In PHP, why does [removed] not show a parse error?

Question

I was running the following PHP code:

?>

There were no parse errors and the output was \"

Answer 1

In PHP, you can use the script tag to open a PHP block.

So you can use

<script language="php">
    echo 'hello world';
</script>

So in your example you have mixed the normal open tag, <?php, with the closing tag, </script>. So the parser assumes that all the text after the closing script tag is normal HTML.

Read more in Escaping from HTML.

Answer 2

This must be because there are various ways of starting a block of PHP code:

• <? ... ?> (known as short_open_tag)

• <?php ... ?> (the standard really)

• <script language="php"> ... </script> (not recommended)

• <% ... %> (deprecated and removed ASP-style tag after 5.3.0)

Apparently, you can open a PHP block one way, and close it the other. Didn't know that.

So in your code, you opened the block using <? but PHP recognizes </script> as the closer. What happened was:

<?php       <----- START PHP
</script>   <----- END PHP
?>          <----- JUST GARBAGE IN THE HTML