (`<?php`). Using the PHP short echo tag (`<?=`) is allowed, though short echo tag snippets should only contain a single statement.
Correct:
<?php … ?>
<?= esc_html( $var ); ?>
Incorrect:
<? … ?>
How to keep short echo tags forbidden in a given project
If this proposal is accepted, but a project wants to keep the short echo tag forbidden in its own codebase, it can do so by adding the following snippet to its PHPCS PHP Code Sniffer, a popular tool for analyzing code quality. The WordPress Coding Standards rely on PHPCS. configuration after the WordPress standard is included:
<rule ref="Generic.PHP.DisallowShortOpenTag.EchoFound">
<severity>5</severity>
</rule>
References
#codingstandards, #php, #wpcs
Props @dingo_d, @garyj, and @jrf for reviewing this post.
