To the contrary, there's absolutely nothing wrong with using HTML as text format with helper programs to generate dynamic content. It's how the web started with

To the contrary, there's absolutely nothing wrong with using HTML as text format with helper programs to generate dynamic content. It's how the web started with super-practical, no-nonsense backend scripting. I've worked with React and even like it when it fits (eg. a highly interactive app where everything can change at any time). But it doesn't do anything for content-driven sites yet requires enormous infrastructure compared to just run stuff on the command line. Where PHP got it wrong is that it did just such a hack job of pasting program output into HTML without HTML-aware, injection-free templating for us to endure in the form of DoS attacks. When all this was readily available - you just don't use SGML processing instructions (eg "<?php ..." which is just a fallback method of last resort) but regular, typed entity expansion, with escaping depending on markup context and content model checking for rejecting eg. script elements in user content.