Content deleted Content added
→Next Generation Shell: remove section. we have no article on this language. no reliable sources cited. no evidence this language meets notability requirements for inclusion in Wikipedia |
Cleanup 1 reference: convert <ref>URL {{webarchive}}</ref> to <ref>{{cite web}}</ref>. NB: title etc is missing, and will display error msg |
||
Line 1:
{{short description|Replacing placeholders in a string with values}}
In [[computer programming]], '''string interpolation''' (or '''variable interpolation''', '''variable substitution''', or '''variable expansion''') is the process of evaluating a [[string literal]] containing one or more [[Form (document)#Placeholders|placeholders]], yielding a result in which the placeholders are replaced with their corresponding values. It is a form of simple [[Template processor|template processing]]<ref>"[http://www.cs.usfca.edu/~parrt/papers/mvc.templates.pdf Enforcing Strict Model-View Separation in Template Engines]", T. Parr (2004), WWW2004 conference.</ref> or, in formal terms, a form of [[quasi-quotation]] (or logic [[
String interpolation is an alternative to building string via [[concatenation]], which requires repeated quoting and unquoting;<ref>{{Cite web|url=http://perlmeme.org/howtos/using_perl/interpolation.html|title = Interpolation in Perl |quote="This is much tidier than repeated uses of the '.' concatenation operator."}}</ref> or substituting into a [[printf format string]], where the variable is far from where it is used. Compare:
Line 20:
== Security issues ==
String interpolation, like string concatenation, may lead to security problems. If user input data is improperly escaped or filtered, the system will be exposed to [[SQL injection]], [[script injection]], [[XML External Entity Injection]] (XXE), and [[cross-site scripting]] (XSS) attacks.<ref>{{cite web |url=http://google-caja.googlecode.com/svn/changes/mikesamuel/string-interpolation-29-Jan-2008/trunk/src/js/com/google/caja/interp/index.html#-autogen-id-1
An SQL injection example:
Line 456:
* [[Quasi-quotation]]
* [[String literal]]
* [[
== Notes ==
| |||