Tonight I saw that the most fantabulous coder, and lead of the the Symfony Framework
Fabien Potencier
, holded posted a new article on his blog about Templating Engines in PHP
, and denoting a new templating engine: Twig
It Holds a good article, and I highly urge that you all move read it. But I took a couple of elisions to some of his statements against PHP
as a templating language itself, I conceive he grossly undercuted PHP-as-template in his enthusiasm to boost his new templating language that he maked. This blog station is hence justly a response to it. To it terminal, I 'd wish to get forth with a couple of groundrules for my treatment:
- Fabien 's thoughts, and blog station, are solid.
- Branchlet seems to be a great looking templating language
- While I prefer PHP-as-template, I understand why, and when, utilizing a templating language add up
So now, what specific points make I challenge thereto he doed? Lem me run through them each, in order he showed them:
Verboseness of but repeating a variable
From his blog:
The PHP language is verbose. You ask no to a lesser degree 14 characters simply to output a simple variable ( and no, employing the more compact & lt;? = cutoff is not an option ):
& lt;? php echo $ volt-ampere? & gt;
Therein lies my first ailment. He Holds taken forth an option that many regard valid. Yes, it Holds long been touted that employing short tickets, specifically the & lt;? ? & gt; version of them in PHP is reckoned bad pattern. In point of fact, I concur with them on it specific point. But it overlooks a really common pattern. Many developers while eschewing the & lt;? ? & gt; crosscut for long blocks of codification, still love, and exercise, the & lt;? =? & gt; shortcut specifically for templet.
Why make they make this? Merely put, it Holds highly simple, and takes the common ill that Fabien holds took upwardly. In point of fact, it is so common, begin inquiring developers and you will happen many that call: `` They can jimmy & lt;? = from my cold dead fingers. ''
So common, that there are a figure of people ( including myself ), who hold been pitching around the thought of advising a new option to the short_tags directional for PHP, permiting not simply holding them turned along or forth. But letting a Third option, that would enable & lt;? =? & gt; while disabling & lt;? ? & gt;
When this is maked, The PHP output rattlingly nearly agrees the Django
that was utilise as an illustration:
| Master: |
<?php echo $var ?>
|
|---|
| Short Ticket: |
<?= $var ?>
|
|---|
| Django: |
{{ var }}
|
|---|
Verboseness of output escaping
The article so too includes a treatment of how cumbrous it is to escape output in pure PHP, versus in most templating languages. I really ca n't directly differ with this one, as even applying short tickets, you finish up with the undermentioned comparing:
| PHP: |
<?= htmlspecialchars($var, ENT_QUOTES, 'UTF-8') ?>
|
|---|
| Django: |
{{ var|escape }}
|
|---|
The PHP version is ugly. So what am I reason here? What I 'm reason, is that the complete assumption is wrong here. It should n't count how complicated it is to escape indoors of the templating language, because you should n't be escaping indoors of your templating language
That statement belike only sat incorrect on some people. Afterall, the templating language is sayed to do things easy, right? Goodly, no. Templating languages are about separation of concern. And specifically in their one genuinely solid usage example - permiting non-programmers to edit guides - are about dividing the mortal redacting that file, from any of the codification.
Why so, would you bank the escaping of output, something that is critical to the safety and security of your site... to a non-coder who wo n't understand those deductions? The reply is: You should n't. Therefore it is my view that you should be dealing all escaping equally necessitated before the data gets to your templet. That Holds the only style to insure security. As a matter of fact, after in the page Fabien acknowledges to this, stating:
For me, security should be enabled by default, especially for guides pent by non-developers who are not necessarily cognisant of the common web menaces like XSS or CSRF.
Now where Fabien and I differ there, is that he believes the solution is only for the templating language to automatically escape everything. I personally dislike this attack, because indiscriminate or inappropriate escaping can make even as many issues as not escaping in the first spot. This is a slippery situation. Not one, IMO, to be left to chance. I thus greatly prefer holding the PHP codification itself, deal escaping in appropriate slipways. Leave that codification ' out of the guides.
Once you 've taking the escaping out of the guide ( either via magical escaping or manual ), the statement over ugly escaping, vanishes.
Discernability of control constructions
The statement rests again mostly in the kingdom of readability, and now turns to more advanced constructions. He specifically gives an statement of an representative that is really ugly in PHP:
<?php if ($items): ?>
<?php foreach ($items as $item): ?>
* <?php echo $item ?>
<?php endforeach; ?>
<?php else: ?>
No item has been found.
