Menu
I am creating a service in which I want to allow end-users to edit HTML templates for web pages that allows for access to specific "variables" for inclusion in the template.
I know that liquid was designed for this very purpose, is secure (at least relatively), and is in heavy production use. However, I find the language to be fairly complex for end-users as compared to something like Mustache.
Mustache sounds great, but I am concerned about security... has it ever been used for end-user templates?
Basically I am looking for a templating engine I can use w/ Rails for end-users that is:
Liquid meets 1 & 2, but not 3-4. Mustache meets 2-4, but I'm not sure about #1 and that is non-negotiable.
Greatly appreciate any insights, experiences, or comments.
527
Mustache. Mustache is one of the most widely known templating systems that works for a number of programming languages, including JavaScript, Node. js, PHP, and many others. Because Mustache is a logic-less templating engine, it can be literally used for any kind of development work.
Pug is a template engine that allows you to write cleaner templates with less repetition. In Angular, you can use Pug to write component templates and improve a project's development workflow. In this article, Zara Cooper explains what Pug is and how you can use it in your Angular app.
A template engine enables you to use static template files in your application. At runtime, the template engine replaces variables in a template file with actual values, and transforms the template into an HTML file sent to the client. This approach makes it easier to design an HTML page.
Template engines are used when you want to rapidly build web applications that are split into different components. Templates also enable fast rendering of the server-side data that needs to be passed to the application. For example, you might want to have components such as body, navigation, footer, dashboard, etc.
Mustache is fantastic for interpolation and I can't imagine it ever exposing you to server-side vulnerabilities if you're using it for Javascript evaluation. It's the simplest, most powerful option. I don't know that non-programmers would understand it, but I'm sure it's simpler than Liquid.
Another option would be to use an existing simpler user markup set like BBcode or a rich-text editing library like TinyMCE. These are much reduced in functionality, but are easier to use for average people.
178
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
