Keywords: PHP | HTTP headers | error handling | output buffering | code restructuring
Abstract: This article provides a comprehensive exploration of the common "Headers already sent" error in PHP, detailing its causes, such as premature output including whitespace, BOM, and error messages. It offers multiple solutions, including code restructuring, use of output buffering, and application of the headers_sent() function, with practical code examples to avoid and fix the error. The discussion also covers how functions like setcookie() and session_start() are affected, aiding developers in fully understanding and addressing this issue.
Error Overview
In PHP development, the "Headers already sent" error is a frequent issue, typically manifesting as a warning: "Warning: Cannot modify header information - headers already sent by (output started at /some/file.php:12) in /some/file.php on line 23". This error occurs when attempting to modify HTTP header information after output has been sent to the browser. Understanding its root causes and solutions is essential for building robust PHP applications.
HTTP Response Structure
An HTTP response consists of headers and a body. Headers contain metadata such as status codes and content types, while the body includes actual content like HTML. Once PHP sends any output, such as via echo or print, it flushes the header information to the server, after which headers cannot be modified. For example, a typical HTTP response is structured as follows:
HTTP/1.1 200 OK
Powered-By: PHP/5.3.7
Vary: Accept-Encoding
Content-Type: text/html; charset=utf-8
<html><head><title>Page Title</title></head><body>Content Section</body></html>After output begins, PHP cannot append to the headers, causing functions like header() and setcookie() to fail.
Error Cause Analysis
The primary cause of this error is output being sent before HTTP header modifications. Output can be intentional or unintentional. Intentional output includes using functions like echo and print, or writing raw HTML code. Unintentional output may arise from:
- Whitespace or line breaks at the start of a file.
- The UTF-8 Byte Order Mark (BOM), an invisible character sequence that might be added by editors.
- Output from error messages or warnings, such as unhandled PHP notices.
- Raw HTML or whitespace before the <?php tag or after the ?> tag.
For instance, if a file starts with a space:
<?php
header("Location: example.com");
?>This will cause an error because the space is treated as output. Similarly, BOM characters (EF BB BF) can be inadvertently introduced and must be detected and removed using hex editors or specific tools.
Locating the Output Source
The error message provides key information to locate the issue. The "output started at" section indicates the file and line number where output began. For example, if the error mentions "output started at /www/auth.php:52", one should check line 52 of that file for output statements. Common output sources include:
- echo or print statements.
- var_dump or print_r used for debugging.
- HTML code preceding PHP code.
- Output from included files.
By carefully reviewing these locations, premature output can be identified and removed.
Solutions
The best way to resolve this error is to restructure code to ensure all HTTP header modifications occur before any output. Specific strategies include:
- Placing calls to header(), setcookie(), etc., at the script's beginning, avoiding any output statements beforehand.
- Using functions or classes to encapsulate logic, separating processing from output. For example, handle form submissions first, then generate HTML.
- Removing excess whitespace or BOM from file starts and ends. Set editors to save as "UTF-8 without BOM".
- Suppressing error output, e.g., using the @ operator or error_reporting(0), but with caution to avoid masking other issues.
For example, fixing a script with premature output:
<?php
// Incorrect example: output before header
echo "Hello";
header("Location: target.php");
?>Should be changed to:
<?php
// Correct example: header before output
header("Location: target.php");
echo "Hello";
?>For cases where immediate restructuring isn't feasible, output buffering can serve as a temporary solution.
Using Output Buffering
PHP's output buffering allows delaying output until the script ends or is explicitly flushed. Using ob_start() and ob_end_flush() functions can buffer output, enabling header modifications within the buffer. Example:
<?php
ob_start();
echo "Buffered output";
setcookie("user", "john");
ob_end_flush();
?>This approach can prevent errors, but note that buffers may be compromised by whitespace or BOM, and buffer size is limited, potentially causing overflows. Thus, output buffering should be considered a stopgap, not a long-term solution. Setting output_buffering in php.ini can enable global buffering, but it may vary by server configuration.
The headers_sent() Function
The headers_sent() function checks if headers have been sent, returning a boolean value. This can be used for conditional logic, such as providing fallbacks if redirection fails. Example:
<?php
if (headers_sent()) {
echo "<a href='target.php'>Click to redirect</a>";
} else {
header("Location: target.php");
exit;
}
?>This method enhances application robustness by ensuring users can navigate even if headers are already sent.
Other Affected Functions
Functions like setcookie() and session_start() also rely on HTTP header modifications and are subject to the same rules. setcookie() sends a Set-Cookie header, while session_start() may involve setting cookies or session IDs. If output occurs before these functions, similar errors arise. Ensure no output precedes their calls, e.g., by placing session start at the script's top.
Common Pitfalls and Debugging
Common pitfalls in development include overlooking output in included files, editors auto-adding BOM, or error reporting settings hiding issues. Enabling error reporting helps identify problems:
<?php
error_reporting(E_ALL);
ini_set("display_errors", 1);
?>If the error message points to "Unknown on line 0", it may stem from PHP extensions or configuration issues, such as gzip compression or duplicate module loads. Checking php.ini settings and server logs can provide clues.
Alternative Redirection Methods
When HTTP redirection is not feasible, client-side redirection via HTML meta tags or JavaScript can be used. For example:
<meta http-equiv="Refresh" content="0; url=target.php">Or using JavaScript:
<script>location.replace("target.php");</script>These methods do not rely on HTTP headers but require browser support and may impact user experience.
Summary and Best Practices
The key to avoiding the "Headers already sent" error is adhering to the "headers first" principle: handle all HTTP header modifications at the script's start before any output. Use modular code structures, regularly check file encoding and whitespace, and employ headers_sent() for error handling. Output buffering can serve as a temporary fix, but long-term solutions involve optimizing code logic. By understanding HTTP protocols and PHP output mechanisms, developers can write more reliable web applications.