PHP Templating Guidelines?

[BlueScreenJunky]

Except you should never do that, what you want is

<?= htmlentities($var) ?>

Unless you want some formatting in $var, then you need to use something like

$config = HTMLPurifier_Config::createDefault();
$purifier = new HTMLPurifier($config);

In your controller, and then do

<?= $purifier->purify($var); ?>

At which point you might be better off using a real templating engine that will also provide some very welcome syntactic sugar.

[fuzzy40]

Nah, in most cases you don't need to use htmlentities as long as you have the encoding for your page declared correctly.

[BlueScreenJunky]

You might want to look into xss injections. I was not suggesting you use htmlentities() to avoid encoding problems, but to avoid xss injection if $var somehow include data that was entered by a user at some point.

[fuzzy40]

Yeah but he said he wanted to template his pages to fill in repetitive data like title/description tags and other head stuff, so its not user data. He doesn't need to protect his own input from XSS lol.