What is the meaning of

Question

Possible Duplicate:
Reference - What does this symbol mean in PHP?

I am try somewhat unsuccessfully to run a test script for the PHP-Nemid. I am trying to work my way through the code, but have become a little lost when it gets to the render function, which makes use of the file "nemid.tpl.php". When I run the script the template file is literally written to the screen, in the sense that rather then PHP filling in the relevant template variables, it instead just writes the literal PHP code. in other words <?= $some_var_value appears just as that in the rendered page's source code.

Another thing I don't understand is what is the meaning of the <?= in the template file. This is not a PHP construct I am familiar with. At first I thought I should change <?= $some_var to <? print $some_var, but in this case it still prints the literal PHP code to the page.

Would be grateful if someone could offer me some insight into what is going on here.

Template file (nemid.tpl.php)

<html>
<body>
        <form id="signedForm" name="signedForm" method="post" action="<?= $_SERVER['PHP_SELF'] ?>">
                <div id="applet">
<!-- div ID used for overlay / modal-box -->
                    <applet name="DANID_DIGITAL_SIGNATUR" tabindex="1" archive="<?= $ServerUrlPrefix ?>/bootapplet/1234567" code="dk.pbs.applet.bootstrap.BootApplet" width="200" height="250" mayscript="mayscript" style="visibility: visible; ">
                        <param name="ServerUrlPrefix" value="<?= $ServerUrlPrefix ?>"> 
                        <param name="ZIP_BASE_URL" value="<?= $ZIP_BASE_URL ?>">
                        <param name="ZIP_FILE_ALIAS" value="<?= $ZIP_FILE_ALIAS ?>">
                        <param name="log_level" value="<?= $log_level ?>"> 
                        <param name="paramcert" value="<?= $paramcert ?>">
                        <param name="signproperties" value="<?= $signproperties ?>"> 
                        <param name="paramsdigest" value="<?= $paramsdigest ?>"> 
                        <param name="signeddigest" value="<?= $signeddigest ?>"> 
                        <param name="MAYSCRIPT" value="<?= $MAYSCRIPT ?>"> 
                    </applet>
                </div>
            <input type="hidden" name="signature">
            <input type="hidden" name="result"> 
        </form>
<script type="text/javascript">
    function onLogonOk(signature) {
        document.signedForm.signature.value=signature;
        document.signedForm.result.value='ok';
        document.signedForm.submit();
    }
    function onLogonCancel() {
        document.signedForm.result.value='cancel';
        document.signedForm.submit();
    }
    function onLogonError(emsg) {
        document.signedForm.result.value=emsg;
        document.signedForm.submit();
    }
</script> 
</body>
</html>

Render function

I have tested the contents of $vars in the below function and can confirm that the extracted variables required by the template are present.

function render($template, $vars = array())
{
    extract($vars);
    ob_start();
    include('../templates/' . $template . '.tpl.php');
    $content = ob_get_contents();
    ob_end_clean();
    return $content;
}

David Harris · Accepted Answer · 2012-12-31T08:07:24.853

4

<?= is a short open tag for echo.

<?='Hello world'?>

Would output Hello world

And to answer why it's not parsing, what's the filename? Do you have PHP installed and configured to work with your Apache/Nginx/other server?

Another thing to note is that the template you have utilizes PHP_SELF

PHP_SELF actually opens up many vulnerabilities and is not recommended to be used. You could use the alternative:

basename(__FILE__);

edited Dec 31 '12 at 08:07

answered Dec 31 '12 at 08:00

David Harris

2,697
15
27

Do note its not wise to use in general as some servers have the option turned off. – Sir Dec 31 '12 at 08:01
1

It's perfectly fine in all ~5.4 installations, they are always enabled in new versions. – David Harris Dec 31 '12 at 08:02
1

I frequently see people say its frowned upon, never really knew why. – Sir Dec 31 '12 at 08:04
Because they're not enabled on some hosts in older versions -- Duh :P – David Harris Dec 31 '12 at 08:05
To be absolutely clear, the short open tag ` ` can still be disabled on PHP 5.4 (to avoid collisions with ` – Matthew Dec 31 '12 at 08:08
Yes, Matthew, that's what I meant :) – David Harris Dec 31 '12 at 08:09
[Here](http://markjaquith.wordpress.com/2009/09/21/php-server-vars-not-safe-in-forms-or-links/) is a simple example with the `PHP_SELF`'s security issue. – Alain Tiemblo Dec 31 '12 at 08:12

score 1 · Answer 2 · edited Dec 31 '12 at 08:07

1

<?=

is php shorthand for

  <?php echo

edited Dec 31 '12 at 08:07

Alain Tiemblo

36,099
17
121
153

answered Dec 31 '12 at 08:01

Laurence

58,936
21
171
212

score 0 · Answer 3 · answered Dec 31 '12 at 08:05

0

<?=

is used as a shorthand, a lot by template makers as they are using HTML for most of the file and just printing out variables in PHP as needed.

My server has that turned on but it can be turned off or not used in older versions.

answered Dec 31 '12 at 08:05

donlaur

1,269
1
12
21

the short-tatgs `` are deprecated. since PHP 5.4 `=` is _always_ available, regardless of the ini settings – Elias Van Ootegem Dec 31 '12 at 08:18
True, but we don't know what version of PHP they are running. – donlaur Dec 31 '12 at 08:24

What is the meaning of

3 Answers3