Structure that scales.
THE PROBLEM
PHP allows mixing logic and markup freely.
WHAT THAT PRODUCES
Files nobody can modify safely Logic that cannot be tested Duplication
WHAT TO DO INSTEAD
Decide what to display in one place Display it in another
WHAT THAT MEANS PRACTICALLY
Code that queries, calculates and decides Templates that output
WHAT TEMPLATES SHOULD CONTAIN
Output, simple conditions, and loops over prepared data.
WHAT THEY SHOULD NOT CONTAIN
Database queries Business rules Complex calculation
WHY
Logic in a template cannot be tested and is difficult to locate.
WHAT TO ALWAYS DO IN OUTPUT
Escape values.
WHY
So content cannot be interpreted as markup.
WHAT FRAMEWORKS PROVIDE
Template engines that escape by default.
WHAT THAT PREVENTS
The most common web vulnerability, by default rather than by discipline.
WHAT TO REVIEW
Anywhere escaping has been disabled deliberately.
