Can I use Plain PHP functions in tpl file?

Question

I have a tpl.php page for login form in my drupal site in which have 4 images.

I need to display only one of these 4 images randomly on each page load.

I can easily do this in less than 10 lines of code using the php rand() function.

But is it advisable to directly use such functions in tpl files. Could this have some sort of security risk?

UPDATE:

The 4 images that I talked about. I have just uploaded them to sites/default/files/images folder and have included them in tpl file using following code:

<img src="http://mysite.com/sites/default/files/images/image.jpg"/>

I have a feeling that this is unsafe too. Please advise.

Answer 1

For the first part of question:

You may output as form item the output of your custom function, where contain logic to get random image:

function MY_MODULE_form_alter(&$form, &$form_state, $form_id) {
    if ($form_id == 'user_login') {
        $form['img_item'] = array(
          '#type' => 'markup',
          '#markup' => my_random_image_output(),
          '#weight' => -50
        );
    }
}

function my_random_image_output() {
    $output = '';

    // your custom logic to output one image $output = '<img src=".... />'

    return $output;
}