> <i>Yii 2.0 helps you to write more secure code. It has built-in support to prevent SQL injections, XSS attacks ...</i><p>This is just a minor complaint, but it's so pervasive among web frameworks that I must complain yet again.<p>According to the documentation for Yii 2.0, the recommended way to output a variable to a web page is:<p><pre><code> <?= Html::encode($var) ?>
</code></pre>
Not the PHP standard:<p><pre><code> <?= $var ?>
</code></pre>
Because if you do the latter, you will be vulnerable to XSS.<p>But why does every framework (and many template engines) insist on telling you to call a specific function in the template in order to get XSS protection? HTML escaping should be turned on by default, by whatever means possible.<p>The simplest template syntax should also be the most secure, not the other way around. Because sooner or later, somebody is going to forget to call that function.<p>Auto-escaping also saves a lot of clutter in templates, since there are usually only a few places in any given page (usually the content of a post) where HTML content needs to be printed unescaped (but filtered, of course).<p>Some frameworks escape everything by default and only allow you to print raw HTML if you add a "noescape" flag. This is better, but some of them only do this if you turn on some sort of "autoescape" flag at the top. This is just as bad, since it is insecure by default.<p>One might point out that not all escaping is the same, since different escaping rules apply in different contexts. But do we really have no way to detect, when parsing and compiling a template, which context we're currently in?<p>XSS protection in modern template engines should be opt-out, not opt-in. Otherwise they have no right to claim XSS protection as a feature.