February 25th, 2014 at 8:38 PM
I've now officially begun working on the template engine. I found a very simple tutorial online to show me how it's done, and overall I'd say it's worked pretty well on an independent test.
Unlike MyBB, you will actually have to explicitly set template variables in the code. This may make the code a little messier, but it is more secure as it ensures that only data that is explicitly set can be included in a template. Someone can't, for example, include the database password and reveal that through a malicious template.
For example:
Would reveal something like:
In the PHP, template variables are set something like this:
I have yet to implement this outside of an independent testing environment, but this is what I've got so far, and we shall see how this works. (In case you're wondering, I got the idea to do it using this method from this tutorial, although I'm definitely not following it exactly. )
Unlike MyBB, you will actually have to explicitly set template variables in the code. This may make the code a little messier, but it is more secure as it ensures that only data that is explicitly set can be included in a template. Someone can't, for example, include the database password and reveal that through a malicious template.
For example:
Code:
hello world, [@user]! <br />
Age: [@age].<br />
Occupation: [@occupation]. </br />
Interests: [@Interests] <br />
Would reveal something like:
Quote:hello world, Darthness!
Age: Unknown
Occupation: Restaurant worker
Interests: Lots of stuff!
In the PHP, template variables are set something like this:
Code:
$templates->set("template_hello", "user", "Darthness");
$templates->set("template_hello", "age", "Unknown");
$templates->set("template_hello", "occupation", "Restaurant worker");
$templates->set("template_hello", "Interests", "Lots of stuff!");
echo $templates->parse("template_hello");
I have yet to implement this outside of an independent testing environment, but this is what I've got so far, and we shall see how this works. (In case you're wondering, I got the idea to do it using this method from this tutorial, although I'm definitely not following it exactly. )