> Two years ago, I picked up Zig, and I’d never have imagined I’d be considering web development in such a low-level language.
This is kind of funny remark, given that the author started in 2000 in Web development, and with PHP 3.0.
I started in 1997, our distributed systems class had exercises to write CGIs in Perl and C.
Between 1999 and 2001, most Web development at my employer was in Tcl and C, ASP was naturally a mix of VB and C++ COM components, and there was also the fun to write all those mod_something Apache extensions, and IIS ISAPI modules, naturally in C and C++.
Ah, Microsoft was also shipping ATLServer, because who wouldn't want to use ATL for Web development, while Borland/Inprise was shipping similar stuff for Delphi and C++ Builder.
PHP itself, in 3.0, it was still the time that it hardly had much functionality builtin, so it was quite common to write extension modules in C.
So it is kind of ironic to read coming back to the way things were, before the slow scripting languages takevover in the 2010's, is something no one thought about.
For me web was always about these scripting languages. Even in the CGI days, I learned to use Perl just enough to do a simple web form. I kind of associated the domain with GC languages, as this kind of work usually involves many temporary strings and dictionaries. In fact, the first compiled language I ever used for a web project was Go, and even that was due to the fact that it has garbage collector.
I kinda like kotlinx.html in Kotlin; it's an eDSL for writing HTML in actual Kotlin. So I can put break points in my template code. It's a tiny bit slower than string-with-some-interpolation type of template libraries; but it's so little that it's a price I'm willing to pay. Also there's more impact on compile times than with string-with-some-interpolation type of template libraries.
The typesafety you get is what you already have in Kotlin, and there a little extra in that you cannot nest certain HTML-elements in certain other elements (adhering to the HTML spec). You can come up with your own elements and attributes, but the ones that are in the HMTL-spec are usually available in kotlinx.html as well (and thus can be auto-completed).
A large part of this library is generated from the actual HTML spec.
Claude Code seems to have not problem writing it (I barely write templates myself these days).
I wish Kotlin was given more attention by JetBrains than the AI nonsense they keep trying to build into, its clear they are going to lose in the AI space at this rate, but Kotlin has so much more potential and its nearly ten years old at this point? Oh its 15 whoops!
I love this design, especially as it takes advantage of the Zig build chain; I expect re-builds will be fast enough that you essentially get JS-style hot reloading in the dev cycle. Now we just need https://github.com/air-verse/air for Zig (Ziex has one built into its CLI, but that's only for Ziex)...
SGML (ISO 8879), the markup meta-language on which HTML is based, has that, as well as many other things, such as type-checked templating.
Hence HTML as a mere vocabulary making use of SGML's facilities didn't need to define its own ad-hoc mechanism.
Btw the <?php ...> construct is also derived from SGML. In SGML terms it's a "processing instruction" rather than an "entity reference", the latter being the basic means for content inclusion.
It's a markup language for documents. If you enable templating devs are then going to ask for more. Eventually it will end up turing complete. Such is the development arc of a lot of languages.
i'm also using a "type safe" templating engine (for kotlin, as a gradle plugin) of my own design that goes the other way - instead of embedding a model class into the template, a template class is generated that takes all the values as parameters.
the biggest upside for me is that this way there's full, free IDE support, i don't need to write extra view models if the mapping isn't 1:1 and performance is pretty good because in the end there's no runtime parsing/compiling/interpreting except for the baseline JDK stuff (though there are even faster engines).
warning: so far i'm the only user though, so don't use it in production. also, i'm working on some improvements right now which haven't been pushed yet.
Thank you for the article. I remember using Google Soy templates roughly 10 years ago. I think this is similar to what is used now when you make Helm templates for example or Go Templates.
It has the html escaping, JavaScript escaping etc built in.
Is there maybe a Zig wrapper for Google soy around?
Fun fact, I actually also had a fork of the Google Closure Templates that added support for Python. I used it briefly. I completely forgot about it, but I remember now I did enjoy using it back then. https://pythonhosted.org/Flask-Soy/
The linked thread here[1] is… illuminating. The Zig stdlib seems pretty buggy, and the much applauded IO interfaces seem to be struggling with cancellation. The BDFL doesn’t seem to have much to say other than “brush your teeth”
No, that's not the best description. The Io interface is actually one of the best cancellation stories out there. If you combine it with defer/errdefer, you get safer cancellation guarantees than you have in async Rust (you can do async "drop" for example). The only problematic part is the interaction between the Reader/Writer interface and the Io interface, with regards to error handling.
