3 ms·
HTML templating in PHP is unfortunately unsafe. It has some nice properties: streams by default, it’s pretty fast for a templating language and you get a lot o
by dgb23 3y ago
HTML templating in PHP is unfortunately unsafe.
It has some nice properties: streams by default, it’s pretty fast for a templating language and you get a lot of stuff for free that you eventually need.
However, you have to escape and sanitize output explicitly, which is not a thing in pretty much any modern templating language.
The std lib in go for example has a very explicit security model.
The problem is that you have to escape differently depending on the micro context. So it can become tedious and error prone if you have to do it explicitly all the time.
- tannhaeuser 3y ago> However, you have to escape and sanitize output explicitly, which is not a thing in pretty much any modern templating language. Idk if it has to with "modern" or not. Proper escaping contexts (whether, and which delimiters to quote in attributes, in content, in markup declarations, ...) are already defined by SGML, with HTML-aware templating or other vocabulary-specific expansion such as suppressing <script> elements injection as would be required by basic user commenting also being covered by SGML. My impression was that go/templating (and maybe pug?), while considered advanced relative to other templating packages shitting strings into markup, still requires explicit sanitation depending on the insertion context.