PHP and HTML – When Separating Them is Counterproductive

htmlPHP

Understanding that it is less load on the server to not have to parse HTML, when does it work the other way, as far as server performance.

The majority of my Web sites are database-driven – often the same cosmetic structure with entirely different information. Separating the HTML, which is minimal compared to the PHP involved, does it come to a point where excessive calls to PHP defeat the performance gained by separating the two? I am totally aware of the possibility that I do not totally understand how PHP processing takes place. I am listing two examples below.

Unless I am misunderstanding how PHP works, in this little bit of code, I am making 5 calls to PHP, whereas the second is only one.

(Please excuse the old mysql. This was just a convenient example)_

Separate

<div class="Filters">
   <?PHP
   $Result = mysql_query( --- Complex query --- );
   if(!$Result){$Error[] = "Database Error! [4]";}
   else
   {
      $L = mysql_num_rows($Result);
      $CatItems[] = "All";
      while($C=mysql_fetch_array($Result))
      {
         $CatItems[] = $C['Cat'];
      }
      sort($CatItems);
      $a = $L%2 == 0 ? (int)($L/2) : (int)($L/2)+1;
      ?>
      <div class="2Col">
      <?PHP
      for($x = 0; $x < $a; $x++)
      {
         ?>
         <div class="FilterItem">
            <div class="CriteriaSelect" data-cat="<?PHP echo($CatItems[$x]);?>"><?PHP echo($CatItems[$x])?/>
            <div class="FilterCount">
               <?PHP  
               if($CatItems[$x] == "All"){$Rows = $ProgRows;}
               else
               {
                  $CCount = mysql_query( --- Complex query --- );
                  $Rows = mysql_num_rows($CCount);
               }
               echo('('.$Rows.');
               ?>
            </div>
         </div>
      </div>
   </div>

PHP Writing HTML

<?PHP
echo('
<div class="Filters">');
   $Result = mysql_query( --- Complex query --- );
   if(!$Result){$Error[] = "Database Error! [4]";}
   else
   {
      $L = mysql_num_rows($Result);
      $CatItems[] = "All";
      while($C=mysql_fetch_array($Result))
      {
         $CatItems[] = $C['Cat'];
      }
      sort($CatItems);
      $a = $L%2 == 0 ? (int)($L/2) : (int)($L/2)+1;
      echo('
      <div class="2Col">');
      for($x = 0; $x < $a; $x++)
      {
         echo('
         <div class="FilterItem">
            <div class="CriteriaSelect" data-cat="'.$CatItems[$x].'">'.$CatItems[$x].'
            <div class="FilterCount">');
               if($CatItems[$x] == "All"){$Rows = $ProgRows;}
               else
               {
                  $CCount = mysql_query( --- Complex query --- );
                  $Rows = mysql_num_rows($CCount);
               }
               echo('('.$Rows.');
               echo('
            </div>
         </div>
      </div>
   </div>');
   ?>

Best Answer

Your two examples are effectively equivalent – the PHP engine processes the entire file and interprets the outside HTML roughly as if it were a string that is printed out like in the second example. There is no extra overhead. And if there is any overhead, it is insignificant compared to actions like waiting for a database response, or negotiating an encrypted HTTPS connection.

The real answer though is “neither”. While PHP was originally developed to allow small PHP snippets to be inserted into an (otherwise normal) HTML file, this is now considered unmaintainable and even dangerous. For example, notice that you fail to perform HTML escaping of the output you are echoing. If someone can insert a string of their choice into the database, they could perform an XSS attack.

For these reasons, the current best practice is to use a separate template engine to render the HTML contents. Most template engines escape by default (so are secure-ish by default), and require you to opt out of escaping if you really have a variable that contains verbatim HTML. For example, the PHP Symfony web framework uses the Twig template language.

Related Topic