return $this->renderBaseAttrs() . ' />'; No wonder it's expensive. If you serialize a tree of objects by concatenating subtrees into substrings, most values ar

return $this->renderBaseAttrs() . ' />'; No wonder it's expensive. If you serialize a tree of objects by concatenating subtrees into substrings, most values are copied many times depending on the depth of the tree, and you end up doing O(n log n) work. But as for the alternative there was basic XSS filtering in place for the naked $_POST['name'] variable in the plain PHP version isn't knowing you have to encode some but not all of your output worse than just encoding all of it? This is the kind of design mistake that leads to databases accidentally full of HTML entities. Or more likely, half full.