That's exactly what has puzzled me for a long time: a language with HTML templating as unique selling point needs a templating "engine" after all? smarty.net h

That's exactly what has puzzled me for a long time: a language with HTML templating as unique selling point needs a templating "engine" after all? smarty.net has a pamphlet up there where pros/cons (but actually only pros) are discussed [1]. Failing to understand that "<?php ...>" syntax is a SGML processing instruction with well-defined ways to embed into a hosting markup language like HTML, they go even so far as to say > Another issue with PHP tags is that they share the <> characters of HTML tags. In the application code this isn't an issue, but mixed with HTML, <?php ?> tags are a maddening process to tell them apart from the HTML tags. This also blurs the line between application and presentation separation since any PHP logic can be injected into a template. Yeah no, now you need new escaping syntax if you ever wanted to have verbatim {$whatever} in your HTML. Notably missing is a discussion about HTML-aware, injection-free templating such as for preventing {$bla} expanding into <script>alert('Pwnd')</script> when sourced from user input, which is what SGML and other HTML-aware template engines can do, and which in the name of everything that's holy should've been implemented in PHP 2 to save the web from becoming a botnet. [1]: https://www.smarty.net/syntax_comparison https://www.smarty.net/syntax_comparison