Skip to content

Reconsider disallowing heredoc and nowdoc #1036

@westonruter

Description

@westonruter

Per #792 (comment):

I'm curious about the rationale here. I can understand the issue with HEREDOC since you can't add escaping functions in the output for interpolated variables, but this isn't the case for NOWDOC.

For example, in WordPress/performance#2144, I want to do this:

$js = <<<'JS'
	const authRadios = /** @type {NodeListOf<HTMLInputElement>} */ ( document.querySelectorAll( "input[name='plsr_speculation_rules[authentication]']" ) );
	const noticeDiv = document.getElementById( "plsr-auth-notice" );
	if ( authRadios.length && noticeDiv ) {
		for ( const authRadio of authRadios ) {
			authRadio.addEventListener( "change", () => {
				const isLoggedOut = ( authRadio.value === "logged_out" );
				noticeDiv.classList.toggle( "notice-info", isLoggedOut )
				noticeDiv.classList.toggle( "notice-warning", ! isLoggedOut )
			} );
		}
	}
JS;
wp_print_inline_script_tag( $js, array( 'type' => 'module' ) );

But the PCP ruleset is flagging this. What is the risk here?

Note: There are 52 files in WordPress core using heredoc/nowdoc: https://github.com/search?q=repo%3AWordPress%2Fwordpress-develop+%2F%3C%3C%3C%27%3F%5BA-Z%5D%2B%2F+path%3A*.php&type=code

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions