Proposal to Permit PHP Short Echo Tags in WordPress Coding Standards

A proposal is currently under consideration to modify the WordPress Coding Standards, specifically regarding the use of the PHP short echo tag (<?=). Currently, the standards explicitly prohibit both the PHP short echo tag and the general PHP short tag (<?). This proposal advocates for allowing the use of the short echo tag for single statements.

Motivation

Historically, prior to PHP 5.4, the PHP short echo tag (<?=) could be disabled using the short_open_tag INI directive. This presented a risk: scripts relying on <?= might display raw code instead of executing it on servers where this directive was off, leading to code exposure. For this reason, the WordPress Coding Standards (WPCS) explicitly forbade its use.

However, the landscape has changed significantly. Since PHP 5.4, the short echo tag is consistently available, and the short_open_tag directive no longer affects its functionality. WordPress ceased support for PHP versions prior to 5.6 in 2019 and has since elevated its minimum supported PHP version to 7.2. Data from WordPress.org indicates that a negligible percentage (0.4%) of active WordPress installations still run PHP versions older than 5.4. Consequently, it is now safe to permit the use of short echo tags.

The short echo tag offers a more concise and readable syntax for outputting values, particularly beneficial within template files. There is clear community support for this change, evidenced by an issue requesting this modification being the most liked in the WPCS repository.

This proposal aims to allow, rather than enforce, the use of the short echo tag for single statements. This implies that:

• Existing open patches for WordPress Core will remain unaffected, as both coding styles will be considered valid.
• Current WordPress Core code and official themes will not require updates; both existing full <?php echo ... ?> and the proposed <?= ... ?> styles will be acceptable. A patch to aggressively enforce short echo tags throughout all possible locations would not be accepted.
• Nevertheless, new official WordPress themes would have the option to adopt short echo tags if their developers choose to do so.

Suggested Change to the Handbook

The proposal suggests modifying the existing rule titled "No Shorthand PHP Tags." The revised rule would be titled "No PHP short open tag" with updated content:

"Important: Never use the PHP short open tag (<?). Always use the full PHP open tag (<?php). Using the PHP short echo tag (<?=) is allowed, though short echo tag snippets should only contain a single statement."

Correct Usage Examples:

<?php ... ?>
<?= esc_html( $var ); ?>

Incorrect Usage Example:

<? ... ?>

How to Prohibit Short Echo Tags in a Specific Project

Should this proposal be accepted, projects wishing to maintain a strict prohibition against short echo tags within their own codebase can achieve this by adding the following snippet to their PHP CodeSniffer (PHPCS) configuration, after the WordPress standard has been included:

<rule ref="Generic.PHP.DisallowShortOpenTag.EchoFound">
    <severity>5</severity>
</rule>

References

• Related issue in the WPCS repository: WordPress/WordPress-Coding-Standards#1642