Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

> The ability to interleave code and HTML was also tacky and never taken seriously but I think touted highly by some as a killer feature.

And yet people seem to keep inventing variations of this as "templating" languages.



That presumably take care of the escaping rules and grammar of the output language, unlike the giant string concatenator that is PHP.


Yeah, a big problem with the traditional PHP-in-HTML approach to generating web sites is that it's one of the areas where PHP hasn't dramatically improved since the early days. Later templating engines learned from the problems people encountered with PHP and were built to be aware of the output format, and PHP never did that. A lot of work was put into writing templating engines in PHP that in retrospect really should have instead been a language mode for PHP itself.

We would have seen dramatically fewer bugs and injection attacks over the years if PHP had made <input value="<?=$value?>"> a perfectly safe and normal thing to write back in 2005.


There are actually shockingly few context-sensitive templating languages for php and those that exist don't seem that popular (Latte is the main one I'm aware of). Most of them are more of the giant string concatenation type, maybe with escape by default semantics (e.g. Smarty, Mustache).




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: