Twig — Flexible Secure Template Engine for PHP

Introduction

Twig is a flexible, secure, and fast template engine for PHP created by the Symfony team. It compiles templates to optimized PHP code, applies automatic output escaping to prevent XSS, and provides a clean syntax with template inheritance that keeps presentation logic separate from application code.

What Twig Does

• Compiles .twig templates to cached PHP classes for fast rendering
• Escapes output automatically by default to prevent cross-site scripting
• Supports template inheritance with extends, block, and include directives
• Provides over 50 built-in filters and functions for string, date, and array manipulation
• Offers a sandbox mode that restricts which tags, filters, and methods templates can use

Architecture Overview

Twig processes templates in three stages: the Lexer tokenizes the template source, the Parser builds an abstract syntax tree (AST), and the Compiler generates PHP class files from the AST. These compiled classes are cached on disk and reloaded on subsequent requests, avoiding repeated parsing. The Environment object serves as the central entry point, holding loaders, extensions, and global variables.

Self-Hosting and Configuration

• Install via Composer with composer require twig/twig
• Create a TwigEnvironment with a filesystem, array, or database loader
• Enable template caching by passing a cache directory to the Environment constructor
• Add custom filters and functions by creating Twig Extensions
• Enable auto_reload in development to recompile templates when source files change

Key Features

• Template inheritance lets child templates override specific blocks in a parent layout
• Macros provide reusable template fragments similar to functions
• Named block scoping prevents accidental variable leaks across templates
• Custom operators and test expressions extend the template language itself
• First-class integration with Symfony, Drupal, Craft CMS, and many PHP frameworks

Comparison with Similar Tools

• Blade — Laravel's template engine with PHP-native syntax; Twig uses its own syntax and compiles to PHP
• Liquid — Shopify's sandboxed template language; Twig is PHP-native with deeper framework integration
• Jinja2 — Python template engine that inspired Twig's syntax; nearly identical in design philosophy
• Smarty — older PHP template engine; Twig offers better performance, security defaults, and modern tooling

FAQ

Q: Is Twig only for Symfony projects? A: No. Twig is a standalone library installable via Composer. It works in any PHP project.

Q: How does the sandbox mode work? A: Sandbox mode restricts which tags, filters, functions, and object methods are accessible. Untrusted templates are rendered inside the sandbox policy.

Q: Does Twig support auto-escaping for JavaScript contexts? A: Twig's default escaping strategy targets HTML. You can specify js, css, or url escaping strategies per variable with the escape filter.

Q: Can I debug Twig templates? A: Yes. The dump() function (requires the Debug extension) outputs variable contents, and the Symfony Web Profiler includes a Twig panel showing render times and template hierarchy.

Sources

• https://github.com/twigphp/Twig
• https://twig.symfony.com/