> The only problematic part is the interaction between the Reader/Writer interface and the Io interface, with regards to error handling.
The fact that error handling suffers when combining two of the base interfaces of the standard library is pretty rough though? I don't think rust has that particular problem.
It's a different approach to Rust. There, if you cancel a future, it stops polling and runs the Drop interface. You don't get to do more complex cleanup. But, at the same time, because cancellation is not an error that all functions have to propagate, it's structurally not possible to ignore it. Zig, like many other languages, uses a specific error to indicate cancellation. The application can decide what to do with it, it has some benefits. But unlike Python/Java where exceptions can he thrown from anywhere, Zig errors need to be named and that's where to issues comes from, because the Reader/Writer interfaces no longer are generic, they can't pass the concrete errors returned from the implementations, and cancellation is one of the errors that get hidden that way. It's a comprise either way, Zig would need to have first class support for comptime interfaces/traits to solve it better, but that's not going to happen. So in the meantime, there is a dilema how to handle it, but I'm sure it will get solved, or at least best practices will get developed.
I am not really convinced that new best practices will be developed or in included in the standard library because andrew thinks that there isn't an issue.
I have a partially written blog post in my head, as I've spent a lot of time thinking about the problem. I'd have preferred if there was a change to the reader/writer interfaces, but even without it, I'm starting to see patterns that work and can be applied to any code to make it safe. People just need to be aware of the problem and that's my goal, although I'm probably failing if my tone is creating the drama, so I'm learning how to communicate it better.
I don't think you are creating any drama to be honest. I understand how frustrating it must be.
There is a similar issue in kotlin where a cancellation is marked via a CancellationException but that extends IllegalStateException and thus Exception. Because of that it gets caught and swallowed all the time. This is a constant source of bugs for me at work and google has resorted to a bunch of linting to get around this design mistake.
Cancellation in Rust is problematic too but for other reasons than cancellation in Zig is problematic. Maybe there is just no free lunch here, but hopefully it can be fixed in Zig and Rust.
Not a zig person, but the post you linked has a good counter example on why the proposal for adding cancellation to the interface is bad: You would be forcing cancellation semantics on interfaces that might not want nor be able to provide one. Forcing a new method because the libraries are not well designed does not seem right for me. Maybe another solutions is available, but that is not one.
I get the pain, but the answer from Scott Redig totally makes sense. I am not sure what is worse: Libraries swallowing cancelled() or libraries lying that they support cancelled.
The point is libraries are agnostic. You as a library user provide io transport and loop implementation which supports/not supports cancelation. And you as as library user handle cancelation.
> Libraries swallowing cancelled() or libraries lying that they support cancelled.
I love the idea! I could imagine something similar created for other languages too. Perhaps written in a way that a template could be reused in, let's say Django, and a JS React frontend. With all the type-safety that tsx provides.
I recently built some templating language (rather an intermediary language for documents) for solving an accumulated frustration over the years. Already added into four or five of my projects (for templating html, emails, dashboards, chatbots messages, and some configs).
There was a brief period where everyone and their dog implemented mustache[0] as a template system, but it died quickly because cross-language templating is not that useful in the end, you seldom need to switch host language but keep the templates.
As for Django... well.. Django only has text formatting, you can write any garbage and broken html and lots of invalid templates with silent failures there unfortunately.
We created https://htpy.dev to solve this for our Django app. Has been using it in production for multiple years. Works great with Django (or any Python web framework).
This had me checking if anyone has implemented first-class support for Python JSX components in Django yet, and it could be... sort of... maybe viable with PyJSX? [1]
It looks like you'd have to implement something equivalent to provider/context functionality yourself if you want it, as well as a simple render()-like helper to render a component tree. I've not tried their VS Code plugin, but it's a good sign that they have one.
I've never quite got the deal with 'template engines'. I have always just done normal programming - in whatever language I'm using - and interspersed outputting raw string literals to create the html.
and this leads to html injection attacks when there are small errors in your escaping.
Using a template engine means you systematically ensure that values are escaped (at least, that's one of the reasons i would choose an engine over raw dogging the html).
If you can suppress your gag reflex, M4 can do some of what you want.
sinclude(...) will include a file and be silent in case of failure.
