Hacker News Reader

Comment by ptx | Hacker News Reader

A template language that requires manually calling htmlspecialchars on every single value (or else you have an XSS vulnerability) seems like an enormous footgun. In Django this problem was corrected before the 1.0 release.

View on HN

PHP isn't really used as a template language any more. Most people use a different template language for the views. I've implemented two myself[0][1] but an early one was Smarty[2] and there are many others. I hear Twig is pretty good[3].

[0]: https://github.com/jbboehr/php-handlebars [1]: https://github.com/jbboehr/php-mustache [2]: https://www.smarty.net/ [3]: https://twig.symfony.com/

If you're not using it as a template language though, why use PHP in the first place? Having to use a separate framework puts it on equal footing with every other language.

it just works with no fuss. no compiling. no memory leaks because it dies after every request. the standard library, despite being horrifically inconsistent, has everything you need

Is this issue a footgun in Symfony, since you're comparing a framework of one language (Python) with a PHP language by itself?

> ... when tied to a framework to avoid the footguns.

Escaping is typically handled in the framework.

Oops, I missed that part when I read the comment I was replying to. Thanks.

Are you talking about outputting unsafe user input? Laravel is the Django of the php world and does that out of the box. You could clean your user input before storing/displaying as best practice suggest.

>Django

You need to use a similar PHP framework, with one such framework you don't need to escape html or sql stuff.

Reply on news.ycombinator.com