Reliable header sending mechanism in php 6

php.internals

Ezra Nugroho

18 years ago
Php Developers, Can I ask for the following support, at least to begin conversation about it if it hasn't been done before. Currently, the header() function still carries the following warning in its online documentation: "Remember that header() must be called before any actual output is sent, either by normal HTML tags, blank lines in a file, or from PHP. It is a very common error to read code with include(), or require(), functions, or another file access function, and have spaces or empty lines that are output before header() is called. The same problem exists when using a single PHP/HTML file." This is quite annoying since this makes header() or setcookie() calls to be unreliable. I am aware that it can be done more reliably by turning the output buffering on. This is less of an issue if you are writing your own webapp. However, this is much more difficult if a person writes a library for other people's consumptions. The library cannot enforce output buffering in the webapp. Can we please give it a thought in PHP 6? Maybe by turning output buffering on by default, or even by enforcing output buffering. In Java, you can get the request object, and the response object of a web request. I find this very useful and reliable. Any thoughts or comments about this? Thank you, Ezra

Rasmus Lerdorf

18 years ago
Ezra Nugroho wrote:
> Can I ask for the following support, at least to begin conversation > about it if it hasn't been done before. > > Currently, the header() function still carries the following warning in > its online documentation: > > "Remember that header() must be called before any actual output is sent, > either by normal HTML tags, blank lines in a file, or from PHP. It is a > very common error to read code with include(), or require(), functions, > or another file access function, and have spaces or empty lines that are > output before header() is called. The same problem exists when using a > single PHP/HTML file." > > This is quite annoying since this makes header() or setcookie() calls to > be unreliable. > > I am aware that it can be done more reliably by turning the output > buffering on. This is less of an issue if you are writing your own > webapp. However, this is much more difficult if a person writes a > library for other people's consumptions. The library cannot enforce > output buffering in the webapp. > > Can we please give it a thought in PHP 6? Maybe by turning output > buffering on by default, or even by enforcing output buffering. > > In Java, you can get the request object, and the response object of a > web request. I find this very useful and reliable. > > Any thoughts or comments about this?
There is nothing unreliable about is as far as I am concerned. You have full control over output buffering from your script. Forcing people to buffer output by default will mean higher memory usage and higher latency for existing scripts with no gain given their code is working today. -Rasmus

Ezra Nugroho

18 years ago
On Tue, 2007-11-27 at 14:50 +1000, Rasmus Lerdorf wrote:
> Ezra Nugroho wrote: > > Can I ask for the following support, at least to begin conversation > > about it if it hasn't been done before. > > > > Currently, the header() function still carries the following warning in > > its online documentation: > > > > "Remember that header() must be called before any actual output is sent, > > either by normal HTML tags, blank lines in a file, or from PHP. It is a > > very common error to read code with include(), or require(), functions, > > or another file access function, and have spaces or empty lines that are > > output before header() is called. The same problem exists when using a > > single PHP/HTML file." > > > > This is quite annoying since this makes header() or setcookie() calls to > > be unreliable. > > > > I am aware that it can be done more reliably by turning the output > > buffering on. This is less of an issue if you are writing your own > > webapp. However, this is much more difficult if a person writes a > > library for other people's consumptions. The library cannot enforce > > output buffering in the webapp. > > > > Can we please give it a thought in PHP 6? Maybe by turning output > > buffering on by default, or even by enforcing output buffering. > > > > In Java, you can get the request object, and the response object of a > > web request. I find this very useful and reliable. > > > > Any thoughts or comments about this? > > There is nothing unreliable about is as far as I am concerned. You have > full control over output buffering from your script. Forcing people to > buffer output by default will mean higher memory usage and higher > latency for existing scripts with no gain given their code is working today.
In my mind, it is still unreliable... When I write my library, how can I enforce people who adopt it to enable ob? Furthermore, I think it's quite annoying that some functions may not work just because of an inclusion of a blank space somewhere in a file that you don't maintain. As php applications get bigger, and developers have only a small scope of the big picture, the reliability of the functions becomes bigger and bigger deal.

Hannes Magnusson

18 years ago
On Nov 28, 2007 12:38 AM, Ezra Nugroho <enugroho@spikesource.com> wrote:
> > On Tue, 2007-11-27 at 14:50 +1000, Rasmus Lerdorf wrote: > > Ezra Nugroho wrote: > > > Can I ask for the following support, at least to begin conversation > > > about it if it hasn't been done before. > > > > > > Currently, the header() function still carries the following warning in > > > its online documentation: > > > > > > "Remember that header() must be called before any actual output is sent, > > > either by normal HTML tags, blank lines in a file, or from PHP. It is a > > > very common error to read code with include(), or require(), functions, > > > or another file access function, and have spaces or empty lines that are > > > output before header() is called. The same problem exists when using a > > > single PHP/HTML file." > > > > > > This is quite annoying since this makes header() or setcookie() calls to > > > be unreliable. > > > > > > I am aware that it can be done more reliably by turning the output > > > buffering on. This is less of an issue if you are writing your own > > > webapp. However, this is much more difficult if a person writes a > > > library for other people's consumptions. The library cannot enforce > > > output buffering in the webapp. > > > > > > Can we please give it a thought in PHP 6? Maybe by turning output > > > buffering on by default, or even by enforcing output buffering. > > > > > > In Java, you can get the request object, and the response object of a > > > web request. I find this very useful and reliable. > > > > > > Any thoughts or comments about this? > > > > There is nothing unreliable about is as far as I am concerned. You have > > full control over output buffering from your script. Forcing people to > > buffer output by default will mean higher memory usage and higher > > latency for existing scripts with no gain given their code is working today. > > > In my mind, it is still unreliable... > When I write my library, how can I enforce people who adopt it to enable > ob? > > Furthermore, I think it's quite annoying that some functions may not > work just because of an inclusion of a blank space somewhere in a file > that you don't maintain. > > As php applications get bigger, and developers have only a small scope > of the big picture, the reliability of the functions becomes bigger and > bigger deal.
http://docs.php.net/manual/en/outcontrol.configuration.php -Hannes

Alexey Zakhlestin

18 years ago
On 11/28/07, Ezra Nugroho <enugroho@spikesource.com> wrote:
> In my mind, it is still unreliable... > When I write my library, how can I enforce people who adopt it to enable > ob? > > Furthermore, I think it's quite annoying that some functions may not > work just because of an inclusion of a blank space somewhere in a file > that you don't maintain. > > As php applications get bigger, and developers have only a small scope > of the big picture, the reliability of the functions becomes bigger and > bigger deal.
Enforcing people to use some specific way of coding to use library is incorrect, anyway. But, you can correctly handle the situation (i.e. provide a meaningful error to the user) by making a simple check: http://docs.php.net/headers-sent
-- Alexey Zakhlestin http://blog.milkfarmsoft.com/

Edward Z. Yang

18 years ago
Alexey Zakhlestin wrote:
> Enforcing people to use some specific way of coding to use library is > incorrect, anyway. But, you can correctly handle the situation (i.e. > provide a meaningful error to the user) by making a simple check: > http://docs.php.net/headers-sent
With a little bit of magic (get_included_files) you can even tell the user where the leading/trailing whitespace is!
-- Edward Z. Yang GnuPG: 0x869C48DA HTML Purifier <http://htmlpurifier.org> Anti-XSS Filter [[ 3FA8 E9A9 7385 B691 A6FC B3CB A933 BE7D 869C 48DA ]]