7 ms·

This could be a game-changer for applications that involve lots of HTML, SQL, or other languages that tend to be embedded within Python programs. Frankly, HTML

• ohnoesjmr 2y ago
  Whats wrong with jinja?
  • pphysch 2y ago
    Jinja et al. are fine. But they still forces me to choose Python OR HTML. I have to jump between files and LSPs. t-strings pave the way for true Python+HTML seamless DX.
• paulddraper 2y ago
  These developer ergonomics reduce injection 90% in my experience. When concatenating strings is the harder approach, it is really beautiful.
• neilv 2y ago
  Agreed, although this doesn't work as well for HTML or SQL that doesn't fit on one line. Since having everything in a string literal is a little messy, and doesn't have the benefit of autoindent, syntax coloring, etc. This is one place where s-expressions of Lisp make embedding these DSLs syntactically easier. To borrow the PEP's HTML examples: #lang racket/base (require html-template) (define evil "<script>alert('evil')</script>") (html-template (p (% evil))) ; <p><script>alert('evil')</script></p> (define attributes '((src "shrubbery.jpg") (alt "looks nice"))) (html-template (img (@ (%sxml attributes)))) ; <img src="shrubbery.jpg" alt="looks nice"> You can see how the parentheses syntax will practically scale better, to a larger and more complex mix of HTML and host language expressions. (A multi-line example using the normal text editor autoindent is on "https://docs.racket-lang.org/html-template/ https://docs.racket-lang.org/html-template/".)
  • davepeck 2y ago
    > Agreed, although this doesn't work as well for HTML or SQL that doesn't fit on one line. PEP 750 t-strings literals work with python's tripe-quote syntax (and its lesser-used implicit string concat syntax): lots_of_html = t""" <div> <main> <h1>Hello</h1> </main> </div> """ My hope is that we'll quickly see the tooling ecosystem catch up and -- just like in JavaScript-land -- support syntax coloring and formatting specific types of content in t-strings, like HTML.
    • neilv 2y ago
      Yeah, editor support will help a lot. Though the PEP's way of doing things doesn't specify the language of the template where the literal occurs, so detection of that might have to be kludged. (Or, in a sufficiently working program, an editor with semantic analysis access could use something like type inference in the Python side, to determine the language in a less-kludgey way.)
      • davepeck 2y ago
        > doesn't specify the language of the template where the literal occurs Yeah, something we spent a bunch of time considering. In the end, we decided it probably needed to stay out of scope for the PEP. You're right that JavaScript has an easier time here. Most of the JS tools we looked at simply inspect the name of the tag and if it's (say) html, they attempt to color/format string content as HTML regardless of what the html() function actually does or the string's contents. Currently, tools like black have no knowledge of types. I'm guessing some amount of kludging is to be expected on day one. But my hope is over the long term, we'll see a story emerge for how annotations can indicate the expected content type.
    • kazinator 2y ago
      But that will not apply proper HTML escaping to the evil script element, allowing injection, and allows tags not to be closed: lots_of_html = t""" <div> <main> <p>{evil}>/p> <main> </span> """