Should I keep the PHP short_open_tag off?

There are security reasons for never using short_open_tag in your code.

Your code could easily end up on a server with short tags off, through a migration or perhaps some misconfiguration. If you have been using short tags to mark what is PHP code and what is not, suddenly your PHP will be interpreted as content and served as is. That could leak all sorts of secrets. But does this mean you should turn the feature off? On the one hand, it's a great way of stopping your developers from using them. On the other hand, if you move in code from somewhere else it exposes you to the problem mentioned above. There is discussion within the PHP community about deprecating short tags.