Question

Modern template engines for php (say, dwoo or smarty) can use objects as variables. You can use {$obj->method()}, which is really convenient, and i am using this a lot. But, there is a clear security problem with exporting directly objects from ORM, which have methods such as insert, delete etc. Is there any sane method to expose only part of methods to template engine? I was thinking of wrapper exposing only whitelisted methods:

$aTplVars = array (new TplWrapper(new User($nUserId),  array( getAccount , getStatus )));

你们的想法是什么(明确的业绩管理)? 或者,在现有的一些实验室发动机中,可能有一些类似的东西?

Answer 1

您可以在项目设计后将“pple”作为目标(或我知道的任何语言)。采用物体似乎有色,但你应当为控制器的模板提供相关数据,并将其放置在你可以安全分配给模板的阵列中。

友情链接