Remix.run Logo
thayne 5 days ago

> In non-web contexts untrusted input is not interpolated into the executable streams so you don't worry about special characters

I don't know what you mean by `executable` streams, but besides databases as I've already mentioned, a common thing that shows up in non-web applications is invoking a shell command that includes a user-supplied file name as part of it. Currently doing so safely means you need to call `shlex.quote` or similar on the filename, but with t-strings you could have something like: `shell(t"some-command {filename} 2> somefile | other-command")`.

And that is just one specific example. There are other cases it might be useful as well, like say generating an XML configuration file from a template that includes user-supplied input.

> No, you can't do that... Every function evaluation creates a new Template object, it does not reuse a precompiled one.

The code that generates that Template object is pre-compiled though.

If you define a function like:

    def my_template(a, b,c):
        return t"a={a} b={b} c={c}"
When python parses that, it will generate bytecode equivalent to:

    def my_template(a, b,c):
        return Template("a=", Interpolation(a, ...), " b=", Interpolation(b, ...), " c=", Interpolation(c,...))
yes, it does create a new `Template` object every time `my_template` is called, but it doesn't have to re-parse the template string each time, which is an improvement over existing APIs that do re-parse a template string every time it is used.