What are some common pitfalls when creating a custom PHP template engine?

One common pitfall when creating a custom PHP template engine is not properly escaping output, which can lead to security vulnerabilities like cross-site scripting (XSS) attacks. To solve this issue, always escape output using functions like htmlspecialchars() before rendering it to the browser.

// Example of properly escaping output in a custom PHP template engine
echo htmlspecialchars($variableToOutput, ENT_QUOTES, 'UTF-8');