Download the PHP package iviphp/view without Composer
On this page you can find all versions of the php package iviphp/view. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.
Package view
Short Description View discovery and PHP template rendering for the IviPHP ecosystem.
License MIT
Informations about the package view
Ivi View
View discovery and native PHP template rendering for the IviPHP ecosystem.
Overview
iviphp/view provides a small, framework-independent view layer for server-rendered PHP applications.
It includes:
- named view discovery;
- dot-notation view names;
- multiple template directories;
- native PHP template rendering;
- isolated template execution;
- output buffering;
- shared template data;
- configurable template extensions;
- cached view-path resolution;
- strict view-name validation;
- strict template-variable validation;
- safe rendering exceptions;
- no global static view state.
The package focuses on server-rendered PHP views. SPA asset management, frontend bundling, hydration and client-side routing belong in separate integration packages.
Installation
Requirements
- PHP 8.2 or later
- Composer
iviphp/support
Package structure
Basic usage
Create a view directory:
Create the template:
Configure the view service:
Render the template:
The rendered output is returned as a string.
The package does not send output directly to the client.
Configuration
Create a view instance from configuration:
Supported configuration fields:
| Field | Required | Default | Description |
|---|---|---|---|
paths |
yes | none | Template directories |
extension |
no | php |
Template file extension |
shared |
no | [] |
Variables shared with every view |
At least one readable view directory is required.
View names
Views are referenced using dot notation.
These names resolve to:
A view name may contain:
- letters;
- numbers;
- underscores;
- hyphens;
- dots separating path segments.
Valid view names:
Invalid view names:
Directory traversal and direct filesystem paths are rejected.
Checking whether a view exists
exists() returns false when the named view cannot be found.
Invalid view names still produce a ViewException.
Rendering views
Inside resources/views/users/profile.php:
The make() alias
make() is an alias of render():
Template variables
Associative array keys become local variables inside the PHP template.
Inside the template:
Template variable names must be valid PHP variable identifiers.
Valid names:
Invalid names:
Reserved template variables
The rendering engine rejects variables that could interfere with PHP internals or the rendering scope.
Reserved names include:
Variables beginning with __ivi are also reserved.
This produces a ViewException.
Escaping output
The view engine does not automatically escape template values.
Escape untrusted HTML output explicitly:
Integer values can be cast:
JSON data can be encoded safely:
Shared view data
Share a variable with every rendered view:
The variable becomes available in every template:
Share multiple values:
Overriding shared data
Data passed directly to render() overrides shared data with the same name.
The template receives:
Inspecting shared data
Check whether a shared variable exists:
Retrieve a shared variable:
Return every shared variable:
Removing shared data
Remove one shared variable:
Remove all shared variables:
Multiple view directories
Directories are searched in declaration order.
When the same named view exists in multiple directories, the first matching file is used.
Example:
With this configuration:
layouts.app resolves to:
Adding view directories
The new path is appended to the search list.
Prepend a path so it has higher priority:
Equivalent:
Removing view directories
Removing a missing or inaccessible path has no effect.
Replacing all view directories
All cached view-path resolutions are cleared automatically.
Inspecting view directories
The returned paths are canonical absolute filesystem paths.
Resolving a view path
Example result:
A ViewException is thrown when the view cannot be found.
View path caching
Resolved view paths are cached in memory.
The second render can reuse the previously resolved path.
The template file is still executed again. Only filesystem discovery is cached.
Forgetting one resolved path
The next render searches the configured directories again.
Clearing all resolved paths
This clears cached view-path resolutions.
It does not remove shared data or template files.
Custom template extension
The default extension is .php.
A different extension can be configured:
A view named:
then resolves to:
However, the included PhpEngine only renders files ending in .php.
For the initial package, use the default php extension with PhpEngine.
Additional template engines can be introduced in later versions.
View manager
Create a ViewFinder:
Create a manager:
Render a view:
Create a manager directly from paths:
Creating the main view entry point
The View class delegates its operations to ViewManager.
View finder
Use ViewFinder directly:
Check existence:
Return the generated relative path:
Result:
Finder extension
Return the configured extension:
Change it:
Changing the extension clears all cached path resolutions.
PHP rendering engine
Use the engine directly:
The engine:
- validates the view name;
- validates the template path;
- validates template variable names;
- opens an output buffer;
- executes the template inside an isolated closure;
- captures the generated output;
- restores the output-buffer state;
- returns the rendered output.
Output buffering
Template output is captured automatically:
Rendering returns:
The engine does not call echo outside the template and does not write directly to the HTTP response.
Output-buffer protection
Templates must not leave the output-buffer stack in an inconsistent state.
