PHP 8: Before and After

Re:PHP 8: Before and After by tannhaeuser on Friday October 23, 2020 @06:28AM (#24867933)

Backward-compat and syntax doesn't have to be a problem. The `<?php ...>` processing instruction can stay as it is, only to be augmented with a new opt-in mechanism based on entity expansion (the fully context-aware templating mechanism built-in to SGML/XML). Eg roughly

    <title>bla</>
    <?php let x =
      "<p>whatever</p>"?>
    &x
    <div class="debug">
     <![ RCDATA [
       &x
     ]]>
    </div>

where x is bound to markup checked against permissible elements in the first context (eg rejecting <script>) and escaped into <p>whatever<p> in the second. Rejecting script elements in user or other dynamic content as well as escaping comes for free with regular SGML parsing.

[ Parent | on HN ]

Re:PHP 8: Before and After by shawnz on Friday October 23, 2020 @06:50AM (#24868080)

There are many cases that doesn't solve, for example, how can I conditionally decide to either inject an attribute or not inject it using this technique? How do I mix user-controlled text which should be escaped with dynamically generated HTML in PHP strings that I don't want to be escaped? How will scope be managed and can those constants be redefined (not normally a concern in SGML)?

Plus, what makes you expect this opt-in syntax would catch on if people already don't care enough to use HTML-aware template engines?

EDIT: Also, what happens if the static parts of the document aren't syntactically correct SGML? How can you even know if the final output will be syntactically correct SGML until you run all the legacy parts of the PHP code that output directly in the document stream?

[ Parent | on HN ]

Re:PHP 8: Before and After by tannhaeuser on Friday October 23, 2020 @10:41AM (#24869967)

Good points, some of which can be addressed:

Re: conditionals SGML allows marked sections to have parameter entities as keywords, and recognizes INCLUDE/IGNORE in their expansions:

    <!entity % e "include">
    ...
    <![ %e [
      will only be included if
      e expands to INCLUDE
    ]]>

Re: mixed user/system text SGML supports quite restrictive content model exclusions, eg the "-(script)" part below makes SGML reject script elements in main's content anywhere:

    <!element main - - ANY
      -(script)>

Moreover, you can declare an entity as a so-called data text entity, special chars in which are preserved

Re: running legacy parts There's no difference to what PHP does now eg just running through the page/template doc until the end, erring out on validation errors?

[ Parent | on HN ]