<?php endif; ?>
PHP is a great toolkit, which intends there are ever a vi slipways to make anything. That Holds great IMO equally far as a templating language because it intends that I hold different options to do something equally legible as possible. Regardless what. In the above situation, Fabien holds taken what is a little control construction with really small text, and written it inward, belike, one of the most ugly shipways possible to drive the point place. Rather peradventure unintentionally. Most coder would hold composed that as something like:
<?php
if ($items) {
foreach ($items as $item) {
echo "* {$item}\n";
}
} else {
echo "No item has been found.\n";
}
?>
That Holds not simply much more decipherable than the original version to a coder ( and one might reason to anyone ), but I even bump it more legible than the ( allowed, littleer ) version of this that Django supplies, because of holding an else ' statement that can be utilized to a for grommet, from Fabien 's instance:
{% for item in items %}
* {{ item }}
{% else %}
No item has been found.
{% endfor %}
Now I agnize that I 've sayed that I
bumped it more legible, and I likewise spoke about how a coder would rewrite this. I recognize at this point, I 'm commencing to cover ways, since maked n't I merely tell that the one existent use-case of a templating language, was for non-programmers? Well yes, and that Holds true. But recognize that there are other even simpler slipways to hold fulfilled the above. Such as a common trick of dividing storing a $noItemsMessage
variable if, as a matter of fact, no points were. Letting it to merely be directly output alternatively of as component of the overarching if/else.
But verily, this now takes directly into the following point:
Complexness of language
Fabien negotiations so about a figure of different points, specifically referring to other templating languages, about how they are not powerful plenty in many shipways. He attends to give a example of the powerfulness of Django, exhibiting representatives of template heritage, as a mode that it mimics category construction inside of the templet.
This is more a weakness of other languages, since you can straightly mimic Django 's functionality via the exercise of a couple of variables and include files, I 've bedded many times. But overall, I conceive again we begin to lose the point and commence to run into the other job when we commence discourse templating langauges.
Discourses of making heritage, or perplexed foreach w/ else statements, appear slightly moot tome. Afterall, was n't the original end again to hold non-programmers composing these guides? Suddenly these are sounding like a programing language wholly. As a matter of fact, they are. It Holds the common expletive of the templating language. It commences as simple. But as people take to execute more complicated labor for more complicated templet for more complicated websites, the demands of the templating language turns, and suddenly it Holds gotten it Holds ain programing language, and goes excessively perplexed for a non-programmer to apply, without larning basic scheduling attainments
This point, is where, in my past, serious treatments hold happed within organisation over `` So who should really be penning these guides now? ''.
So now permit 's get downwardly to a difficult statement by ME It is my ain personal thought, that if you employing a templating language, you should n't be making anything perplexed. That overcomes the intention. If people are attending be acquiring to indite codification, they should larn PHP and go helpful. Or the control of the guides should pass into the manuses of the coder. And if the guides are in the paws of the coder, holding PHP as your templating language intends naught new to acquire, for anyone.
It Holds a vicious circle, I recognise, but I maintain coming back thereto. In the main, you should ever
hold as much codification out of your guide as possible. There are e'er shipways to structure data to do the template simpler. If you are taking the majority of logic out of your guide thence, so holding a complex language makes n't count. ( Though, PHP should see all your complexness takes that you could ever desire anyhow )
A valid point
So it looks that I 've completely criticise Fabien 's article, but I desire that you make n't see it that mode. He does some good points. There are statements for applying his, or any, templating language. But as I got away stating, he looked fanatical in coming upward with exemplar, alternatively of seeking to place them on equal evidences.
There is; notwithstanding, one highly
valid point that he holded. What few templating languges offer you, and PHP definitely makes n't, is sandboxing. The ability to barricade the template codification from making certain actions. Accessing data it should n't, naming mappings that are inappropriate, etc.
If you are in a situation where you absolutely should permit guides be redacted by untrusted origins, and being printed unvalidated. ( Such as allowing users of a website edit guides on the fly ) So yes, you absolutely take to chance another option besides PHP-as-template
Related posts:
Michael Gongora
Twestival Art Auction: Tea with Slothfulness
Toilet Graham 's attorney invites run to continue on May 12
![[info]](http://l-stat.livejournal.com/img/userinfo.gif){kind=small}
