Hacker News Reader

He mentions that SSGs require tooling and dependencies.

And if all you need are dynamic headers and footers, just wrap those in 'php include' tags and rename the files to .php. It's still HTML and CSS that's getting rendered.

View on HN

I’m not a web guy—- this should be safe from php vulnerabilities I would think, because there is no db and it’s just taking advantage of very limited/basic features of php right?

Php vulnerabilities are introduced by the developer.

The number of vulnerabilities is vastly reduced due to the static nature of the site. You aren't buying anything on it, or inputting other kinds of data that needs to be written to a database. It may as well be a read-only site.

I've used both server side rendering and server side includes. A static site generator beats both. Just have a listener that will re-generate the site live when you write new content, then just ssh/ftp the generated content to the server when you are done, or if you are fancy you can use version control and push to a repo with a CI toolchain that will regenerate and ssh/ftp it for you.

Reply on news.ycombinator.com