There is nothing great about this sort of thing:
<?php for($i=0; $i<$num_rows; $i++) { ?>
<div><?php echo htmlspecialchars($db_row[$i]['field']); ?></div>
<?php } ?>
repeated ad-nauseum across hundreds of files.And then somebody decides to drop php variables directly into javascript and css...
No. No no no.
<?php foreach($row in $results) { ?>
<div><?=h($row->field)?></div>
<?php } ?>
Is it really longer/worse than the equivalent twig/smarty/handlebars ?I would have added it in real code... but manually escaping everything is still what you have to do with raw php. At the very least, have something to recursively escape an array (keys and values) before it gets dumped onto the page.
Twig at least lets you escape by default (and you don't have to worry about double-escaping), but the equivalent wouldn't be much less verbose. Twig's syntax is a bit cleaner in couple of places I think, and it lets you use array bracket syntax [] in versions of PHP too old to support it natively.
{% for row in results %}
<div>{{ row.field }}</div>
{% endfor %}
Of course this doesn't include the added complexity of an entire framework implementing its own language running on top of everything but still, the environment is a bit more sane. <? foreach($row in $results): ?>
<div><?= $row['field'] ?></div>
<? endforeach ?>
(Assume the helper function maps htmlspecialchars over an array returned by PDO::FETCH_ASSOC.)A lot of self-described minimalist templating languages do wind up looking a lot like that. I personally don't want to see raw PHP in anything i'm calling a template but to each their own.