3 ms·
you're right. it was obvious when we started seeing templating engines for php while php is itself a templating engine
by slim 5y ago
you're right. it was obvious when we started seeing templating engines for php while php is itself a templating engine
- tored 5y agoOnly thing missing from PHP now is to programmatically detect tainted strings, i.e. strings that are dangerous like user input, if we had that we could continue with the built in templating and still be sure to escape output at the correct moment. Tainted strings should be built into PHP (there was an RFC for it but it didn't pass). Another solution could be using operator overloading instead (that RFC didn't pass either).
- krapp 5y agoOr do what Hack did with XHP and make XML/HTML a part of the language, and escape everything else by default. That was the one Hack feature PHP should have taken, but didn't.