PHP vs template engine [closed]

Question

For template engines:

1. Added security for end-user customization. Themes in pure PHP have unconstrained ability to cause harm to a user and their installation. Thus a template engine removes that risk, if it is a good one.
2. Ease of use for non-programmers, such as graphic artists or web designers.

For plain-php:

1. The speed of pure PHP cannot be matched by any template engine built atop it.
2. The full power of PHP is available to the output, and not just an interpreted or filtered portion.

I prefer PHP itself if at all possible. And most folks don't want to hack your software by making a custom theme, so it's easy to take a cursory read and investigate its security. That said, I am the "between guy" who does both templating and programming, and even some graphic arts; my skillset differs from a strict programmer and a strict artist/designer.

I found that when I introduced Smarty, it was fairly straight forward to get web designers to produce HTML with smarty variables. The folks on the programming team now concentrate on more back-end work, that is, the production of the content of the Smarty variables.

This has shortened the development lifecycle, with work being able to be split between more people, and has ultimately led to better designs.

Well, it's just my opinion, but template engines suck. You have to first understand how the template engine is implemented and then learn how to use it. It seems just wasted time, because PHP alone does it best and offers much more flexibility.

The following reasons apply:

• Separating your application into templates with an engine makes your application less vulnerable to halting code errors
• Using templates can give you greater flexibility in the future when refactoring because the namespace won't be directly built into the application
• Using templates encourages (forces) developers to keep business logic and code OUT of the presentation layer.
• Using templates it is easier to mock up datasets and pass them to a template engine and get a preview of what the site will look like with data

Using a template engine can be helpful if you have a non-programmer doing the templates. In many cases, the simplified template language can be easier for a non-programmer to pick up than PHP itself.

That said, I find myself moving away from using templates when it's just me (or me and other developers).

PHP is not a template engine, but a language that can be used to write templates, or template engines. A template engine is not just a language, but also the programming API that allows the scripts to locate, organize templates or assign the data from the script to them. Pure PHP offers you absolutely nothing - it is just a language. Instead, you should take such libraries, as Zend_View in Zend Framework to comparisons (basically, it works exactly in the same way, as Smarty, except that it uses PHP to write templates). You should ask whether you should use a template engine with PHP or something else as a template language.

When it comes to templating languages themselves, then well... ordinary loops and conditions are enough to write templates, but this "enough" does not mean that it is easy, comfortable, efficient or flexible. PHP does not offer anything special for template designers, but many "templating languages" (like Smarty) provide just a limited subset of PHP, so I'm not surprised that programmers choose PHP. At least they can write functions and use OOP which is too massive for this (in my opinion), but does work and really helps.

The point is that custom templating languages are not limited with PHP drawbacks, but their designers unsually do not see it, claiming that "displaying variables and a loop is enough". The possible areas, where templating languages could be much more effective:

• Form displaying and rendering (I haven't seen any framework with PHP as a templating language that provided an easy, flexible and generic system for customizing the form look).
• Understanding the HTML/XML document structure.
• Automatic XSS injection filters.
• Solving various common problems in the presentation layer (i.e. customizing the look of the pagination system, displaying the data in columns etc.)
• Template portability and true separation of the application logic and implementation details from the templates.

Examples of templating languages that follow this way are mentioned above PHPTAL and Open Power Template 2. Some similar ideas can be also found in TinyButStrong, but unfortunately this template engine is extremely slow.

PHP as template engine will not complain when you mix up your HTML syntax. It will let you forget to close tags, mis-nest them, etc.

PHP's output is not escaped by default, so unless you remember to rigorously add htmlspecialchars() everywhere, your site will have HTML injection (XSS) vulnerabilities.

<p>Hello <?= $name ?></b>
<!-- Simple template full of errors -->

These problems are much worse when you try to generate XHTML properly. It's not that you can't do that with plain PHP - of course you can - but that requires more effort and diligence.

That's why my recommendation is PHPTAL. OPT2 is OK too.