Moving from Hack to vanilla PHP, I miss XHP T__T
This isn't XHP, but it does provide a minimum-bullshit method of generating HTML in a consistent and secure manner
<?phpusefunctionMicroHTML\{HTML,SECTION,H1,P,DIV};
$page = HTML(
SECTION(["id"=>"news"],
H1("My title"),
P("Here's some content")
)
);
$page->appendChild(
SECTION(["id"=>"comments"],
DIV("Oh noes: <script>alert('a haxxor is attacking us');</script>")
)
);
print($page);<html><sectionid='news'><h1>My title</h1><p>Here's some content</p></section><sectionid='comments'><div>Oh noes: <script>alert('a haxxor is attacking us');</script></div></section></html>- Tag attribute values and text content are escaped by default
- Tag names and attribute names are not escaped, it is assumed that the developer will be hard-coding these
- Tag attributes are not filtered other than escaping, so be careful when allowing user input in attributes (e.g.
href,src) to avoid XSS vulnerabilities rawHTML()can be used to insert unescaped content - it is the developer's responsibility to ensure that this content is safe
src/microhtml.php is generated by gen.php
composer install
composer check
git tag v1.2.3
git push --tags