First impression is that this is a lot like their PHP language extension XHP[1], which allows you to embed XML syntax into PHP and automatically escapes variabl

First impression is that this is a lot like their PHP language extension XHP[1], which allows you to embed XML syntax into PHP and automatically escapes variables depending on their context (inside or outside the XML): <?php // note: includes omitted if ($_POST['name']) { echo <span>Hello, {$_POST['name']}</span>; } else { echo <form method="post"> What is your name?<br /> <input type="text" name="name" /> <input type="submit" /> </form>; } in that snippet, the $_POST variable is correctly escaped to mitigate XSS attacks. XHP also allows you to condense complex components into a single tag. 1: https://www.facebook.com/note.php?note_id=294003943919 https://www.facebook.com/note.php?note_id=294003943919