Output buffer vulnerabilities PHP

Question

What are the vulnerabilities of output buffer functions in PHP?

• Not saying it has vulnerabilities, merely wondering if there were any

Why is it considered ugly php code?

• http://symfony.com/doc/2.0/book/from_flat_php_to_symfony2.html Under isolating the layout

Answer 1

Output buffering is considered ugly if it is used to circumvent ye' olde Cannot send headers, output already started at... warning. Output buffering is then used to make up for poor design.

In a well designed application you would make sure that any response headers are sent first before any response body content is output, without having to resort to output buffering.

In an application which is made up of spaghetti code , a developer might make the decision to cram another header in somewhere, after body content has already been output. And since http headers must be sent before http body content, they use output buffering to tackle this violation of the http protocol. I've explained this more elaborate a while ago in this answer .

Answer 2

It's actually a very helpful tool as explained in the article below...

http://dev-tips.com/featured/output-buffering-for-web-developers-a-beginners-guide