3 ms·

In its early years up until around 2006, PHP was mostly "HTML on steroids", that is, an HTML preprocessor with lots of goodies like "batteries-included" DB acce

In its early years up until around 2006, PHP was mostly "HTML on steroids", that is, an HTML preprocessor with lots of goodies like "batteries-included" DB access, form handling, image processing, text processing, all accessed via a single Apache module. You simply rename your .html file to .php, and put some magic between "<?php" and "?>". Then came along templating engines like Smarty, and they introduced a new templating language for a language that was already built for templating. For some reason, "<?= $foo ?>" was considered much worse than "{$foo}".

hparadiz 5y ago
It was one of the first freely available languages that allowed you to do image manipulation so sites like DeviantArt would use it.
ehnto 5y ago
> For some reason, "<?= $foo ?>" was considered much worse than "{$foo}". A stigma that remains to this day, even though the spec is very clear about those kinds of short tags and the flags that affect them. PHP developers are absolutely terrified that some imaginary environment flag they have control over is going to brick their application, but are happy to bring in an entirely new templating language as a dependency instead. I'm sure Smarty was borne of a need, but I was never sure what it brought to the table except different tags for existing features.
tannhaeuser 5y ago
That's exactly what has puzzled me for a long time: a language with HTML templating as unique selling point needs a templating "engine" after all? smarty.net has a pamphlet up there where pros/cons (but actually only pros) are discussed [1]. Failing to understand that "<?php ...>" syntax is a SGML processing instruction with well-defined ways to embed into a hosting markup language like HTML, they go even so far as to say > Another issue with PHP tags is that they share the <> characters of HTML tags. In the application code this isn't an issue, but mixed with HTML, <?php ?> tags are a maddening process to tell them apart from the HTML tags. This also blurs the line between application and presentation separation since any PHP logic can be injected into a template. Yeah no, now you need new escaping syntax if you ever wanted to have verbatim {$whatever} in your HTML. Notably missing is a discussion about HTML-aware, injection-free templating such as for preventing {$bla} expanding into <script>alert('Pwnd')</script> when sourced from user input, which is what SGML and other HTML-aware template engines can do, and which in the name of everything that's holy should've been implemented in PHP 2 to save the web from becoming a botnet. [1]: https://www.smarty.net/syntax_comparison https://www.smarty.net/syntax_comparison
- krapp 5y ago
  >and which in the name of everything that's holy should've been implemented in PHP 2 to save the web from becoming a botnet. Hack did this correctly with XHP templating. Unfortunately, Hack was killed by PHP7, and of all the features it took from Hack, context-aware native templating was not among them.

hparadiz 5y ago

It was one of the first freely available languages that allowed you to do image manipulation so sites like DeviantArt would use it.

ehnto 5y ago

> For some reason, "<?= $foo ?>" was considered much worse than "{$foo}". A stigma that remains to this day, even though the spec is very clear about those kinds of short tags and the flags that affect them. PHP developers are absolutely terrified that some imaginary environment flag they have control over is going to brick their application, but are happy to bring in an entirely new templating language as a dependency instead. I'm sure Smarty was borne of a need, but I was never sure what it brought to the table except different tags for existing features.

tannhaeuser 5y ago

That's exactly what has puzzled me for a long time: a language with HTML templating as unique selling point needs a templating "engine" after all? smarty.net has a pamphlet up there where pros/cons (but actually only pros) are discussed [1]. Failing to understand that "<?php ...>" syntax is a SGML processing instruction with well-defined ways to embed into a hosting markup language like HTML, they go even so far as to say > Another issue with PHP tags is that they share the <> characters of HTML tags. In the application code this isn't an issue, but mixed with HTML, <?php ?> tags are a maddening process to tell them apart from the HTML tags. This also blurs the line between application and presentation separation since any PHP logic can be injected into a template. Yeah no, now you need new escaping syntax if you ever wanted to have verbatim {$whatever} in your HTML. Notably missing is a discussion about HTML-aware, injection-free templating such as for preventing {$bla} expanding into <script>alert('Pwnd')</script> when sourced from user input, which is what SGML and other HTML-aware template engines can do, and which in the name of everything that's holy should've been implemented in PHP 2 to save the web from becoming a botnet. [1]: https://www.smarty.net/syntax_comparison https://www.smarty.net/syntax_comparison

krapp 5y ago
>and which in the name of everything that's holy should've been implemented in PHP 2 to save the web from becoming a botnet. Hack did this correctly with XHP templating. Unfortunately, Hack was killed by PHP7, and of all the features it took from Hack, context-aware native templating was not among them.