Here's how to safely output a variable in PHP:

<?php echo htmlspecialchars($name); ?>

Here's how to do the same thing in Django:

{{ name }}

That's the thing that bugs me most about PHP: it's not even a productive templating language!

I didn't realize Django is a language. Lets not compare frameworks to languages.

I personally think PHP it blurs the line between a language and framework. The "framework" part is the 20,000 builtin functions and the mechanism it provides for executing code as part of a dynamic web request.

In any case, my intent wasn't to compare Django to PHP, it was to point out that PHP's default way of outputting things really does make it inconvenient to write secure code - hence answering the parent post that argued that poor security had nothing to do with the language used.

Django is a framework, but it also has a language for writing templates, which is what the example above is written in.

You are comparing apples to oranges. Django is a framework built on Python. Python doesn't provide anything to escape strings. I'm sure there are also PHP frameworks and templating languages which make this very easy.

I realize I'm playing devil's advocate because I love Python, but you shouldn't put blame nor give credit where it isn't due.

See my reply here: http://news.ycombinator.com/item?id=209259

Here you go:

function o($name) { echo htmlspecialchars($name); }

o($name);

You still need to do this:

<?php o($name); ?>

I've used this exact function in my own code, though I call it "h". Really sucks that we have to do this - not to mention that PHP's global namespace for functions means it's better to have long names that are more likely not to clash with third party code.

Actually you can use the <?= syntax to make it even more concise:

function o($name) { return(htmlspecialchars($name));}

<?=o($name)?>

which lo, and behold, looks a lot like the rails candidate below.

You can't write code for redistribution like that though as most PHP installations have that option disabled since ti inteferes with XML processing instructions.

And in Rails

<%= h(@var) %>