Avoid manually opening or closing output buffers inside templates:
The engine detects unexpected output-buffer changes and produces a ViewException.
Template includes
A template can include another trusted PHP file:
Direct includes are normal PHP behavior.
The included file is not resolved through ViewFinder.
For reusable application views, rendering named templates through View or ViewManager is preferred.
Simple layout example
Directory structure:
resources/views/pages/home.php:
Render the page content:
Render the layout:
resources/views/layouts/app.php:
Only render trusted HTML content without escaping.
Component example
Create:
Template:
Render:
Rendering collections
Template:
Conditional rendering
Templates are regular PHP files and support normal PHP syntax.
View exceptions
View failures throw:
Example:
Safe exception context
ViewException provides diagnostic context without including template values.
Example:
Invalid data failures only include variable names:
Template values are never added to exception context.
Exception factories
Error handling
Do not expose filesystem paths or internal rendering errors directly to application users in production.
Complete example
Project structure:
public/index.php:
resources/views/pages/home.php:
resources/views/layouts/app.php:
Available classes
ViewInterface
View
ViewManager
ViewFinder
PhpEngine
ViewException
Security considerations
Escape untrusted output
The package does not automatically escape values.
Always escape untrusted content before inserting it into HTML:
Do not expose arbitrary template selection
Do not render a view name directly from user input:
Even though names are validated, template selection should remain controlled by the application.
Use an allowlist:
Keep template directories trusted
Templates are executable PHP files.
Only trusted application code should be stored in view directories.
Do not allow users to upload PHP files into these directories.
Protect filesystem paths
Do not return view exception paths directly to users in production.
Filesystem paths may reveal internal application structure.
Escape attributes separately
Use HTML escaping inside attributes:
Trusted rendered fragments
A rendered child view may be inserted into a layout without escaping:
Only do this when $content was generated by trusted application templates.
SPA integration
This package focuses on server-rendered PHP templates.
A future SPA integration package can provide:
- Vite manifest discovery;
- JavaScript and CSS asset helpers;
- development-server detection;
- frontend entry-point resolution;
- preload tags;
- hydration data;
- frontend route fallback;
- Vue, React or Svelte integration;
- server-side rendering bridges.
Those features should remain separate from the core view package so applications can use native PHP views without installing frontend tooling.
A PHP view can already host a SPA entry point:
Asset discovery and build-tool integration can be added later through a dedicated package.
Design principles
- Small framework-independent API
- Native PHP templates
- Dot-notation view names
- Multiple ordered view directories
- Strict path validation
- Strict variable-name validation
- Isolated template execution
- Captured template output
- Shared application data
- Cached view discovery
- No hidden global view state
- No automatic output escaping
- No automatic HTTP response emission
- Safe rendering diagnostics
- Clear separation from frontend tooling
Package boundaries
This package is responsible for:
- named view discovery;
- template directory management;
- native PHP rendering;
- output capture;
- shared template data;
- view-path caching;
- rendering exceptions.
It is not responsible for:
- HTTP responses;
- routing;
- controllers;
- frontend bundling;
- SPA routing;
- Vite integration;
- JavaScript compilation;
- CSS compilation;
- server-side JavaScript rendering;
- automatic HTML escaping;
- authentication;
- authorization;
- application bootstrapping.
These responsibilities belong to other IviPHP packages or application code.
Current limitations
The initial release does not include:
- template inheritance syntax;
- template directives;
- automatic layouts;
- components as PHP objects;
- view composers;
- namespaces;
- package view registration;
- compiled templates;
- automatic HTML escaping;
- frontend asset manifests;
- Vite integration;
- SPA hydration;
- React, Vue or Svelte adapters;
- server-side JavaScript rendering.
The package intentionally starts with a small native PHP rendering foundation.
Ecosystem
This package is part of the IviPHP ecosystem:
iviphp/contractsiviphp/supportiviphp/configiviphp/containeriviphp/httpiviphp/validationiviphp/databaseiviphp/cacheiviphp/viewiviphp/authiviphp/framework
Contributing
Contributions should preserve the focused and secure design of the package.
Changes should:
- preserve strict view-name validation;
- prevent directory traversal;
- preserve isolated PHP rendering;
- preserve output-buffer restoration;
- avoid exposing template data in exceptions;
- avoid automatic HTTP output;
- remain independent from the full framework;
- avoid hidden global state;
- keep frontend tooling outside the core package;
- support PHP 8.2 and later.
Security
Please report security vulnerabilities privately to the Softadastra maintainers instead of opening a public issue.
License
This project is licensed under the MIT License.
Maintainer
Created and maintained by Softadastra.