Heh, now I see why they had to invent HipHop. It's an interesting idea - trade off speed for readability and security, and then write a PHP->C++ compiler to recover the speed you've lost. I wonder whether it would've been easier to use a language + templating system that gets security right in the first place, though.
No wonder it's expensive. If you serialize a tree of objects by concatenating subtrees into substrings, most values are copied many times depending on the depth of the tree, and you end up doing O(n log n) work. But as for the alternative
there was basic XSS filtering in place for the naked
$_POST['name'] variable in the plain PHP version
isn't knowing you have to encode some but not all of your output worse than just encoding all of it? This is the kind of design mistake that leads to databases accidentally full of HTML entities. Or more likely, half full.
Only if you care about the readability and maintainability of the target HLL.
Going from one HLL to another if you never plan to look at or change the generated code is significantly easier than going to machine code. Just look at all the compilers that target C.
Though he points out that if your PHP script spends most of its time doing algorithmic calculations, waiting on I/O, etc., or if you're using an external template library already, then you might well not notice the difference anyway.
