All geek questions in one place

What is an effective hidden secure template system for PHP?

(Annotation: my users should be able to edit the structure of their dynamically created web pages without being able to do any damage.)

Hello ladies and gentlemen. I am currently working on a service where clients from a certain demography can create a certain type of website and fill it with their own content. The system is written in PHP.

Many users of this system want to edit how their particular website looks, or, as a rule, the designer does it for them. CSS editing is great and dandy, but sometimes it’s not enough. Sometimes they want to shuffle the whole page structure by editing the raw HTML of dynamically created web pages.

The template system used by WordPress, as I understand it, is ideal for my use. Except for one thing that is critical. In addition to the fact that you can edit the display of comments or when the menu goes, someone editing a template may have this template to execute arbitrary PHP code.

Since the same code base works with all these different sites, all the content in the same database, which allows my users to run arbitrary code, is clearly out of the question.

So what I need is a stupefying system, an idiotic template system where my users can edit most of the page structure themselves, pulling out dynamic sections anywhere, without even being able to echo 1 + 1 ;.

Observe the following psuedocode:

<!DOCTYPE html>
<title><!-- $title --></title>
<!-- header() -->
<!-- menu() -->
<div>Some random custom crap added by the user.</div>
<!-- page_content() -->

, . - . .

, , - . - , ?

.

+3
4

Twig.

http://www.twig-project.org/

, .

: Twig . Twig , .

, , ? , , , , - , .

, , ? , PHP , , .

http://github.com/bobthecow/mustache.php

+5

Smarty?

http://www.smarty.net/

security settings, , , .

, , - , , , .

+4

http://dwoo.org/

Dwoo - PHP5, 2008 . , Smarty, , . , , , PHP4, - PHP5 .. , Dwoo , . , Smarty, , , Smarty, Dwoo .

+1

What is the difference between <!-- $title -->and <!-- header() -->?
Why not make it the same style, and then just <!-- $header -->just str_replace?

0
source

Source: https://habr.com/ru/post/1739409/

More articles:


All Articles