I did something like this for user-login history because I couldn't use
PHP or Perl:
I'm not a fan of Rust, the overly flexible macros are actually one reason for it, but if you can indeed get LSP support in a custom syntax like this, that's really awesome. Thank you for the example.
do you think that when compiler internals 'settle down' it will (gradually) be exposed through some interfaces (like compiler plugins in jai) so that we can more easily develop LSP for quasi-zig formats like this ?
That would be great, I really like openness and ~plugin interfaces of jai compiler internals ...
> Two years ago, I picked up Zig, and I’d never have imagined I’d be considering web development in such a low-level language.
This is kind of funny remark, given that the author started in 2000 in Web development, and with PHP 3.0.
I started in 1997, our distributed systems class had exercises to write CGIs in Perl and C.
Between 1999 and 2001, most Web development at my employer was in Tcl and C, ASP was naturally a mix of VB and C++ COM components, and there was also the fun to write all those mod_something Apache extensions, and IIS ISAPI modules, naturally in C and C++.
Ah, Microsoft was also shipping ATLServer, because who wouldn't want to use ATL for Web development, while Borland/Inprise was shipping similar stuff for Delphi and C++ Builder.
PHP itself, in 3.0, it was still the time that it hardly had much functionality builtin, so it was quite common to write extension modules in C.
So it is kind of ironic to read coming back to the way things were, before the slow scripting languages takevover in the 2010's, is something no one thought about.
Google probably still has a large chunk of web development happening in C++.
For me web was always about these scripting languages. Even in the CGI days, I learned to use Perl just enough to do a simple web form. I kind of associated the domain with GC languages, as this kind of work usually involves many temporary strings and dictionaries. In fact, the first compiled language I ever used for a web project was Go, and even that was due to the fact that it has garbage collector.
Fair enough, different life experience then.
I kinda like kotlinx.html in Kotlin; it's an eDSL for writing HTML in actual Kotlin. So I can put break points in my template code. It's a tiny bit slower than string-with-some-interpolation type of template libraries; but it's so little that it's a price I'm willing to pay. Also there's more impact on compile times than with string-with-some-interpolation type of template libraries.
The typesafety you get is what you already have in Kotlin, and there a little extra in that you cannot nest certain HTML-elements in certain other elements (adhering to the HTML spec). You can come up with your own elements and attributes, but the ones that are in the HMTL-spec are usually available in kotlinx.html as well (and thus can be auto-completed).
A large part of this library is generated from the actual HTML spec.
Claude Code seems to have not problem writing it (I barely write templates myself these days).
https://github.com/kotlin/kotlinx.html
https://dzone.com/articles/modern-type-safe-template-engines...
I wish Kotlin was given more attention by JetBrains than the AI nonsense they keep trying to build into, its clear they are going to lose in the AI space at this rate, but Kotlin has so much more potential and its nearly ten years old at this point? Oh its 15 whoops!
I love this design, especially as it takes advantage of the Zig build chain; I expect re-builds will be fast enough that you essentially get JS-style hot reloading in the dev cycle. Now we just need https://github.com/air-verse/air for Zig (Ziex has one built into its CLI, but that's only for Ziex)...
Looking forward to seeing some benchmarks!
W3C: Why can't we just have <includes src="./header.html"> and be done with it?
Nice idea!
https://web.dev/articles/imports
Been there, tried that.
Introduced in 2014 (Chrome 36) Deprecated 2018 (Chrome 70) Retired 2019 (Chrome 73)
You might be interested in https://github.com/WICG/declarative-partial-updates
SGML (ISO 8879), the markup meta-language on which HTML is based, has that, as well as many other things, such as type-checked templating.
Hence HTML as a mere vocabulary making use of SGML's facilities didn't need to define its own ad-hoc mechanism.
Btw the <?php ...> construct is also derived from SGML. In SGML terms it's a "processing instruction" rather than an "entity reference", the latter being the basic means for content inclusion.
We do.
https://www.w3.org/TR/xinclude/
https://www.w3.org/TR/xinclude-11/
<?php include "header.html" ?>
Yes, but then you need php
Why is there no direct support for templating in HTML itself?
It's a markup language for documents. If you enable templating devs are then going to ask for more. Eventually it will end up turing complete. Such is the development arc of a lot of languages.
> If you enable templating devs are then going to ask for more
This might be the worst argument for anything I've read this week, there's got to be a name for this logical fallacy
A "slippery slope" fallacy might be what you're thinking of.
