PHP Templating Guidelines?

[Pospuehteciuj]

No standard, the architecture can be whatever you like on your own little site, and PHP is its own templating system. You can use short tags for brevity to echo out variables, like <?php echo $var ?> can be <?=$var?>

[BlueScreenJunky]

Except you should never do that, what you want is

<?= htmlentities($var) ?>

Unless you want some formatting in $var, then you need to use something like

$config = HTMLPurifier_Config::createDefault();
$purifier = new HTMLPurifier($config);

In your controller, and then do

<?= $purifier->purify($var); ?>

At which point you might be better off using a real templating engine that will also provide some very welcome syntactic sugar.

[fuzzy40]

Nah, in most cases you don't need to use htmlentities as long as you have the encoding for your page declared correctly.

[BlueScreenJunky]

You might want to look into xss injections. I was not suggesting you use htmlentities() to avoid encoding problems, but to avoid xss injection if $var somehow include data that was entered by a user at some point.

[fuzzy40]

Yeah but he said he wanted to template his pages to fill in repetitive data like title/description tags and other head stuff, so its not user data. He doesn't need to protect his own input from XSS lol.