# Latte treats every unescaped variable as a security question

> Latte is Nette's PHP templating engine, designed around the idea that a template author who forgets to escape a value should not be able to create a cross-site scripting hole. It fits PHP teams that want HTML-aware templates with a syntax that looks like PHP, and it does not fit a team that needs a non-HTML output format or a template language with no PHP-like syntax at all.

**nette/latte** — ☕ Latte: the safest & truly intuitive templates for PHP. Engine for those who want the most secure PHP sites.

- Repository: https://github.com/nette/latte
- Website: https://latte.nette.org
- Stars: 1,293 · Forks: 116
- Language: PHP
- License: NOASSERTION
- Published: 2026-10-19 · Updated: 2026-10-19 · Language: en
- Canonical page: https://hysenlabs.com/projects/nette-latte

## The design premise is that escaping should be deliberate

Latte is described as the safest templating system for PHP, and the readme spells out the two claims behind that. The first is the only truly secure templating system for PHP, and the second is that you already know the syntax. The framing is that it is cleverly designed and easy to learn for those familiar with PHP, since they can quickly adopt its basic tags.

The mechanism behind the security claim is content-awareness, which is one of the repository's own topics alongside xss and safety. The idea is that a template engine which knows it is producing HTML can treat an unescaped value as a deliberate, visible act rather than an oversight.

That is a different bet from the one most template engines make. The usual design is that escaping is the default and a developer opts out of it with a marker, so the failure mode is that the opt-out marker ends up in the wrong place. Latte's premise is closer to the reverse, that printing a value into HTML is something you have to say explicitly.

The readme backs the claim with a rhetorical device rather than a measurement, pointing out that only 1 percent of programmers can pass a quiz about defending against an XSS vulnerability. The link goes to a Nette blog post.

The readme also states the second half of the pitch plainly, that a wide range of useful features will significantly simplify your work, that it provides top-notch protection against critical vulnerabilities, and that it allows you to focus on creating high-quality applications without worrying about their security. It describes itself as a highly mature, fast and widely used library, and the homepage is latte.nette.org.

## Getting started is three documentation pages and a few lines of PHP

The getting started section is three steps, and it is worth reading as a description of how the project expects to be learned.

First, familiarize yourself with Latte syntax and try it online, with a link to a fiddle at fiddle.nette.org/latte/. Second, look at the basic set of tags and filters, each with its own documentation page. Third, render a template with a few lines of PHP code.

That third step is the important one for judging the integration cost. The README links to the develop page for the details, and the point of the step is that rendering a template is a small amount of code rather than a subsystem. A template engine that needs a service container, a template registry, a cache warmer and a compiler pass to produce a page is a framework, and this one is not.

The repository layout backs that up. The top level holds src/ for the implementation, tests/, docs/, bin/, composer.json, an AGENTS.md, a ncs.xml for coding standards, a phpstan.neon for static analysis, and a license.md. There is no framework around it, and no application skeleton.

The editor integration list is also part of the getting started story, because a template language is only as usable as its editor support. There is a PhpStorm plugin, in both a free Latte variant and a Latte Pro variant, and two Visual Studio Code extensions, Nette Latte plus Neon and Nette for VS Code.

## The repository is a library with no framework dependency

Latte ships as a standalone package with a composer.json at the root, a src/ tree, a tests/ directory and a docs/ folder. There is no framework layer, no application directory, and no dependency on the Nette Framework in the sense of requiring it, even though the repository topics list nette and nette-framework, and it also works standalone.

That distinction matters for adoption. A team that already uses the Nette Framework gets Latte as part of the stack, and the readme's own framing of a focused, safe engine is aimed at that world. A team that does not use Nette can still take Latte on its own, because it renders templates and does not need a surrounding framework to do it.

The tooling in the tree is worth noting for a project with this much of a safety claim. phpstan.neon means static analysis is configured, ncs.xml means the coding standard is enforced by a tool rather than by convention, and the tests/ directory is the counterpart to the claim that the escaping behaviour is reliable. The bin/ directory suggests command line tooling ships with the package.

