Heredoc / Nowdoc
debt(d7/e3/b3/t5)
Closest to 'only careful code review or runtime testing' (d7). The detection_hints note automated detection is 'no' and tools listed (phpcs, phpstan) can flag some patterns but not reliably catch injection via interpolated user data inside heredoc — that requires code review to spot the intent behind the variable use. The indentation issue in PHP < 7.3 would be a parse error (d1), but the injection and misuse-of-interpolation issues are silent.
Closest to 'simple parameterised fix' (e3). The quick_fix indicates switching between heredoc and nowdoc or replacing string concatenation — a small localised change within one file or block. Fixing injection misuse requires adding parameterised queries, which is a pattern replacement rather than a one-liner, but stays within a single component.
Closest to 'localised tax' (b3). Applies broadly (web, cli, queue-worker contexts) but heredoc is a string-syntax choice that affects only the specific code blocks where it's used. It doesn't impose a gravitational pull on the rest of the codebase — each usage is independent.
Closest to 'notable trap — a documented gotcha most devs eventually learn' (t5). The misconception field directly states the canonical trap: developers conflate heredoc (interpolating) and nowdoc (literal), and may unintentionally interpolate user data or fail to interpolate when they expected it. The closing-marker indentation rule in PHP < 7.3 is an additional documented gotcha.
Also Known As
TL;DR
Explanation
Heredoc syntax starts with <<<IDENTIFIER, followed by the string on new lines, closed by IDENTIFIER on its own line. Like double-quoted strings, heredocs interpolate variables and escape sequences. Nowdoc uses <<<'IDENTIFIER' and behaves like a single-quoted string — no interpolation — making it safer for embedding large blocks of raw text, SQL, or HTML without accidental variable expansion. Both are useful for readability but can obscure injection risks if user data is embedded in a heredoc without escaping.
Common Misconception
Why It Matters
Common Mistakes
- Interpolating user input directly inside heredoc SQL strings — same injection risk as regular string concatenation.
- Not knowing that nowdoc (single-quoted heredoc) disables variable interpolation — use it when interpolation is not needed.
- Indenting the closing marker in PHP < 7.3 — the closing marker must be at column 0 in older PHP.
- Using heredoc for short strings where a regular quoted string is more readable.
Code Examples
// Variable interpolation in SQL heredoc — SQLi risk:
$id = $_GET['id'];
$sql = <<<SQL
SELECT * FROM users WHERE id = $id
SQL;
// Use prepared statements — heredoc does not make this safe// Heredoc — interpolates variables (like double-quoted string)
$name = 'World';
$html = <<<EOT
<div class="greeting">
<h1>Hello, {$name}!</h1>
</div>
EOT; // closing marker indentation sets the strip amount (PHP 7.3+)
// Nowdoc — no interpolation (like single-quoted string)
$template = <<<'EOT'
Dear $name,
Your order #$orderId is confirmed.
EOT;
// $name and $orderId are NOT expanded — useful for SQL templates, regex, JS snippets