Comment by jaxxzi
17 hours ago
I've never quite got the deal with 'template engines'. I have always just done normal programming - in whatever language I'm using - and interspersed outputting raw string literals to create the html.
17 hours ago
I've never quite got the deal with 'template engines'. I have always just done normal programming - in whatever language I'm using - and interspersed outputting raw string literals to create the html.
and this leads to html injection attacks when there are small errors in your escaping.
Using a template engine means you systematically ensure that values are escaped (at least, that's one of the reasons i would choose an engine over raw dogging the html).
You can have a safe library that does this and then enforce its usage with a linter or something. Template engines print strings and escape them under the hood.
eww gross.