用于面向客户的 CMS 的内联标记/模板引擎
有许多托管 CMS 应用程序为您提供某种内联标记/模板引擎，使您可以将内容输出到页面中。
例如，托管的 cms 应用程序允许您将模板编辑为自定义 html/css，但它们还让您在页面上执行一些基本的内联代码来执行此操作，例如注入文章标题、日期等. （对象属性）并让您循环访问预定义的集合。
他们是如何做到这一点的？
它们如何阻止用户访问您不希望他们访问的其他对象？
例如，我让他们输出您的连接字符串！哈哈，
There are many hosted CMS applications that provide you with some sort of inline markup/ templating engine that lets you output things into a page.
for example, a hosted cms application lets you edit your templates to custome html/css, but they also let you do some basic inline code on the page to do this like inject the article title, date, etc. (object properties) and let you loop through predefined collections.
How do they do this?
How do they prevent the user from accessing other objects which you don't want them to?
e.g. Imaine them outputing your connection string! lol
here is an example: http://wiki.shopify.com/UsingLiquid
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
通常，最安全的方法是创建一种独立的脚本语言 - 运行时中的运行时，其由主机运行时填充的内置对象范围非常有限，并且没有一个是危险的。显然，在运行时中执行的脚本无法到达其自身的范围之外，除非运行时本身提供了一种机制来执行此操作。
Typically the safest way is to create a self-contained scripting language - a runtime within the runtime that has a very limited scope of builtin objects populated by the host runtime, and none of which are dangerous. Obviously a script executing in a runtime cannot reach up outside it's own universe unless the runtime itself provides a mechanism to do so.