The last push was on 2026-09-28, and the release history shows v3.1.6 on 2026-07-27, v3.1.5 on 2026-07-25 and v3.1.4 on 2026-04-23, so the project is on a 3.x line and shipping patch releases regularly.

## The licence is a custom one, and that needs reading rather than assuming

The repository's licence field records a custom licence that GitHub cannot classify, and the licence text lives in license.md at the root. The readme itself does not state the licence terms.

That is worth flagging plainly, because the project's central selling point is safety and a reader might extend that trust to the licence terms without checking. The terms are in the repository and they are the authoritative statement.

The same caution applies to the surrounding ecosystem. Latte is a component of the Nette organisation, so the terms that apply to the rest of your stack are a separate question.

The practical step is simple: read license.md before you vendor the engine into a product, and if you distribute a site built with it, check what the licence requires of you, which is a question for whoever owns that decision in your organisation.

## Where Latte is the wrong tool

The first wrong-tool case is a non-HTML output format. Latte's content-awareness is a feature about HTML, and the whole premise of the safety argument is that the engine understands the context of the output. A template that renders JSON, a plain text email body, a CSV export or a terminal report has a different context, and the escaping rules that make Latte safe in HTML are at best irrelevant and at worst wrong for those formats. A project that renders several of those needs to think about which engine covers all of them, and Latte's answer is strongest for exactly one of them.

The second is a team that has already standardised on another syntax. The readme's second claim is that you already know the syntax, and for PHP developers that is true, because the tags look like PHP. But a team coming from Blade, or from Django templates, or from a JavaScript-centric stack, will find the learning curve that the readme dismisses. The claim is aimed at PHP developers, and it is a good argument for that audience specifically.

The third is a team that wants to render on the client. Latte is a server-side PHP engine, and the readme's editor integrations are for people writing templates, not for a build step that compiles templates to JavaScript. If the requirement is a single-page application with client-side templating, the ecosystem is different.

The fourth is the security claim itself, which deserves a sober reading rather than a dismissal. A templating engine can remove one class of mistake, namely the unescaped output, and that is a real and worthwhile reduction. It cannot remove the class of mistake where a value is escaped into the wrong context, where a URL scheme is not checked, or where the template author writes the wrong variable. The quiz statistic in the readme is about the industry, not about a measured improvement from using Latte, and a team should evaluate the engine on how it handles its own context, not on the claim in the header.

## Conclusion

Latte fits a PHP team that renders HTML and wants the escaping decision to be visible at the point of output, and it does not fit a project that emits non-HTML formats or that has standardised on a different template syntax. Before adopting it, check the licence in license.md, since the repository records a custom licence that GitHub cannot classify, and read the safety documentation linked from the README, because the engine's central claim is about how unescaped values behave and that is what you are buying.

## FAQ

### What is Latte and who is it for?

Latte is Nette's templating system for PHP, described as the safest templating system for PHP and as easy to learn for those familiar with PHP since they can quickly adopt its basic tags. The repository topics list content-aware, safety, security, xss and template-engine.

### How do I get started with Latte?

The readme gives three steps: familiarize yourself with the Latte syntax and try it online in the fiddle, look at the basic set of tags and filters, then render a template with a few lines of PHP code. Editor support exists for PhpStorm, with Latte and Latte Pro plugins, and for Visual Studio Code, with Nette Latte plus Neon and Nette for VS Code.

### Does Latte require the Nette Framework?

Latte is a standalone library that renders templates without a surrounding framework, and the repository contains only src/, tests/, docs/, bin/ and tooling configuration such as composer.json, phpstan.neon and ncs.xml. Its topics list nette and nette-framework, so it sits naturally in that ecosystem.

### What licence does Latte use?

The repository records a custom licence that GitHub cannot classify, and the terms are in license.md at the repository root. The readme itself does not restate the licence terms, so the file is the authoritative statement.

## Sources

- [Issues](https://github.com/nette/latte/issues)
- [nette/latte on GitHub](https://github.com/nette/latte)
- [Project website](https://latte.nette.org)
- [README](https://github.com/nette/latte/blob/master/README.md)
- [Releases](https://github.com/nette/latte/releases)

---

Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/nette-latte