4 ms·
me too, i like php. it's a decent templating language with some very advanced features. it even supports namespaces!
by plq 15y ago
me too, i like php. it's a decent templating language with some very advanced features. it even supports namespaces!
- pornel 15y agoIt's an XSS-prone templating language, as the default correct syntax for outputting variables is: <?php echo htmlspecialchars($value, ENT_QUOTES);?> which is far from encouraging safe best practices. PHP namespaces aren't any better: http://pornel.net/phpns http://pornel.net/phpns
- shiflett 15y agoActually, you should also always indicate the character encoding, for reasons I explain here: http://shiflett.org/blog/2005/dec/google-xss-example http://shiflett.org/blog/2005/dec/google-xss-example
- pornel 15y agoYes, declaration is necessary, but not in the htmlspecialchars() call if you're using ASCII-superset encoding (and you really should declare UTF-8, never UTF-7).