Display plain text(not rendering html syntax) in laravel

Question

Currently I use database to store all data(description, name, etc) that user key in (user can self generate content)

Yet, my site is "hijacked" by someone who knows html.. Let's say in description, they enter

<a href="http://hijack.comhijack">abc</a>

to put link:

The code in my Larvel view is {{$site->description}}

How can I restrict them to show this like plain text?

Tt will mess-up my page, and when I put my description in meta property, it will mess up to..

any solution for this?

You have to HTML escape the data. If you're using blade, use triple curly braces: {{{ $site->description }}} — No Results Found
– No Results Found, Commented Jun 11, 2014 at 1:22
@WesleyMurch thanks, how bout i want break line to remain(not escaping) — keatwei
– keatwei, Commented Jun 11, 2014 at 1:36
@WereWolf-TheAlpha ya. escaping, i doesn't know how to say it. sorry. — keatwei
– keatwei, Commented Jun 11, 2014 at 1:37
If you are saving the user submitted data in to database then Validation of that field will protect you and inputs are sanitized (AFAIK). — The Alpha
– The Alpha, Commented Jun 11, 2014 at 1:39

Joseph Silber · Accepted Answer · 2015-09-22 12:31:30Z

4

In Laravel 5, double curly braces now automatically escape all the HTML from your string.

More info: Blade templating

If you're still using Laravel 4, use triple curly braces instead of double, which will escape all the HTML from your string:

{{{ $site->description }}}

edited Sep 22, 2015 at 12:31

answered Jun 11, 2014 at 2:54

Joseph Silber

221k59 gold badges369 silver badges293 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

dave_the_dev · Accepted Answer · 2015-04-07 05:04:03Z

1

No need to use any blade syntax for this just use normal PHP:

<?php echo $site->description; ?>

I am new to Laravel and was looking for a blade solution but this worked for me and seemed to be the simplest solution

answered Apr 7, 2015 at 5:04

dave_the_dev

396 bronze badges

Comments

Holt · Accepted Answer · 2015-12-02 06:47:24Z

-2

you can try :

{!! $site->description !!}

edited Dec 2, 2015 at 6:47

Holt

38.1k7 gold badges100 silver badges147 bronze badges

answered Dec 2, 2015 at 4:23

Quân Vũ Quốc

473 bronze badges

Collectives™ on Stack Overflow

Display plain text(not rendering html syntax) in laravel

3 Answers 3

Comments

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related