SSIs are not widely supported any more, and were never a part of the HTML standard
(but yes- I used these a lot like 25 years ago)
From what I can tell, apache mod_include and nginx SSI are still included by default?
Can I introduce you to iframes? Clunky but they do exactly what you are asking for.
and in a much safer way, sandboxed.
i'm also using a "type safe" templating engine (for kotlin, as a gradle plugin) of my own design that goes the other way - instead of embedding a model class into the template, a template class is generated that takes all the values as parameters.
i.e. MyTemplate.tpl.html
which creates a kotlin class that can be used like this: the biggest upside for me is that this way there's full, free IDE support, i don't need to write extra view models if the mapping isn't 1:1 and performance is pretty good because in the end there's no runtime parsing/compiling/interpreting except for the baseline JDK stuff (though there are even faster engines).https://codeberg.org/h34tnet/tempolin
warning: so far i'm the only user though, so don't use it in production. also, i'm working on some improvements right now which haven't been pushed yet.
Nice work. This is a good approach IMHO, and (if you need validation) also the one adopted by Templ in Go, which has a 'generate' command to do this.
Thank you for the article. I remember using Google Soy templates roughly 10 years ago. I think this is similar to what is used now when you make Helm templates for example or Go Templates. It has the html escaping, JavaScript escaping etc built in.
Is there maybe a Zig wrapper for Google soy around?
Fun fact, I actually also had a fork of the Google Closure Templates that added support for Python. I used it briefly. I completely forgot about it, but I remember now I did enjoy using it back then. https://pythonhosted.org/Flask-Soy/
The linked thread here[1] is… illuminating. The Zig stdlib seems pretty buggy, and the much applauded IO interfaces seem to be struggling with cancellation. The BDFL doesn’t seem to have much to say other than “brush your teeth”
1. https://ziggit.dev/t/making-it-harder-to-swallow-error-cance...
No, that's not the best description. The Io interface is actually one of the best cancellation stories out there. If you combine it with defer/errdefer, you get safer cancellation guarantees than you have in async Rust (you can do async "drop" for example). The only problematic part is the interaction between the Reader/Writer interface and the Io interface, with regards to error handling.
> The only problematic part is the interaction between the Reader/Writer interface and the Io interface, with regards to error handling.
The fact that error handling suffers when combining two of the base interfaces of the standard library is pretty rough though? I don't think rust has that particular problem.
It's a different approach to Rust. There, if you cancel a future, it stops polling and runs the Drop interface. You don't get to do more complex cleanup. But, at the same time, because cancellation is not an error that all functions have to propagate, it's structurally not possible to ignore it. Zig, like many other languages, uses a specific error to indicate cancellation. The application can decide what to do with it, it has some benefits. But unlike Python/Java where exceptions can he thrown from anywhere, Zig errors need to be named and that's where to issues comes from, because the Reader/Writer interfaces no longer are generic, they can't pass the concrete errors returned from the implementations, and cancellation is one of the errors that get hidden that way. It's a comprise either way, Zig would need to have first class support for comptime interfaces/traits to solve it better, but that's not going to happen. So in the meantime, there is a dilema how to handle it, but I'm sure it will get solved, or at least best practices will get developed.
I am not really convinced that new best practices will be developed or in included in the standard library because andrew thinks that there isn't an issue.
I have a partially written blog post in my head, as I've spent a lot of time thinking about the problem. I'd have preferred if there was a change to the reader/writer interfaces, but even without it, I'm starting to see patterns that work and can be applied to any code to make it safe. People just need to be aware of the problem and that's my goal, although I'm probably failing if my tone is creating the drama, so I'm learning how to communicate it better.
The most frustrating part about it for me it's Andrew's argument: just write correct code. I have C at home.
I don't think you are creating any drama to be honest. I understand how frustrating it must be.
There is a similar issue in kotlin where a cancellation is marked via a CancellationException but that extends IllegalStateException and thus Exception. Because of that it gets caught and swallowed all the time. This is a constant source of bugs for me at work and google has resorted to a bunch of linting to get around this design mistake.
Yeah, I feel Andrew's tooth brushing argument is quite weak here. It is basically the same as the defence of C's error handling, which Zig fixed.
Cancellation in Rust is problematic too but for other reasons than cancellation in Zig is problematic. Maybe there is just no free lunch here, but hopefully it can be fixed in Zig and Rust.
