4 ms·

Further evidence of this is the fact that `<?= $foo ?>`, and the long-form `<?php echo $foo ?>`, don’t offer a way to easily HTML-encode the output; instead you

Further evidence of this is the fact that `<?= $foo ?>`, and the long-form `<?php echo $foo ?>`, don’t offer a way to easily HTML-encode the output; instead you have to use `htmlentities()`. Whereas ASP.NET has had `<%: foo %>` to encode output for almost 15 years now, and Razor defaults to encoding: they make it harder to render unrecoded output.

wvenable 5y ago
Actually only 12 years since that syntax came out with ASP.NET version 4.0. ASP.NET went a long time without it (and classic ASP before that). And, like with razor, you can use plenty of libraries with PHP that will encode by default.
- DaiPlusPlus 5y ago
  Razor is stock though, but there is still no in-box way using PHP's own syntax to auto-encode output.
corobo 5y ago
Comparing a language to a framework is a bit wonky isn't it? Laravel (PHP framework) for instance has {{ $foo }}
- DaiPlusPlus 5y ago
  PHP is simultaneously a framework and a language, though. It features a very simple framework, though, and has been supplanted by others, including those that resort to reimplementing their own templating system, which defeats the point of using PHP in the first place as that was its main goal: to be a templating system for Personal Home Pages.
- arp242 5y ago
  PHP started life as a template engine for CGI applications written in C. And some pretty major projects like WordPress use PHP as a "template language". There are various constructs in the language rarely seen in PHP code that make this easier, such as <?=, but also also "if (..):" which can be ended with "endif", and "foreach (...):" which can be ended with "endforeach". It's not a hard feature to add. PHP devs want to move away from this "PHP as a template language" (I think they tried to remove the <?= a few years back); that's all fine, but fact of the matter is that people ARE using it as a template language and will continue to do so in the foreseeable future. Not supporting that with something as simple as "automatic escape special HTML characters" is extremely disappointing, and would actually prevent a lot of problems.
  - DaiPlusPlus 5y ago
    "I think they tried to remove the <?= a few years back)" Not quite. They deprecated `<?` but not `<?=`, see here: https://wiki.php.net/rfc/deprecate_php_short_tags https://wiki.php.net/rfc/deprecate_php_short_tags Another PHP-RFC removed `<%`, `<%=`, and `<script language="php">` (I'll admit I didn't know about that one): https://wiki.php.net/rfc/remove_alternative_php_tags https://wiki.php.net/rfc/remove_alternative_php_tags - but as with before, this specifically retained `<?=`.
    - arp242 5y ago
      Ah yes, it was just the "<?" tag and not "<?="; I misremembered. The ASP tags were always a bit of a misfeature; I don't think I've ever seen it used even once. <script language="php"> is just weird because it's intended for client-side scripts :-/
- deleted 5y ago
  [deleted]
deleted 5y ago
[deleted]

wvenable 5y ago

Actually only 12 years since that syntax came out with ASP.NET version 4.0. ASP.NET went a long time without it (and classic ASP before that). And, like with razor, you can use plenty of libraries with PHP that will encode by default.

DaiPlusPlus 5y ago
Razor is stock though, but there is still no in-box way using PHP's own syntax to auto-encode output.

corobo 5y ago

Comparing a language to a framework is a bit wonky isn't it? Laravel (PHP framework) for instance has {{ $foo }}

DaiPlusPlus 5y ago
PHP is simultaneously a framework and a language, though. It features a very simple framework, though, and has been supplanted by others, including those that resort to reimplementing their own templating system, which defeats the point of using PHP in the first place as that was its main goal: to be a templating system for Personal Home Pages.
arp242 5y ago
PHP started life as a template engine for CGI applications written in C. And some pretty major projects like WordPress use PHP as a "template language". There are various constructs in the language rarely seen in PHP code that make this easier, such as <?=, but also also "if (..):" which can be ended with "endif", and "foreach (...):" which can be ended with "endforeach". It's not a hard feature to add. PHP devs want to move away from this "PHP as a template language" (I think they tried to remove the <?= a few years back); that's all fine, but fact of the matter is that people ARE using it as a template language and will continue to do so in the foreseeable future. Not supporting that with something as simple as "automatic escape special HTML characters" is extremely disappointing, and would actually prevent a lot of problems.
- DaiPlusPlus 5y ago
  "I think they tried to remove the <?= a few years back)" Not quite. They deprecated `<?` but not `<?=`, see here: https://wiki.php.net/rfc/deprecate_php_short_tags https://wiki.php.net/rfc/deprecate_php_short_tags Another PHP-RFC removed `<%`, `<%=`, and `<script language="php">` (I'll admit I didn't know about that one): https://wiki.php.net/rfc/remove_alternative_php_tags https://wiki.php.net/rfc/remove_alternative_php_tags - but as with before, this specifically retained `<?=`.
  - arp242 5y ago
    Ah yes, it was just the "<?" tag and not "<?="; I misremembered. The ASP tags were always a bit of a misfeature; I don't think I've ever seen it used even once. <script language="php"> is just weird because it's intended for client-side scripts :-/
deleted 5y ago
[deleted]

deleted 5y ago

[deleted]