Is there an "right way" to avoid output_buffering?

Question

I've been trying to find a host that has output_buffering enabled and my host atm doesn't have it enabled. It's impossible to get a hold of him... So... I need to find a solution or get a new host. I thought I might ask before I decide if there was a "right way" or a way that output_buffering doesn't have to be on.

Here's a script I made that fails to function without output_buffering:

<?php
session_start();
if (isset($_SESSION['authenticated'])) {
    if (isset($_GET['time']) && isset($_GET['user']) && isset($_GET['pass']) && isset($_GET['ip'])) {
        require("config.php");
        $currentTime = time();
        $time = mysql_real_escape_string($_GET['time']);
        $user = mysql_real_escape_string($_GET['user']);
        $pass = mysql_real_escape_string($_GET['pass']);
        $ip = mysql_real_escape_string($_GET['ip']);
        mysql_query("INSERT INTO `deleted` (timeDeleted, timeLogged, username, password, ip) VALUES('$currentTime','$time','$user','$pass','$ip')") or die(/*mysql_error() . */" Error code: 1");
        mysql_query("DELETE FROM `flagged` WHERE `timeLogged`='$time'") or die(/*mysql_error() . */"Error code: 2");
        mysql_close($con);
        include("flagged.php");
    }
} else {
    header("Location: index.php");
    exit;
}
?>

It fails because include("flagged.php"); never gets included, or it might but I just never see it.

So my question is: What can I do to get this to work without output_buffering? And is output_buffering bad/bad practice?

Answer 1

Output buffering is a workaround. It can be avoided by structuring the application flow correctly and taking care with encoding issues and dangling whitespace. But as workaround for such issues, it is quite functional. And you can manually enable it by placing this on top of your script:

<?php
   ob_start();

The actual problem in your case might be the UTF8 BOM. This is an invisible marker at the start of text files (like your php script). It lives before the <?php and thus the ob_start() can't help anymore. It outputs 3 bytes and would prevent headers from getting sent. If that's the case, then ob_start won't help.

But output buffering can often be enabled via .htaccess too:

php_value output_buffering On