5 ms·

My personal philosophy is that string interpolation should not be used to generate machine-readable code, and template languages are just fancy string interpola

My personal philosophy is that string interpolation should not be used to generate machine-readable code, and template languages are just fancy string interpolation. We've all seen the consequences of SQL injection and cross-site scripting. That's the kind of thing that will keep happening as long as we keep putting arbitrary text into interpreters. Yes, this means I don't think we should use template files to make HTML at all. Alternatives to using template languages for HTML include Haml (for Ruby) and Pug (for JavaScript). These languages have defined ways to specify entire trees of tags, attributes, and text nodes. If you don't like Python-style significant indentation, JavaScript has JSX. The HTML-looking parts of JSX compile down to a bunch of `createElement` expressions that create a web document tree. That tree can then be output as HTML if necessary. Haml, Pug, and JSX are not template languages even though they can output HTML. Likewise, `JSON.stringify(myObj)` is not a template language for JSON. Generating machine-readable code should be done with a tool that understands and leverages the known structure of the target language when possible.

kevincox 3y ago
This is the essence of the problem! Yaml and templates are just distractions. It just boils down to the fact that "string" is a very general type and we use it lazily. My personal rule: Every time a value is inserted into a string it must be properly encoded. I wrote a full blog post around this a while back https://kevincox.ca/2022/02/08/escape-everything/ https://kevincox.ca/2022/02/08/escape-everything/. But the TL;DR is that every string has a format which needs to be respected wether that be HTML, SQL or human-readable terminal output. Every time you put some value into a string you should be properly encoding it into that format. But we rarely do.
- Izkata 3y ago
  > My personal rule: Every time a value is inserted into a string it must be properly encoded. This is how Django templates have done it for over a decade. You have to go out of your way to tell it not to escape the values if for some reason you need that.
lioeters 3y ago
> Haml, Pug, and JSX are not template languages even though they can output HTML. That's nonsense, unless we go by your idiosyncratic definition of what a template language is ("fancy string interpolation"). > Haml (HTML Abstraction Markup Language) is a templating system that is designed to avoid writing inline code in a web document and make the HTML cleaner. > Pug – robust, elegant, feature rich template engine for Node.js > JSX is an XML-like syntax extension to ECMAScript without any defined semantics. OK, I'd agree that JSX is not strictly a template language. But in the end, all of these compile down to HTML. Not by string interpolation, but as a language that is parsed into a syntax tree, then rendered into HTML properly with an internal understanding of valid structure. YAML with templating is fancy string interpolation, it's not a template language (or at least a poorly implemented one).
- neallindsay 3y ago
  I am aware that Haml and Pug call themselves template languages, but they are not. In a template language, the source is a "template" that has some special syntax to fill in some bits. I don't think that's a very idiosyncratic definition. Pretty much any programming language can output a bunch of text, but most of them are not template languages. Java has XMLBuilder, but that doesn't make it a template language for outputting XML. But PHP is a template language, even though it's not recommended to use it that way anymore.
  - lioeters 3y ago
    Well, it's true that Haml calls itself a "templating system", and Pug uses the term "template engine". That's 3 out of 3, you win. ;) PHP is a scripting language that is also a template processor, but I wouldn't call it a template language. So we disagree on several points, but no big deal. A big disadvantage of PHP, in relation to your original point about "fancy string interpolation", is that it does not natively understand the target output HTML syntactically and structurally.
  - lioeters 3y ago
    Sorry, reading over my comment, I sounded more antagonistic than I meant to be. After all, we're here to enjoy discussion and not to battle against each other. As an aside, on another post yesterday, I had a pleasant surprise about "templating" in life itself. > The familiar distinction between software and hardware loses its meaning in living cells. We propose new ways to study the phylogeny of metabolisms, new astronomical ways to search for life on exoplanets, new experiments to seek the emergence of the most rudimentary life, and the hint of a coherent testable pathway to prokaryotes with template replication and coding. https://arxiv.org/abs/2401.09514 https://arxiv.org/abs/2401.09514 Maybe DNA is the original templating language. (Hopefully with more sophistication than fancy string interpolation.)
int_19h 3y ago
Not all template languages are string template languages, though. If you consider PHP a templating language for text, for example, then by the same logic XQuery is a templating language for XML.

kevincox 3y ago

This is the essence of the problem! Yaml and templates are just distractions. It just boils down to the fact that "string" is a very general type and we use it lazily. My personal rule: Every time a value is inserted into a string it must be properly encoded. I wrote a full blog post around this a while back https://kevincox.ca/2022/02/08/escape-everything/ https://kevincox.ca/2022/02/08/escape-everything/. But the TL;DR is that every string has a format which needs to be respected wether that be HTML, SQL or human-readable terminal output. Every time you put some value into a string you should be properly encoding it into that format. But we rarely do.

Izkata 3y ago
> My personal rule: Every time a value is inserted into a string it must be properly encoded. This is how Django templates have done it for over a decade. You have to go out of your way to tell it not to escape the values if for some reason you need that.

lioeters 3y ago

> Haml, Pug, and JSX are not template languages even though they can output HTML. That's nonsense, unless we go by your idiosyncratic definition of what a template language is ("fancy string interpolation"). > Haml (HTML Abstraction Markup Language) is a templating system that is designed to avoid writing inline code in a web document and make the HTML cleaner. > Pug – robust, elegant, feature rich template engine for Node.js > JSX is an XML-like syntax extension to ECMAScript without any defined semantics. OK, I'd agree that JSX is not strictly a template language. But in the end, all of these compile down to HTML. Not by string interpolation, but as a language that is parsed into a syntax tree, then rendered into HTML properly with an internal understanding of valid structure. YAML with templating is fancy string interpolation, it's not a template language (or at least a poorly implemented one).

neallindsay 3y ago
I am aware that Haml and Pug call themselves template languages, but they are not. In a template language, the source is a "template" that has some special syntax to fill in some bits. I don't think that's a very idiosyncratic definition. Pretty much any programming language can output a bunch of text, but most of them are not template languages. Java has XMLBuilder, but that doesn't make it a template language for outputting XML. But PHP is a template language, even though it's not recommended to use it that way anymore.
- lioeters 3y ago
  Well, it's true that Haml calls itself a "templating system", and Pug uses the term "template engine". That's 3 out of 3, you win. ;) PHP is a scripting language that is also a template processor, but I wouldn't call it a template language. So we disagree on several points, but no big deal. A big disadvantage of PHP, in relation to your original point about "fancy string interpolation", is that it does not natively understand the target output HTML syntactically and structurally.
- lioeters 3y ago
  Sorry, reading over my comment, I sounded more antagonistic than I meant to be. After all, we're here to enjoy discussion and not to battle against each other. As an aside, on another post yesterday, I had a pleasant surprise about "templating" in life itself. > The familiar distinction between software and hardware loses its meaning in living cells. We propose new ways to study the phylogeny of metabolisms, new astronomical ways to search for life on exoplanets, new experiments to seek the emergence of the most rudimentary life, and the hint of a coherent testable pathway to prokaryotes with template replication and coding. https://arxiv.org/abs/2401.09514 https://arxiv.org/abs/2401.09514 Maybe DNA is the original templating language. (Hopefully with more sophistication than fancy string interpolation.)

int_19h 3y ago

Not all template languages are string template languages, though. If you consider PHP a templating language for text, for example, then by the same logic XQuery is a templating language for XML.