4 ms·

String-based templating is a bad pattern fraught with security issues that shouldn't be translated from old languages to new ones.

jamespo 11y ago
I'm interested to hear an alternative, particularly one that will work with separate front end dev teams etc.
- ecto 11y ago
  The frontend consuming a RESTful API is a viable alternative
  - simonz05 11y ago
    That is not really the same as server rendered templates.
- xaritas 11y ago
  Enlive and related libraries for Clojure, Lift for Scala, and heist for Haskell use node transformation. I know that there are a few others I'm forgetting. Basically given a fragment of an HTML 5 or XML document, your view functions transform it into a different fragment. E.g. in Lift, given <div class="greeting-container" data-lift="SayHello"><span class="greeting">lorem ipsum</span></div> And a transformation: ".greeting *" #> "Hello World" The output will be: <div class="greeting-container"><span class="greeting">Hello World</span></div> See http://exploring.liftweb.net/master/index-5.html#entry-CSS-Transforms-0 http://exploring.liftweb.net/master/index-5.html#entry-CSS-T... et alia With this technique, your designers can create pure HTML and assets, with no logic in the templates. Basically they create static mock-ups and then the developers "enliven" them. I prefer this but I don't imagine it will ever become mainstream. React's JSX is also (as far as I can tell) node based, but with a lot less power (you can really only do insert operations, and the operations don't really compose well).
  - tootie 11y ago
    I recently did a project using this type of template system and it was ok, but not really better than string-based templating. You're really still doing String-based templating except you're embedding all your directives in data attributes and it gets super messy and unreadable.
- davexunit 11y ago
  You need to use something that represents the HTML tree using real data types. I do a lot of my work in Scheme, where we have SXML: '(p "hello" (strong "jamespo")) Before you say "ahhh the parens!", there are special readers such as Racket's Pollen that provide a less Lispy, but still powerful, language for writing documents. For JavaScript, there's of course a bunch of options such as Mithril: m("p", ["hello", m("strong", "jamespo")]); I don't write Go so I don't know what the options are there. Just trying to raise awareness for safer programming. For much more in-depth information about the problem, see: http://www.more-magic.net/posts/structurally-fixing-injection-bugs.html http://www.more-magic.net/posts/structurally-fixing-injectio...
deleted 11y ago
[deleted]

jamespo 11y ago

I'm interested to hear an alternative, particularly one that will work with separate front end dev teams etc.

ecto 11y ago
The frontend consuming a RESTful API is a viable alternative
- simonz05 11y ago
  That is not really the same as server rendered templates.
xaritas 11y ago
Enlive and related libraries for Clojure, Lift for Scala, and heist for Haskell use node transformation. I know that there are a few others I'm forgetting. Basically given a fragment of an HTML 5 or XML document, your view functions transform it into a different fragment. E.g. in Lift, given <div class="greeting-container" data-lift="SayHello"><span class="greeting">lorem ipsum</span></div> And a transformation: ".greeting *" #> "Hello World" The output will be: <div class="greeting-container"><span class="greeting">Hello World</span></div> See http://exploring.liftweb.net/master/index-5.html#entry-CSS-Transforms-0 http://exploring.liftweb.net/master/index-5.html#entry-CSS-T... et alia With this technique, your designers can create pure HTML and assets, with no logic in the templates. Basically they create static mock-ups and then the developers "enliven" them. I prefer this but I don't imagine it will ever become mainstream. React's JSX is also (as far as I can tell) node based, but with a lot less power (you can really only do insert operations, and the operations don't really compose well).
- tootie 11y ago
  I recently did a project using this type of template system and it was ok, but not really better than string-based templating. You're really still doing String-based templating except you're embedding all your directives in data attributes and it gets super messy and unreadable.
davexunit 11y ago
You need to use something that represents the HTML tree using real data types. I do a lot of my work in Scheme, where we have SXML: '(p "hello" (strong "jamespo")) Before you say "ahhh the parens!", there are special readers such as Racket's Pollen that provide a less Lispy, but still powerful, language for writing documents. For JavaScript, there's of course a bunch of options such as Mithril: m("p", ["hello", m("strong", "jamespo")]); I don't write Go so I don't know what the options are there. Just trying to raise awareness for safer programming. For much more in-depth information about the problem, see: http://www.more-magic.net/posts/structurally-fixing-injection-bugs.html http://www.more-magic.net/posts/structurally-fixing-injectio...

deleted 11y ago

[deleted]