5 ms·
A template language that requires manually calling htmlspecialchars on every single value (or else you have an XSS vulnerability) seems like an enormous footgun
by ptx 4y ago
A template language that requires manually calling htmlspecialchars on every single value (or else you have an XSS vulnerability) seems like an enormous footgun. In Django this problem was corrected before the 1.0 release.
- wzy 4y agoIs this issue a footgun in Symfony, since you're comparing a framework of one language (Python) with a PHP language by itself?
- pjio 4y ago> ... when tied to a framework to avoid the footguns. Escaping is typically handled in the framework.
- ptx 4y agoOops, I missed that part when I read the comment I was replying to. Thanks.
- simion314 4y ago>Django You need to use a similar PHP framework, with one such framework you don't need to escape html or sql stuff.
- ipaddr 4y agoAre you talking about outputting unsafe user input? Laravel is the Django of the php world and does that out of the box. You could clean your user input before storing/displaying as best practice suggest.
- jbboehr 4y agoPHP isn't really used as a template language any more. Most people use a different template language for the views. I've implemented two myself[0][1] but an early one was Smarty[2] and there are many others. I hear Twig is pretty good[3]. [0]: https://github.com/jbboehr/php-handlebars https://github.com/jbboehr/php-handlebars [1]: https://github.com/jbboehr/php-mustache https://github.com/jbboehr/php-mustache [2]: https://www.smarty.net/ https://www.smarty.net/ [3]: https://twig.symfony.com/ https://twig.symfony.com/
- ptx 4y agoIf you're not using it as a template language though, why use PHP in the first place? Having to use a separate framework puts it on equal footing with every other language.
- 8n4vidtmkvmk 4y agoit just works with no fuss. no compiling. no memory leaks because it dies after every request. the standard library, despite being horrifically inconsistent, has everything you need