4 ms·

> no template tags Why? Native PHP excels at html templating, that's what it was created for.

• scintill76 10y ago
  Native templating isn't easy/safe. Every time you want to embed a dynamic string, you'd better remember to escape it in the correct way for the context (attribute value, text, JSON), or you're vulnerable to HTML injection, or at least mangled output that doesn't render the way it should have. If they built syntax-aware templating in, that might be interesting, but AFAIK, for now you have to use a third-party template implementation to get something semi-enjoyable to use safely. It would be better to just throw out the "template" features because they encourage messy, unsafe code.
  • tyingq 10y ago
    As far as I know, most templating frameworks (php or otherwise) don't really solve this either. PHP's native templating is perhaps prone to more issues in this area, but template frameworks (for the most part) still allow you shoot yourself in the foot with data contained in strings.
    • combatentropy 10y ago
      Most templates I've seen escape HTML by default. You have to type something extra to unescape it.