Hacker News Reader

Comment by mappu | Hacker News Reader

You forgot `ENT_QUOTES | ENT_SUBSTITUTE` on `htmlspecialchars`, it's perilous to use directly in every single place. But after embracing `short_open_tag` (or `<?=` is always available in 5.4+), foreach, `\PDO::FETCH_OBJ` and a helper function;

    <?php foreach($row in $results) { ?>
        <div><?=h($row->field)?></div>
    <?php } ?>

Is it really longer/worse than the equivalent twig/smarty/handlebars ?

View on HN

>You forgot `ENT_QUOTES | ENT_SUBSTITUTE` on `htmlspecialchars`, it's perilous to use directly in every single place.

I would have added it in real code... but manually escaping everything is still what you have to do with raw php. At the very least, have something to recursively escape an array (keys and values) before it gets dumped onto the page.

Twig at least lets you escape by default (and you don't have to worry about double-escaping), but the equivalent wouldn't be much less verbose. Twig's syntax is a bit cleaner in couple of places I think, and it lets you use array bracket syntax [] in versions of PHP too old to support it natively.

   {% for row in results %}
     <div>{{ row.field }}</div>
   {% endfor %}

Of course this doesn't include the added complexity of an entire framework implementing its own language running on top of everything but still, the environment is a bit more sane.

Meh. With short tags, and a helper function which can be abstracted away in your stack, you can write the following:

  <? foreach($row in $results): ?>
    <div><?= $row['field'] ?></div>
  <? endforeach ?>

(Assume the helper function maps htmlspecialchars over an array returned by PDO::FETCH_ASSOC.)

At that point, though, once you no longer have to echo and escape everything, you have a templating framework on top of PHP. The number and complexity of 'helper functions' differs between this and something like Twig, but it's still using abstractions to manage what PHP doesn't do well on its own.

A lot of self-described minimalist templating languages do wind up looking a lot like that. I personally don't want to see raw PHP in anything i'm calling a template but to each their own.

Reply on news.ycombinator.com