Let me separate the paths associated with this subject separately:
1. Get the logic out of the presentation - don't put the "code" in your HTML
Anyone who says this and then tells you to go with the template is contradictory:
- PHP is an interpreted language - it becomes C executable code.
- Template Template Syntax Interpreted in PHP
They must stop lying to themselves. Their "template syntax" is a programming language built on top of another, which, in turn, is built on top of another language - it is inefficient, redundant and strange.
In addition, I do not see how the very existence of variables in which each template engine hangs is not considered logic. Their existence, content and implementation depend on the logical backend.
And which of these template systems with if / else statements and for loops? This is the very essence of logic - the very concepts that most programming languages ββuse. They require variable data that can be generated or exist only through some form of computation.
You cannot serve dynamic content without mixing presentation with logic. It's impossible.
2.1 This is safer ...
So, you do not trust your boyfriend HTML?
Case: You think your HTML / CSS guy is stupid and accidentally prints the database password
If so, I have news for you - your environment is already insecure if access to sensitive data can be changed from anywhere in the program.
Case:. You think your HTML guy will print random server constants - it's dangerous to let him, as a person, work with server logic
I see that he is either stupid or hates his job, and wants to be fired, and therefore will do something dumb, like print session variables. Great, but I will say ...
... Why the hell is this material not up to expert judgment ? Even if he did not have access to the direct logic of the server, but rather a bizarre template system, he could still spread his stupidity / hatred just because he has a final opinion about the exit. Or he may even conspire with another programmer (if any) and still access the server and co constants.
-
2.2.1 Good template engines automatically sanitize the output or let the template designer do it themselves - he knows better when the data needs to be sanitized
You are fictitious.
You do not know when to disinfect the release? You could not do this ..?
Even so, you may be just a monkey of code, and the HTML guy is an expert in embedding HTML technologies for web security, and he should be the only disinfectant product. In this case, giving him access to PHP, he also allows you to use similar htmlspecialchars() , and not that the template allows him to do the same.
As for automatic escaping, provided that you are transferring content safely, you can implement such a simple function in the code that you do.
-
2.2 ... and I can control what data is processed using
Think about classes, functions, etc. - You enter data, they work with it, then you get the result. As a rule, they do not deal with external data, unless it is handed over to them (otherwise, fuzzy, dangerous and bad practice - some constants aside). Using these same methods, you can convey exactly what you need for your output in an effective, clear and unlimited estate.
-
All that has been said is similar to the fact that, in your opinion, your template engine is more secure than regular code, because you are missing in several areas of general security:
- You (or anyone else) did not view the review content - you allow individuals to display the content.
- You do not apply the correct or safe programming methods and do not seem to understand that you can control the transmission from point A to B.
3. PHP syntax is too complicated / hard to teach people style
True, this is no more complicated than the psuedo syntax created by template systems such as Smarty, so if this is a problem, then dynamic content is not for you.
PHP's short syntax contains the following: - Is it too complicated?
<div class='username'><?= $username ?></div>
4. It is too much to develop my own solution.
Although I would not argue, you can choose whatever you want! Choose everything that best suits your needs. They are usually free, not difficult to integrate, and come with many features out of the box.
I get the impression that most people choose templates simply because they look "leading" in the file - they like to think that the TPL file is a special thing that they created, they like the syntax; Itβs as if by some magic the variable is βcalledβ by the small symbol @ or # and jumps from your logic to the output.
It looks like a trick - a beautiful sorceress (AKA The templating engine) attracts you with its beauty. Although eye-catching, it does bleed the demon and extracts your soul (server resources) in exchange for eye candies that no one else sees (your users will likely have a faster website and more features funded by $ $$ you 'saving when renting electricity / server)
<title>{{@title}}</title> Vs <title><?= $title ?></title>
I agree, there is only one case that I can think of, in which the templates have some kind of foundation for PHP - Portability for other applications. appartisan responds to these addresses. However, itβs easy to replace <?= $var ?> {{@var}} - this is the job for templating-esque.