The answer from Andrew sounds like that because there is a history between people from the core team and lalinsky.
Not a zig person, but the post you linked has a good counter example on why the proposal for adding cancellation to the interface is bad: You would be forcing cancellation semantics on interfaces that might not want nor be able to provide one. Forcing a new method because the libraries are not well designed does not seem right for me. Maybe another solutions is available, but that is not one.
I get the pain, but the answer from Scott Redig totally makes sense. I am not sure what is worse: Libraries swallowing cancelled() or libraries lying that they support cancelled.
The point is libraries are agnostic. You as a library user provide io transport and loop implementation which supports/not supports cancelation. And you as as library user handle cancelation.
> Libraries swallowing cancelled() or libraries lying that they support cancelled.
For me former is obviously worse.
I love the idea! I could imagine something similar created for other languages too. Perhaps written in a way that a template could be reused in, let's say Django, and a JS React frontend. With all the type-safety that tsx provides.
I recently built some templating language (rather an intermediary language for documents) for solving an accumulated frustration over the years. Already added into four or five of my projects (for templating html, emails, dashboards, chatbots messages, and some configs).
The design point "deterministic, hostable, with enough to make hooks from the templates" is what makes it special: https://lucasdicioccio.github.io/tramaj/ .
I always thought that the type-safe XML/HTML in Ur/Web was elegant.
For examples, see http://www.impredicative.com/ur/demo/
There was a brief period where everyone and their dog implemented mustache[0] as a template system, but it died quickly because cross-language templating is not that useful in the end, you seldom need to switch host language but keep the templates.
0: https://en.wikipedia.org/wiki/Mustache_(template_system)
I think the craze was about "purity" of mustache as presentation-only template engine. Apparently you need some level of logic to be useful.
Type safe DSLs in Kotlin
https://kotlinlang.org/docs/type-safe-builders.html
Copied from Groovy Builders, here's an example from 2009: https://blog.mrhaki.com/2009/10/groovy-goodness-creating-xml...
This is sort of halfway between tsx and Elixir's EEx
I think nim also has this.
As for Django... well.. Django only has text formatting, you can write any garbage and broken html and lots of invalid templates with silent failures there unfortunately.
We created https://htpy.dev to solve this for our Django app. Has been using it in production for multiple years. Works great with Django (or any Python web framework).
This had me checking if anyone has implemented first-class support for Python JSX components in Django yet, and it could be... sort of... maybe viable with PyJSX? [1]
It looks like you'd have to implement something equivalent to provider/context functionality yourself if you want it, as well as a simple render()-like helper to render a component tree. I've not tried their VS Code plugin, but it's a good sign that they have one.
[1] https://github.com/tomasr8/pyjsx
sounds very similar to jte.gg for Java
I've never quite got the deal with 'template engines'. I have always just done normal programming - in whatever language I'm using - and interspersed outputting raw string literals to create the html.
and this leads to html injection attacks when there are small errors in your escaping.
Using a template engine means you systematically ensure that values are escaped (at least, that's one of the reasons i would choose an engine over raw dogging the html).
eww gross.
If you can suppress your gag reflex, M4 can do some of what you want. sinclude(...) will include a file and be silent in case of failure. I did something like this for user-login history because I couldn't use PHP or Perl:
one thing i love about rust's macros is that you can accomplish this without needing a separate file type or inventing syntax
> you can accomplish this
That's not HTML though, you have to learn a whole new dsl that must conform to rust parser rules. So, not the same thing at all.
You can do actual html. This is Leptos, a Solidjs like rust library:
does it still work if you remove that space before the tag's closing character in this line?
i prefer it, but you can also get html if you want
eg
but you have invented syntax
This is just Twig templates, crazy. It's cool that Rust can do this out of a box
yep and you get rust's lsp support too, autoformatting, etc.
this is rsx, but there are other macros that look just like html. i prefer this though, it's much more compact and readable imo
I'm not a fan of Rust, the overly flexible macros are actually one reason for it, but if you can indeed get LSP support in a custom syntax like this, that's really awesome. Thank you for the example.
do you think that when compiler internals 'settle down' it will (gradually) be exposed through some interfaces (like compiler plugins in jai) so that we can more easily develop LSP for quasi-zig formats like this ?
That would be great, I really like openness and ~plugin interfaces of jai compiler internals ...
That is super cool actually