Print HTML approaches.

unreal128

I wanted to get everyone's ideas on the best way to write out HTML while using PHP. The first approach is to break out of the PHP parser and print it like...

<?php
if (isset($var)) {
echo variable is set
} else {
?>
<div id="html stuff"></div>
<?php
}

or by stating the html code within a print call like...

print '<div id="html stuff"></div>'."\r";

The advantage of the first is better tab spacing and legibility but it seems almost insecure to keep html tags outside of PHP's domain (especially secured forms and hidden fields.) The second one seems to address this but can get cumbersome when you are concerned with detail.

What is everyone's method that they use to express HTML?

sneakyimp

i use both. i use the print approach when i'm outputting results from php variables. i use the escaping approach when i have to output a bunch of complicated HTML and i don't want to have to backslash all the quotes or whatever.

as for security, why would you think it's less secure? i'm no expert, but i can't think of any reason why it would be less secure.

unreal128

If you escaping the PHP parser, wouldn't someone be theoretically able to get the HTML output without satisfying the arguments in PHP; the server would dump the HTML on the screen.

LoganK

You're right; it's not insecure at all. It's all under PHP's domain.

sneakyimp

unreal128 wrote:
If you escaping the PHP parser, wouldn't someone be theoretically able to get the HTML output without satisfying the arguments in PHP; the server would dump the HTML on the screen.

if you want a page to display ONLY IF your conditions get satisfied, you should probably do something like this:
====THE VERY BEGINNING OF YOUR PAGE=====

<?
if ($my_conditions_are_not_met) {
  die("OH NO YOU DON'T.  YOU HAVE TO MEET MY CONDITIONS");
}
?>
this <b>html</b>won't show because of the die() command above.  other options are as follows
<?
if ($secondary_conditions_are_not_met) {
  echo "Nice try scumbag but it still doesn't work";
  Header("location: plan_b.html");
  // the exit() command will prevent anything else on this page from happening
  exit();
}
?>

etc. etc. etc.

sneakyimp

actually that header() command above will cause an error because you have already output some text in the script. sorry about that. at any rate, you see what i mean?

LoganK

Please edit your posts; I was once yelled at for double-posting!

And yes, that's valid.

if ($logged_in)
{
?>
This HTML code will only be displayed if PHP's condition is satisified, even though it is "outside" the parser.
<?php
}

unreal128

Thanks alot for the input. I will start using this method to print HTML. I created a library of common HTML markup that I do. My next thing is to setup the functions to set out tab spacing so my markup looks pretty when ppl view the source. 😉

LoganK

Great idea! Most of the time I do a few echo()'s or make a newline - but I forget that PHP ignores all that, and doesn't actually make good, pretty HTML code. Most of the time my (outputted) HTML code is a one-line disaster 😃