<?php
foreach ($contacts as $contact_object) {
  $contact_array = (array) $contact_object;
  foreach ($contact_array as $key=>$value) $$key = h($value);
  echo <<<END_ROW
    <tr>
      <td>$id</td>
      <td>$first_name</td>
      <td>$last_name</td>
      <td>$phone</td>
      <td>
        <a href="?action=edit&amp;id=$id">edit</a>
        <a href="?action=delete&amp;id=$id">delete</a>
      </td>
    </tr>
END_ROW;
}

<?php foreach ($contacts as $contact_object) 
{ $contact_array = (array) $contact_object; 
foreach ($contact_array as $key=>$value) 
$$key = h($value); echo <<<END_ROW <tr> <td>$id</td> <td>$first_name</td> <td>$last_name</td> <td>$phone</td> <td> <a href="?action=edit&id=$id">edit</a> <a href="?action=delete&id=$id">delete</a> </td> </tr> END_ROW; }

http://pdxphp.org/articles/escaping-injected-data

The above example uses PHP's heredoc syntax. With it, we can completely eliminate PHP tags from the insides of HTML tags.

user PHP's heredoc syntax

php, html

PHP