Re: Play nice! Re: Savant/Flexy/Foo template engines

Hi,

Why don't we stop arguing about whether Savant will be in PEAR, and instead argue about how it will be in PEAR. Clearly, there is a significant need for a minimalist template engine, and Savant is that. In order to allow users to comfortably switch to a different engine if their requirements change would be a good thing for Savant, and a good thing for PEAR and by consequence, for PHP.

I agree on that but if synergy is not possible let it be. As I user I don't think I would welcome a uber-template when I could use and benefit largely for what Savant has to offer.

Granted; while I would love to see a unified template engine in PEAR, it does require collaboration between devs. If that collaboration is not forthcoming, then obviously there can be no unification. :-(

Scenario: I start using Savant as the template engine frontend for my website example.com. The site becomes popular, and users have lots of content to offer, so I would like to make it possible for them to code some pages. I can't offer them full access, and so the security risk of allowing access to PHP tags through Savant templates is unacceptable.

Not entirely sure but since I use Savant extensively both on a person and a professional site, here is my scenario: a) If I hire a graphic designer I simply give him the .tmp.php files. With any editor like Adobe Golive/Dreamweaver he can see the blue area which made up the php tags and he will not mess with that. b) the same issue of "messing up" the page might occur with smarty: e.g. <body> User Information:<p> Name: {$name}<br> Address: {$address}<br> If the contributor deletes the {} tags all is gone. The difference is that Savant will keep it as it should be, PHP. If you mean the risk of using php to do some exec or nasty stuff, well if the contributor has access to the CVS or FTP nothing stops him to upload his own script or overwrite my pages.

In general I agree here; if your template designers can't be trusted, then that's a problem. The template system they use may help minimize risk, but won't remove it. BUT: If your choice of template engine is based on the idea that your template designers are a security risk or are "too dumb", then your problems are organizational and managerial and educational, not technical. In that case, no matter what system you use, your template designers will be a problem. Having said that, there can be a legitimate need for reducing template functionality to a limited subset of commands; I'm not sure what that need might be, but I don't know every possible situation. Thus, I am not opposed to Savant (as it is, or some future version) being a base from which other template engines may spring.

c) I wouldn't allow access to a page to someone who is not able to read the code and pay attention to the php part ;)

See my point above about template designers being a risk. :-) -- Paul M. Jones Savant: the simple alternative to Smarty for PHP. http://phpsavant.com/ DB_Table: build RDBMS tables and XHTML forms in one PHP class. http://wiki.ciaweb.net/yawiki/index.php?area=DB_Table Yawiki: a collaborative online documentation system. http://wiki.ciaweb.net/yawiki/index.php?area=Yawiki Yawp: a single-file foundation for PHP applications. http://phpyawp.com/