No eval()
Every expression runs through a recursive grammar parser instead of preg_replace code generation. Function calls, "::" and method calls are categorically excluded.
PHP Template Engine
UIEngine
A lightweight PHP template engine that cleanly separates logic from presentation – no eval(), strict auto-escaping by default, and an optional security sandbox for environments with multiple template authors.
v15 · externally security-audited · PHP 8.1+ · zero dependencies
What is UIEngine?
UIEngine compiles its own compact template syntax (.tpl files) into cached PHP. Unlike an earlier pre-release version, the current compiler never falls back to raw text substitution: every expression runs through a recursive grammar parser that only permits a fixed, vetted set of constructs – variables, comparison operators, array/object access, but no function or method calls and no ::.
The result: template authors get a familiar, Smarty-style syntax with inheritance, includes, modifiers and custom plugins – developers keep full control over what a template can actually execute.
Six reasons for UIEngine
Auto-escaping
{$var} output is HTML-escaped by default. Anyone who wants raw output has to request it explicitly with |raw – never the other way around.
Inheritance & includes
{extends}, {block}, {parent} and {include} for reusable layouts, plus {function} for your own template macros.
Security-policy sandbox
Optionally restrict: allowed modifiers, visible PHP constants, extra template directories, disable {eval}, allow {fetch} only for explicitly whitelisted prefixes.
Output caching
Compiled templates are cached, entire pages optionally via display($tpl,$id,$lifetime) – dynamic islands stay live via {nocache}.
Zero dependencies
Pure PHP 8.1+, its own PSR-4 autoloader for use without Composer, but works just as well with it.
Here's what it looks like
A snippet from a typical page with inheritance, a condition and a loop:
{extends 'layout.tpl'}
{block content}
{if $user}
Hallo {$user->name}!
{else}
Hallo Gast!
{/if}
<ul>
{foreach $items as $item}
<li>{$item.name} – {$item.price|number_format:2}€</li>
{/foreach}
</ul>
{/block}Security is not an afterthought
The expression grammar is the engine's central security measure, not a filter bolted on afterwards. Paths for {include} and config files are resolved via realpath() and checked against the allowed directory before any file is read. In v15 the engine was additionally audited externally – every finding has been fixed, see the release notes.
Ready to get started?
The first page is running in a few minutes – the quick start walks through every step.