4 ms·

PHP actually is a bad templating engine for HTML because it doesn't have a feature to convert special characters to HTML entities by default. It is easy to forg

PHP actually is a bad templating engine for HTML because it doesn't have a feature to convert special characters to HTML entities by default. It is easy to forget a call to htmlspecialchars() (especially for beginners) so the code gets vulnerable to XSS. That is why you should prefer Twig or other templating engine with autoescaping. > They all start as an attempt to remove the possibility of writing meaningful code I don't think so. Twig developers have a large list of reasons on their frontpage: http://twig.sensiolabs.org/ http://twig.sensiolabs.org/

megous 10y ago
Not much difference: <?= escape($var) ?> {{ var | escape }} Nevertheless, I used DOM/libxml on the server side in PHP/C, since 10 years ago, and was happy about it. It avoids all the other the template issues (balancing open/close tags, etc.) very well. A few helper functions and you're good to go, with simplicity, flexibility and speed you will not get from any templating library in PHP. Though, some coding customers don't know what to make of it. Some people have trouble with not being able to see HTML in the code, because "where do I paste my Google Analytics code?".
- codedokode 10y ago
  Twig does not require you to write escape so you can have to write just {{ var }} That is a big difference because beginners always forget about escaping. > Nevertheless, I used DOM/libxml on the server side in PHP/C, There used to be XSLT templates but they don't seem to be popular now. Constructing DOM trees in the code without using templates is probably inconvinient and produces bloated code.
  - megous 10y ago
    Not that much bloated. And it can be quite readable if done well. You also don't need to learn peculiarities of for loops or macro language in a given templating system. The host language is it's own macro language with all the features you already know, and not limited to whatever template language authors decided to implement. Beginners also forget about balancing HTML tags, which is quite unpleasant experience when creating and changing more complicated templates with loops, conditions, etc. You can also do post-processing on the constructed DOM, even during construction. Bloated code only happens if the programmer fails to structure the code into nicely re-usable functions. Anyway, it seems to be quite popular right now with all the react hype - React.createElement is such a helper function to help construct DOM tree. It's pretty much the same concept on the server side. Except you don't need to care about DOM diffing, because server has no persistent DOM.

megous 10y ago

Not much difference: <?= escape($var) ?> {{ var | escape }} Nevertheless, I used DOM/libxml on the server side in PHP/C, since 10 years ago, and was happy about it. It avoids all the other the template issues (balancing open/close tags, etc.) very well. A few helper functions and you're good to go, with simplicity, flexibility and speed you will not get from any templating library in PHP. Though, some coding customers don't know what to make of it. Some people have trouble with not being able to see HTML in the code, because "where do I paste my Google Analytics code?".

codedokode 10y ago
Twig does not require you to write escape so you can have to write just {{ var }} That is a big difference because beginners always forget about escaping. > Nevertheless, I used DOM/libxml on the server side in PHP/C, There used to be XSLT templates but they don't seem to be popular now. Constructing DOM trees in the code without using templates is probably inconvinient and produces bloated code.
- megous 10y ago
  Not that much bloated. And it can be quite readable if done well. You also don't need to learn peculiarities of for loops or macro language in a given templating system. The host language is it's own macro language with all the features you already know, and not limited to whatever template language authors decided to implement. Beginners also forget about balancing HTML tags, which is quite unpleasant experience when creating and changing more complicated templates with loops, conditions, etc. You can also do post-processing on the constructed DOM, even during construction. Bloated code only happens if the programmer fails to structure the code into nicely re-usable functions. Anyway, it seems to be quite popular right now with all the react hype - React.createElement is such a helper function to help construct DOM tree. It's pretty much the same concept on the server side. Except you don't need to care about DOM diffing, because server has no persistent DOM.