← CodeClarityLab Home
Browse by Category
+ added · updated 7d
← Back to glossary

Short Open Tag (<?)

php PHP 5.0+ Beginner

Also Known As

<? tag short_open_tag short PHP tag

TL;DR

Using <? instead of <?php — short tags are disabled by default in many PHP configurations and conflict with XML processing instructions.

Explanation

PHP supports three open tags: <?php (always works), <?= (short echo, always works since PHP 5.4), and <? (short open tag, requires short_open_tag=On in php.ini). The <? short tag conflicts with XML processing instructions <?xml and is disabled in many shared hosting environments, Docker images, and production configurations. PSR-1 mandates only <?php and <?= tags. Rector can automatically expand <? to <?php across a codebase.

Common Misconception

Short tags work everywhere because my dev machine has them enabled — production servers, Docker images, and shared hosts commonly disable short_open_tag; code that depends on it fails silently or with parse errors.

Why It Matters

A file with <? short tags silently fails to execute as PHP when short_open_tag is off — the PHP code is served as raw text to the browser, exposing source code including credentials.

Common Mistakes

  • Using <? throughout a legacy codebase that runs fine locally but fails on the production server.
  • <?= is a short echo tag — unlike <?, this is always available since PHP 5.4 and is PSR-1 compliant.
  • Mixing <?php and <? in the same file.
  • Not running Rector's ShortOpenTagSniff to find all occurrences automatically.

Code Examples

✗ Vulnerable
<? // Short tag — requires short_open_tag=On
$user = getUser($id);
?>
<p>Hello <? echo $user->name; ?></p>

<? if ($user->isAdmin()): ?>
    <p>Admin panel</p>
<? endif; ?>
✓ Fixed
<?php // Always works — PSR-1 compliant
$user = getUser($id);
?>
<p>Hello <?= htmlspecialchars($user->name) ?></p>

<?php if ($user->isAdmin()): ?>
    <p>Admin panel</p>
<?php endif; ?>

Added 16 Mar 2026
Edited 22 Mar 2026
Views 17
Rate this term
No ratings yet
🤖 AI Guestbook educational data only
| |
Last 30 days
0 pings F 0 pings S 2 pings S 0 pings M 0 pings T 1 ping W 0 pings T 0 pings F 0 pings S 1 ping S 0 pings M 1 ping T 0 pings W 0 pings T 0 pings F 0 pings S 1 ping S 0 pings M 0 pings T 0 pings W 1 ping T 0 pings F 0 pings S 1 ping S 0 pings M 0 pings T 0 pings W 0 pings T 0 pings F 0 pings S
No pings yet today
No pings yesterday
Amazonbot 6 Unknown AI 3 Perplexity 2 Google 1 ChatGPT 1 Ahrefs 1
crawler 13 pre-tracking 1
DEV INTEL Tools & Severity
🟡 Medium ⚙ Fix effort: Low
⚡ Quick Fix
Never use <? short tags in new code — they conflict with XML and may be disabled (short_open_tag=Off); PSR-1 requires <?php or <?= only; <?= is always available since PHP 5.4 regardless of short_open_tag
📦 Applies To
PHP 5.0+ web cli
🔗 Prerequisites
🔍 Detection Hints
<? without php after; short tags in template files; <% ASP-style tags legacy; PHP files using short echo tag <? echo instead of <?=
Auto-detectable: ✓ Yes phpcs php-cs-fixer rector
⚠ Related Problems
🤖 AI Agent
Confidence: High False Positives: Low ✓ Auto-fixable Fix: Low Context: Line

✓ schema.org compliant