Right, because in any sane templating library you would just have something like Hello & Welcome {{a}} but despite being "built for the web", php is n

Right, because in any sane templating library you would just have something like Hello & Welcome {{a}} but despite being "built for the web", php is not a sane templating language for dealing with html. Facebook's XHP solves this problem: https://github.com/facebook/xhp-lib#escaping https://github.com/facebook/xhp-lib#escaping "An interesting feature of XHP is the idea of automatic escaping" ... "As you can see, using XHP makes safety the default rather than the exception." Unfortunately your standard php hosting site is not running hhvm.