A Quick Look 

// Familiar variable and List syntax.
$colors = ['red', 'blue', 'green'];

// New JSON-style syntax for Maps
$colorHex = {
    red:   '#FF0000',
    green: '#00FF00',
    blue:  '#0000FF',
};

// Built-in types have methods using
// the mainstream 'dot' syntax.
$colors.push('purple');

// Extra parens aren't needed.
if $colors.length() > 3 {
    $colors.pop();
}

// The standard library is organized
// into modules.
Response.sendPage({
    title: 'Colors',
    body: bodyHtml($colors),
});

// Template Functions let you organize
// your output (views) however you like.
// (e.g. by component, module, file, etc.)
template bodyHtml($colors) {

    <h1>Colors</>
    <ul>
    -- foreach $colors as $c {
        <li>{{ $c.toUpperCaseFirst() }}</>
    -- }
    </>
}

Web Framework Included 

THT includes many tools that are useful for modern web development:

• Router for clean URLs (e.g. “/blog/123/top-ten-things”)
• Templates that support the full THT syntax
• Input validation and secure file uploads
• Stylesheet with reset styles, grid system & SVG icons
• Litemark parser for Markdown-style content
• JCON for human-friendly JSON-style configuration
• Session support with secure defaults & flash data
• Database module with CRUD methods & parameterized queries
• Cache module for performance tuning

Built-In Security 

By default, THT defends against the most common security risks.

These safeguards are integrated into the language, providing better protection than if they were imported from a third-party library.

TypeStrings

TypeStrings are used to prevent injection attacks, which are considered the #1 security vulnerability on the internet.

They can not be mixed with (unsafe) regular strings. Dynamic values are inserted via placeholders.

$q = sql'select name from users where id = {}';
$q.fill(123);

url'/users?sort={}'.fill('desc');

$c = cmd'chmod {perms} {file}';
$c.fill('755', 'my_file.conf');

Other Safeguards

• User input (which should never be trusted) can only be accessed through validation methods, via the Input module.
• Template variables are automatically escaped.
• Response headers include CSP to prevent Cross-Site Scripting (XSS).
• Direct calls to high-risk PHP commands like eval are prohibited.
• File functions are sandboxed to a data directory, and can’t be used with external (potentially dangerous) URLs.

Performance 

Out of the box, PHP is more than fast enough for most apps.

PHP 7 already offers major speed gains, but you can benefit even more by using an opcode cache like APC.

On a MacBook Pro, the core THT test suite (800 tests) finishes in 13 milliseconds.

THT is a safe choice, compared to the performance of other PHP libraries.

In a basic “Hello World” benchmark, THT is 6x faster than Laravel (1000 req/s vs 160 req/s) and uses 60% less memory (0.8 MB vs 2 MB).

The THT bundle is about 80x smaller than Laravel and its dependencies (180 KB vs 16 MB, zipped).

It also has built-in performance tools:

• The Perf Panel is an easy way to profile your overall page speed.
• The Cache module can help you minimize the biggest performance hits.
• Responses are automatically minified & GZIP compressed, reducing most page sizes by up to 70%.

How It Works 

Once you set up a THT app, your workflow is the same as with PHP. After you edit a file, just save and refresh.

There are no build steps, background tasks, or server restarts to disrupt your flow.

When you add or update a .tht file, it is automatically transpiled to PHP on the first request. Then it is cached for performance.

The transpiled code is compatible with PHP 7.1+.

The transpiler itself is written in 100% PHP with no dependencies.

Third-party PHP libraries can be accessed through the PHP Interface.

Give It a Try 

THT is still in Beta, but if you’d like to try it out, it’s already suitable for most small-to-medium web apps.