Support
Frequently asked questions
Answers on security, requirements and the engine's boundaries. Missing something? The full guide lives in GUIDE.md in the download package.
How is UIEngine different from Twig or Smarty?
UIEngine follows the same basic idea (separating logic from presentation, its own template syntax) but is deliberately kept compact: no external dependencies, a single, clearly readable grammar parser for expressions, and a built-in, optional security-policy sandbox for environments with multiple, differently trusted template authors.
Does UIEngine use eval() internally?
No. Every expression (in {if}, {math}, plugin arguments, variables and modifiers) runs through a recursive grammar parser (ExpressionCompiler) that only allows a fixed set of constructs. Function calls, method calls and "::" are categorically excluded.
Which PHP version is required?
PHP 8.1 or newer. The engine uses modern language features such as readonly properties, match expressions and nullsafe operators in the generated code.
Do I need Composer?
No, but it's supported. Without Composer it's enough to copy the folder and include UIEngine/src/Autoload.php – a small, self-contained PSR-4 autoloader takes care of the rest. With Composer, its autoloader is used automatically instead.
What exactly does the security-policy sandbox do?
It further restricts an already-secure engine: limit allowed modifiers to a whitelist, restrict which PHP constants are visible via {$engine.const.*}, allow extra template directories, disable {eval} entirely, and allow {fetch} only for explicitly whitelisted file/URL prefixes. Useful as soon as multiple, differently trusted template authors share the same engine instance.
How does caching work?
Compiled templates are stored as PHP files in the cache directory and only recompiled on change. On top of that, display($template, $cacheId, $lifetime) can cache the entire rendered page – sections inside {nocache}...{/nocache} are still re-evaluated on every request regardless.
Can I register custom tags, modifiers or plugins?
Yes, on three levels: simple function plugins via register(), block plugins via registerBlock() (transform already-rendered content), and full compiler plugins via registerCustomTag() for entirely new tag syntax.
Is UIEngine suitable for multiple, independent template authors on the same install?
Yes, that's exactly what the SecurityPolicy sandbox is for. Without a policy set, the engine behaves openly (intended for a single, trusted codebase); with a policy set, modifiers, constants and file access can be restricted per instance.
Where can I find the full documentation?
The download package includes GUIDE.md with 17 sections covering everything from installation to every language feature to troubleshooting, each with runnable examples. This website summarizes the key points but does not fully replace the detailed guide.
How do I report a security issue?
Via the contact details included in the download package, with as precise a description as possible and a minimal reproduction example. The engine has already been externally audited at least once (see the v15 changelog); further reports are explicitly welcome.
Didn't find your answer?
The full guide covers every language feature with runnable examples.