note 88096 added to language.basic-syntax.phpmode
| From: | phpcoder at CPE00609791e69c-CM0014e8b571b2 dot cpe dot net dot cable dot rogers dot com | Date: | Sat, 10 Jan 2009 07:14:45 +0000 |
| Subject: | note 88096 added to language.basic-syntax.phpmode | ||
| Groups: | php.notes | ||
| Request: | Send a blank email to php-notes+get-149023@lists.php.net to get a copy of this message | ||
Some graphical HTML editors (and most web browsers) don't explicitly recognize the <?php
?> tags. When opening a PHP file with a graphical HTML editor to design the page layout, chunks
of PHP code can appear as literal text if the PHP code contains a greater-than symbol (>).
Example:
<html>
<body>
Unsafe-<?php
if (4>3) {
echo "PHP-";
}
?>embedding
</body>
</html>
When executed, it should display this:
Unsafe-PHP-embedding
However, when opened with an HTML editor, the on-screen result might look like this:
Unsafe-3) { echo "PHP-"; } ?>embedding
...and further, the PHP code after the great-than operator (>) is at risk of being corrupted by
the HTML editor's text formatting algorithms.
PHP code with greater-than symbols can be safely embedded into HTML by surrounding it with a pair of
HTML-style comment delimiters + fake HTML end & start stags, as PHP-style comments.
Example:
<html>
<body>
Safe-<?php
/*><!--*/
if (4>3) {
echo "PHP-";
}
/*--><?*/
?>embedding
</body>
</html>
When executed, it should display this:
Safe-PHP-embedding
And when opened with an HTML editor (or even opened directly with a web browser), it should display
this:
Safe-embedding
An HTML editor will see the surrounded PHP code as an HTML comment, and (hopefully) leave it as-is.
Finally, any PHP code with a hard-coded string containing the HTML end-of-comment delimiter (-->)
should be reconstructed to be syntactically identical, while avoiding the literal "-->"
sequence in the PHP code.
For example, this:
<?php
/*><!--*/
$a = "-->";
/*--><?*/
?>
...can safely be changed to any of these:
<?php
/*><!--*/
$a = "\55->";
/*--><?*/
?>
<?php
/*><!--*/
$a = "--\76";
/*--><?*/
?>
<?php
/*><!--*/
$a = '--'.'>';
/*--><?*/
?>
----
Server IP: 216.235.13.26
Probable Submitter: 99.228.195.19
----
Manual Page -- http://www.php.net/manual/en/language.basic-syntax.phpmode.php
Edit -- https://master.php.net/note/edit/88096
Del: integrated -- https://master.php.net/note/delete/88096/integrated
Del: useless -- https://master.php.net/note/delete/88096/useless
Del: bad code -- https://master.php.net/note/delete/88096/bad+code
Del: spam -- https://master.php.net/note/delete/88096/spam
Del: non-english -- https://master.php.net/note/delete/88096/non-english
Del: in docs -- https://master.php.net/note/delete/88096/in+docs
Del: other reasons-- https://master.php.net/note/delete/88096
Reject -- https://master.php.net/note/reject/88096
Search -- https://master.php.net/manage/user-notes.php