← Home ← Codex ← DEBT ← Engine
Browse by Category
+ added · updated 7d
← Back to glossary

Short Open Tags History & Why to Avoid

PHP PHP 3.0+ Beginner
debt(d3/e1/b3/t5)
d3 Detectability Operational debt — how invisible misuse is to your safety net

Closest to 'default linter catches the common case' (d3). The detection_hints list phpcs and rector — both widely used default-level PHP tooling — and the code_pattern `^<\?[^p=]` is simple enough that phpcs/PSR-1 sniffs catch it automatically in a standard CI pipeline.

e1 Effort Remediation debt — work required to fix once spotted

Closest to 'one-line patch or single-call swap' (e1). The quick_fix is explicit: replace all `<?` with `<?php`. This is a mechanical find-and-replace, automatable with rector or a sed one-liner, with no logic changes required.

b3 Burden Structural debt — long-term weight of choosing wrong

Closest to 'localised tax' (b3). The issue applies to web and cli contexts broadly, but the fix is syntactic and confined to file headers/open tags. It doesn't impose an ongoing architectural weight; once replaced, the debt is gone. Slightly elevated from b1 because inconsistent mixing across many files in a legacy codebase does slow down reviewers.

t5 Trap Cognitive debt — how counter-intuitive correct behaviour is

Closest to 'notable trap' (t5). The misconception field states it exactly: developers assume `<?=` is the same as `<?` and therefore believe all short tags are affected by `short_open_tag=Off`. In reality `<?=` has been standardised since PHP 5.4 and is always available. This is a documented, well-known gotcha that most PHP developers eventually learn, matching the t5 anchor.

About DEBT scoring →

TL;DR

PHP's short tags (<? ?> and <?= ?>) have been problematic since PHP 3 — disabled by many hosting providers, conflicting with XML, and inconsistent across environments.

Explanation

PHP has always supported <? ?> (short_open_tag) and <?= ?> (short_echo_tag). Problems: (1) short_open_tag=Off on many PHP installs — code breaks silently. (2) <?xml conflicts with PHP short tags when short_open_tag=On. (3) Different defaults across PHP versions. PHP 5.4 made <?= always available regardless of short_open_tag. PHP 7+ recommends always using <?php. In templates, <?= $var ?> is acceptable and standardised (Blade, Twig use it). But <? for code blocks should always be avoided. PSR-1 requires <?php or <?=.

Common Misconception

<?= is the same as <? — <?= (short echo) is standardised since PHP 5.4 and always available. <? (general short open tag) depends on the ini setting.

Why It Matters

Using short tags causes code to render as plain text instead of executing on servers where short_open_tag=Off — a common debugging puzzle for newcomers.

Common Mistakes

  • Using <? instead of <?php for code blocks.
  • Not knowing <?= is always available since PHP 5.4.
  • Mixing short tags and full tags inconsistently.

Code Examples

✗ Vulnerable
<? // Breaks on servers with short_open_tag=Off
$users = getUsers();
foreach ($users as $user): ?>
    <p><?=$user->name?></p>
✓ Fixed
<?php // Always works
$users = getUsers();
foreach ($users as $user): ?>
    <p><?= htmlspecialchars($user->getName()) ?></p>
<?php endforeach; ?>

Added 23 Mar 2026
Views 108
Rate this term
No ratings yet
🤖 AI Guestbook educational data only
| |
Last 30 days
1 ping W 1 ping T 0 pings F 0 pings S 0 pings S 0 pings M 0 pings T 0 pings W 0 pings T 4 pings F 2 pings S 0 pings S 1 ping M 1 ping T 1 ping W 0 pings T 0 pings F 2 pings S 0 pings S 2 pings M 1 ping T 0 pings W 0 pings T 0 pings F 0 pings S 1 ping S 0 pings M 1 ping T 0 pings W 0 pings T
No pings yet today
No pings yesterday
Amazonbot 14 SEMrush 13 PetalBot 9 ChatGPT 7 Ahrefs 7 Unknown AI 5 Perplexity 4 Google 3 Scrapy 3 Twitter/X 3 Applebot 2 Bing 2 Meta AI 1 Brave Search 1
crawler 68 crawler_json 3 your_contextpost 1 pre-tracking 2
🧱 FUNDAMENTALS — new to this? Start with the ground floor.
PHP php A server-side scripting language that generates web pages and APIs — the code runs on the server, and only its output (usually HTML or JSON) reaches the browser.

PHP is often the first server-side language people meet, and understanding its execution model — script starts fresh on every request, no memory between requests — explains most of how the web backend works: sessions, databases, and caching all exist to bridge that per-request amnesia.

💡 Start with PHP 8.x, declare(strict_types=1), and PDO — skip any tutorial that mentions mysql_query().

Ask Codex about PHP →
DEV INTEL Tools & Severity
🟢 Low ⚙ Fix effort: Low
⚡ Quick Fix
Replace all <? with <?php. Keep <?= for output (standardised in PHP 5.4). Follow PSR-1.
📦 Applies To
PHP 3.0+ web cli
🔗 Prerequisites
🔍 Detection Hints
^<\?[^p=]
Auto-detectable: ✓ Yes phpcs rector
🤖 AI Agent
Confidence: High False Positives: Low ✓ Auto-fixable Fix: Low Context: File


✓ schema.org compliant