Hacker News new | past | comments | ask | show | jobs | submit login

Advantages: Automatic tag closing. Near elimination of XSS opportunities (once you write proper escaping in the first place). Ability to take advantage of all normal code constructs without having to explicitly import them into the template language directly, which allows for some nice abstracting.

Disadvantages: Performance; it is intrinsically slower to process things on a tag-by-tag basis than to just blindly shovel out bytes from a template. Optimization may be able to get this to the point you don't care, but you're starting out behind. The classic "designers can't handle this directly" argument cited several other times. There are other reasons to think that maybe templates shouldn't be in a Turing-complete language (though I'd argue once you are there it might as well be a nice Turing-complete language and not a hacked-together one).

Personally, I'm not a huge fan of the "dumb designers" argument because any designer that dumb is probably lobbing in XSS vulnerabilities everywhere, but that depends on your framework. I also think that if your language starts out looking just like a slightly-respelled HTML that it's hardly any different than current template languages, which aren't actually HTML either. But most people seem to stop at the "designers" argument and consider it to trump all, no matter what the other advantages may be.

Personally, I lean in favor of using a code-based system because in my value system, "preventing XSS and other injection vulnerabilities" rates above everything else, even "designers can modify my code" and building HTML with code makes this much easier to enforce, but... evidence is pretty strong I'm unusual in this view.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: