PHP exit() vs if - else statement

Question

Is it a good or bad practice to authenticate and then just exit() the function or to wrap the whole result of the authentication in an if statement? Example

function foo($uid)
{

    $allowed = $auth->checkIfAllowed($uid);

    if ($allowed == false) exit();

        //continue with senstive code here

    }
}

OR

function foo($uid)
{

    $allowed = $auth->checkIfAllowed($uid);

    if ($allowed == true)
    {
        // do sensitive stuff
    } 
}

Your two samples do different work. The first terminates code execution, and the second - doesn't — zerkms
– zerkms, Commented Jan 15, 2012 at 0:37
I personally do not like "early returns" in any language. There are cases when they can make the code more clear, but I like to "read the indents" (of which the post has none of -- grr!) and keep it consistent. — user166390
– user166390, Commented Jan 15, 2012 at 0:40
What about if the code in the indents are long? For me it feels tacky to have many lines of code within an if statement.. but maybe thats just me. — leonvdyk
– leonvdyk, Commented Jan 15, 2012 at 0:50

Wrikken · Accepted Answer · 2012-01-15 00:45:07Z

4

I would like to take this opportunity to talk about exit; (as others have stated both work, the second is more explicit then the first, and give you the opportunity to send a nice error message to the user). My main beef (I have several with exit;) is that people should stop using it in libraries, i.e. code that can/will be used in other projects... You know how irritating it is to debug those? Throw exceptions, trigger fatal errors, but give me something with a description.

/rant

answered Jan 15, 2012 at 0:45

Wrikken

70.8k8 gold badges99 silver badges136 bronze badges

Sign up to request clarification or add additional context in comments.

5 Comments

leonvdyk Over a year ago

Thanks for the rant! I'm actually planning on throwing an exception if the user is not allowed, but while you are here, do exceptions stop execution of the rest of the code like exit does?

Michael Berkowski Over a year ago

@Wrikken Do you think we'll ever see a day when all the online PHP tutorials promoting the do_something() or die("oops"); method of error handling have gone away? It brings me to tears to see that so commonly here on SO.

Wrikken Over a year ago

Only until they are catched, and it they're not catched, execution will still halt, but I have a nice error message in my error logs I can monitor for, with a description and a location.

Wrikken Over a year ago

@Michael: yep, even in the official docs, all with the excuse 'it is just example code, not something you would use in real life', and see what happened... Sad, sad state of affairs.

Milad Naseri Over a year ago

Yeah, they don't realize that most people start their PHP learning by copying and pasting those very tutorials.

Michael Berkowski · Accepted Answer · 2012-01-15 00:39:39Z

3

Your examples are equivalent.

However, it's not usually useful to the end user to just exit the script abruptly. Instead, send your user a useful error message printed in HTML rather than the plain text you would get from a die() call, for example.

function foo($uid)
{

  $allowed = $auth->checkIfAllowed($uid);

  if ($allowed == false)
  {
    $errormsg = "You are not allowed to view this page";
  }

  else 
  { 
    //continue with senstive code here    
  }
}

Later, print the error in HTML, rather than just aborting the script:

<div class='error'><?php echo $errormsg; ?></error>

answered Jan 15, 2012 at 0:39

Michael Berkowski

271k47 gold badges450 silver badges395 bronze badges

Comments

brenjt · Accepted Answer · 2012-01-15 00:38:21Z

0

Either or. I don't think it'll make a difference. It relatively the exact same thing. In programming there are many ways to program things, never on right way in most instances.

answered Jan 15, 2012 at 0:38

brenjt

16.3k14 gold badges80 silver badges120 bronze badges

Comments

Milad Naseri · Accepted Answer · 2012-01-15 00:38:42Z

0

They are absolutely the same. The indentation and coding style is the only difference. In both cases the sensitive code won't execute unless the authentication is done successfully.

It's usually better to be expressive in your code though, so I'd recommend the second method.

answered Jan 15, 2012 at 0:38

Milad Naseri

4,1281 gold badge30 silver badges40 bronze badges

2 Comments

leonvdyk Over a year ago

The reason I ask the question is because the first method just makes the code cleaner.. especially when there is alot of code in the if statement. I don't have to worry about the closing bracket hiding from me :)

Milad Naseri Over a year ago

I know. If you ARE going to use the first method, you should ALWAYS do it in a way that some meaningful feedback is generated. Trigger an error by trigger_error or better still, use a throw new Exception(). But don't just cut off execution. By throwing an exception, you will halt execution, and you are giving the person calling your function an opportunity to catch that exception and deal with the error (or simply send it to the user as a feedback or ignore it and log it somewhere), and it will be traceable.

Collectives™ on Stack Overflow

PHP exit() vs if - else statement

4 Answers 4

5 Comments

Comments

Comments

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

4 Answers 4

5 Comments

Comments

Comments

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related