Home Login Create account Contact Help
Close

Login to your account

Other Options

Comments feed

In response to Practicality versus Purity in Python templates

There are a number of very powerful template languages available in Python. Some template languages, such as Genshi [genshi.edgewall.org], allow complex Python statements and even full Python code within the template file. Others, such as Django [djangoproject.com] templates, prefer to restrict templates to presentation only and do not allow general Python expressions within the body of the template.

In the context of a web framework, is it better to have the full expressiveness of Python, or restrict templates to presentation only?

...

NB. You can post code with the [code] bbcode tag. Many languages are supported. e.g.

[code python]

print "Hello, World!"

[/code]



Glyph Lefkowitz argues for "Presentation only"
Thu, 28 Feb 2008 by glyph
Rank 2. Average +1.0 ( 4 votes )

Templates are a resource that should be loaded and manipulated by code. Ideally you should be able to load that resource from an untrusted source, for example to allow users to customize their own presentation.

Asking whether you should be able to put Python in your templates is like asking whether you should be able to put Python in images or sound files. The expressive power of Python is fabulous when you're writing programs and should always be close at hand, but Python code goes in Python modules, so it can be found, loaded, inspected, tested, and documented. Instead of asking Django "why do you make it so hard to put Python code in HTML templates", we should ask Genshi "why do you make it so hard to put Python code in Python modules"? It seems like it should always be easier to do the latter.

Christopher Perkins comments...
Fri, 29 Feb 2008 by percious


Asking whether you should be able to put Python in your templates is like asking whether you should be able to put Python in images or sound files.

The reason people don't put code in images and sound files is that they are meant to be purely data, and it poses a security risk... Also, if you look at the gif89a spec you can see that you are able to put a little mini-program in your file to create animated gifs. It might not be python, but it is code.



we should ask Genshi "why do you make it so hard to put Python code in Python modules"? It seems like it should always be easier to do the latter.


As far as I know genshi does not make it hard to put code in your module. Perhaps you could explain what you mean by this.
Glyph Lefkowitz comments...
Fri, 29 Feb 2008 by glyph
According to Christopher Perkins:


The reason people don't put code in images and sound files is that they are meant to be purely data, and it poses a security risk... Also, if you look at the gif89a spec you can see that you are able to put a little mini-program in your file to create animated gifs. It might not be python, but it is code.


If Python provided a fully resource-controlled jailed execution environment, perhaps the answer would be different, and data files could contain code. Hopefully one day this will be a reality.






As far as I know genshi does not make it hard to put code in your module. Perhaps you could explain what you mean by this.


Python modules are clearly the right place for Python code. If Genshi makes it so that sometimes you want to put code into a data file like a template, why has it made it easier to do that than to put the function where it goes, in a python file?
Will McGugan comments...
Sat, 01 Mar 2008 by admin
According to Glyph Lefkowitz:

Python modules are clearly the right place for Python code. If Genshi makes it so that sometimes you want to put code into a data file like a template, why has it made it easier to do that than to put the function where it goes, in a python file?

I don't think it is made easier by design. Its just easier because changes are limited to a single file when adding code to the template.


Return to debate