Mix code and HTML

A .cow page is ordinary HTML with server-side code in it. This guide shows you how to write code tags, print values safely, add types, and import your own code.
Put code inside <?js … ?> or <?ts … ?>. Both tags in a Cow file accept optional TypeScript syntax. Cow sends everything outside a tag to the browser as written.
index.cow
<?js
const things = ['A good idea', 'A little code', 'A cup of tea']
?>
<ul>
  <?js for (const thing of things) { ?>
    <li><?= h(thing) ?></li>
  <?js } ?>
</ul>
Output, with blank lines removed
<ul>
    <li>A good idea</li>
    <li>A little code</li>
    <li>A cup of tea</li>
</ul>
Note: Coming from PHP? Cow keeps the line break after a closing ?>, where PHP removes it. That is why the raw output has blank lines. Browsers ignore them in HTML.

Print values

<?= expression ?> writes a value to the response and escapes it for HTML text and quoted attributes.
Note: Unlike PHP, <?= ?> escapes. To print HTML that your own code built, wrap it in raw(html), and escape any text inside it with h(value). echo() writes values without escaping.
greeting.cow
<h1>Hello, <?= req.get('name') || 'friend' ?>!</h1>
Output — /greeting?name=<b>Clover</b>
<h1>Hello, &lt;b&gt;Clover&lt;/b&gt;!</h1>
HTML escaping is not URL validation or JavaScript escaping. Choose the right handling for the place you put the value.

Add types

greeting.cow
<?ts
const name: string = req.get('name') || 'friend'
?>
<p>Nice to meet you, <?= h(name) ?>.</p>
Cow removes type annotations before it runs the page. There is no separate build step and no full template type checker. All code blocks in one page share a scope.

Import your own code

Use import for JavaScript, TypeScript, Cow modules, and supported packages. Keep exports in a reusable module rather than a rendered page. A final code block may leave off its closing ?> tag. See Modules & includes for a complete example.
Cow also accepts legacy .jsp and .tsp pages. Use .cow for new work.