`<?= $_GET['theVarName'] ?>` Is vulnerable to XSS This I assume is another reason why HTML "aware" templating engines are now popular in PHP rather than toggl

`<?= $_GET['theVarName'] ?>` Is vulnerable to XSS This I assume is another reason why HTML "aware" templating engines are now popular in PHP rather than toggling with <? and ?> between HTML and PHP PHP makes it really easy (IMHO) to write insecure code, and most samples you find online are. Not many people starting with PHP learn `<?= htmlspecialchars($_GET["theVarName"]) ?>` or equivalent.