3 ms·

If you ask me, mixing presentation and logic is the core of most web development. They just missed a lot of opportunities for sanitizing data. I also don't see

by yan 18y ago

If you ask me, mixing presentation and logic is the core of most web development. They just missed a lot of opportunities for sanitizing data. I also don't see how PHP goes 'out of its way'. It doesn't do anything, neither do most other web languages, you build or use existing frameworks and libraries to help with such tasks.

simonw 18y ago
Here's how to safely output a variable in PHP: <?php echo htmlspecialchars($name); ?> Here's how to do the same thing in Django: {{ name }} That's the thing that bugs me most about PHP: it's not even a productive templating language!
- fendale 18y ago
  And in Rails <%= h(@var) %>
- vulpes 18y ago
  I didn't realize Django is a language. Lets not compare frameworks to languages.
  - simonw 18y ago
    I personally think PHP it blurs the line between a language and framework. The "framework" part is the 20,000 builtin functions and the mechanism it provides for executing code as part of a dynamic web request. In any case, my intent wasn't to compare Django to PHP, it was to point out that PHP's default way of outputting things really does make it inconvenient to write secure code - hence answering the parent post that argued that poor security had nothing to do with the language used.
  - cstejerean 18y ago
    Django is a framework, but it also has a language for writing templates, which is what the example above is written in.
- yan 18y ago
  You are comparing apples to oranges. Django is a framework built on Python. Python doesn't provide anything to escape strings. I'm sure there are also PHP frameworks and templating languages which make this very easy. I realize I'm playing devil's advocate because I love Python, but you shouldn't put blame nor give credit where it isn't due.
  - simonw 18y ago
    See my reply here: http://news.ycombinator.com/item?id=209259 http://news.ycombinator.com/item?id=209259
- breck 18y ago
  Here you go: function o($name) { echo htmlspecialchars($name); } o($name);
  - simonw 18y ago
    You still need to do this: <?php o($name); ?> I've used this exact function in my own code, though I call it "h". Really sucks that we have to do this - not to mention that PHP's global namespace for functions means it's better to have long names that are more likely not to clash with third party code.
    - deleted 18y ago
      [deleted]
    - ojbyrne 18y ago
      Actually you can use the <?= syntax to make it even more concise: function o($name) { return(htmlspecialchars($name));} <?=o($name)?> which lo, and behold, looks a lot like the rails candidate below.
      - simonw 18y ago
        You can't write code for redistribution like that though as most PHP installations have that option disabled since ti inteferes with XML processing instructions.

by yan 18y ago

simonw 18y ago

Here's how to safely output a variable in PHP: <?php echo htmlspecialchars($name); ?> Here's how to do the same thing in Django: {{ name }} That's the thing that bugs me most about PHP: it's not even a productive templating language!

fendale 18y ago
And in Rails <%= h(@var) %>
vulpes 18y ago
I didn't realize Django is a language. Lets not compare frameworks to languages.
- simonw 18y ago
  I personally think PHP it blurs the line between a language and framework. The "framework" part is the 20,000 builtin functions and the mechanism it provides for executing code as part of a dynamic web request. In any case, my intent wasn't to compare Django to PHP, it was to point out that PHP's default way of outputting things really does make it inconvenient to write secure code - hence answering the parent post that argued that poor security had nothing to do with the language used.
- cstejerean 18y ago
  Django is a framework, but it also has a language for writing templates, which is what the example above is written in.
yan 18y ago
You are comparing apples to oranges. Django is a framework built on Python. Python doesn't provide anything to escape strings. I'm sure there are also PHP frameworks and templating languages which make this very easy. I realize I'm playing devil's advocate because I love Python, but you shouldn't put blame nor give credit where it isn't due.
- simonw 18y ago
  See my reply here: http://news.ycombinator.com/item?id=209259 http://news.ycombinator.com/item?id=209259
breck 18y ago
Here you go: function o($name) { echo htmlspecialchars($name); } o($name);
- simonw 18y ago
  You still need to do this: <?php o($name); ?> I've used this exact function in my own code, though I call it "h". Really sucks that we have to do this - not to mention that PHP's global namespace for functions means it's better to have long names that are more likely not to clash with third party code.
  - deleted 18y ago
    [deleted]
  - ojbyrne 18y ago
    Actually you can use the <?= syntax to make it even more concise: function o($name) { return(htmlspecialchars($name));} <?=o($name)?> which lo, and behold, looks a lot like the rails candidate below.
    - simonw 18y ago
      You can't write code for redistribution like that though as most PHP installations have that option disabled since ti inteferes with XML processing instructions.