mj-zana / view

v2.1.0 2026-10-25 20:38 UTC

Requires

• php: ^8.5
• mj-zana/core: ^2.1
• mj-zana/http: ^2.1
• mj-zana/routing: ^2.1

Requires (Dev)

• mj-zana/security: ^2.1
• mj-zana/translation: ^2.1
• phpstan/phpstan: ^2.1
• phpunit/phpunit: ^11.5

Suggests

• mj-zana/security: For the csrf_token() and csrf_field() helpers
• mj-zana/translation: For the t() helper and the locale global
• mj-zana/view-twig: To write templates in Twig

MIT

• view
• html
• layout
• templates
• zana

Published on Packagist.org on 2026-10-25 21:17 UTC

README

HTML views for Zana applications: templates per module, layouts, escaping by default, View route results and templated error pages. Templates are plain PHP; mj-zana/view-twig adds Twig.

composer require mj-zana/view

Setup

Register ViewServiceProvider, after the http and routing providers. Templates live in templates/ (view.path), and each module's Resources/views/ is available under the module's name:

#[Route('/contact', methods: ['GET'])]
public function show(): View
{
    return View::make('@Contact/form', ['sent' => false]);
}

Templates

<?php $this->layout('layouts/site', ['title' => 'About']) ?>
<h1><?= $heading ?></h1>
<a href="<?= $this->url('contact') ?>"><?= $this->t('nav.contact') ?></a>

<!-- templates/layouts/site.php -->
<html lang="<?= $locale ?>"><title><?= $title ?></title>
<?= $this->section('content') ?></html>

• Escaping by default. Strings in the context, also inside arrays, are escaped before the template sees them. Wrap trusted HTML in Markup. Objects are not escaped: print them with $this->e($object). $this->raw('name') gives a value unescaped.

• Passing values on. Values a template passes to layout() or insert() are printed as given, since template variables and helper output are already escaped. Give helpers $this->raw('name') when they need the original text.

• Layouts and sections. layout(), start()/stop() and section(); insert() renders a partial with the current context.

• Helpers.

  • url() and alternates(), from routing;
  • t() and the locale global, with mj-zana/translation;
  • csrf_token() and csrf_field(), with mj-zana/security;
  • add your own with ViewHelpers::add().

  Helper output is escaped unless the helper is declared safe.

• Globals. view.globals, ViewHelpers::addGlobal(), and csp_nonce when SecurityHeadersMiddleware uses a nonce.

Error pages

Browsers get errors/<status>, e.g. errors/404, or errors/error, with status, title and detail. Without those templates, they get the built-in page. JSON clients still get problem documents.

License

MIT