Laravel Escaping All HTML in Blade Template

Question

I'm building a small CMS in Laravel and I tried to show the content (which is stored in the DB). It is showing the HTML tags instead of executing them. Its like there is an auto html_entity_decode for all printed data.

<?php

class CmsController extends BaseController
{
    public function Content($name)
    {    
        $data = Pages::where('CID', '=', Config::get('company.CID'))
            ->where('page_name', '=', $name)
            ->first();

        return View::make('cms.page')->with('content', $data);
    }
}

I tried to print the content using the curly brace.

{{ $content->page_desc }}

and triple curly brace.

{{{ $content->page_desc }}}

And they give the same result. I need to execute those HTML tags instead of escaping them.

In latest version ver-5.0 {{...}} and {{{...}}} both does this, what version do you have exactly ? — The Alpha
– The Alpha, Commented Sep 24, 2014 at 18:22
Are they stored as "tags" or already escaped in the db? Because else I would see it like The Alpha, this should only be the case in v5 of laravel — theiNaD
– theiNaD, Commented Sep 24, 2014 at 18:34

Ivan Topolcic · Accepted Answer · 2016-04-28 01:17:30Z

196

Change your syntax from {{ }} to {!! !!}.

As The Alpha said in a comment above (not an answer so I thought I'd post), in Laravel 5, the {{ }} (previously non-escaped output syntax) has changed to {!! !!}. Replace {{ }} with {!! !!} and it should work.

edited Apr 28, 2016 at 1:17

answered Apr 10, 2015 at 5:44

Ivan Topolcic

2,0541 gold badge12 silver badges8 bronze badges

Sign up to request clarification or add additional context in comments.

4 Comments

fpauer Over a year ago

Solved in my case!

Always_a_learner Over a year ago

worked like magic. Thanks!! Though I don't know why html_entity_decode didn't work.

CodeConnoisseur Over a year ago

@IvanTopolcic is there a way to extract the html coming back from an @yield('content') blade directive?

William Entriken Over a year ago

This is documented at laravel.com/docs/8.x/blade

Joundill · Accepted Answer · 2020-12-11 03:37:24Z

19

use this tag {!! description text !!}

edited Dec 11, 2020 at 3:37

Joundill

7,84113 gold badges40 silver badges54 bronze badges

answered Feb 27, 2016 at 20:03

sanjay

2292 silver badges3 bronze badges

2 Comments

PapaHotelPapa Over a year ago

This answer worked for my in Laravel 5.2. In the course of working on the problem, I also discovered that Illuminate/Support/helpers.php::529 runs htmlentities() if you don't use this syntax: {!! !!}.

Pathros Over a year ago

Still works in Laravel 7 ...

Mehmet Sefa Balık · Accepted Answer · 2017-06-21 10:49:16Z

9

I had the same issue. Thanks for the answers above, I solved my issue. If there are people facing the same problem, here is two way to solve it:

You can use {!! $news->body !!}
You can use traditional php openning (It is not recommended) like: <?php echo $string ?>

I hope it helps.

answered Jun 21, 2017 at 10:49

Mehmet Sefa Balık

4997 silver badges20 bronze badges

1 Comment

CodeConnoisseur Over a year ago

is there a way to extract the html coming back from an @yield('content') blade directive?

Joundill · Accepted Answer · 2020-12-11 03:37:30Z

7

Include the content in {! <content> !} .

edited Dec 11, 2020 at 3:37

Joundill

7,84113 gold badges40 silver badges54 bronze badges

answered Jan 2, 2016 at 14:30

Avinash Kumar

7872 gold badges11 silver badges26 bronze badges

Comments

Marcin Nabiałek · Accepted Answer · 2014-09-24 19:08:58Z

There is no problem with displaying HTML code in blade templates.

For test, you can add to routes.php only one route:

Route::get('/', function () {

        $data = new stdClass();
        $data->page_desc
            = '<strong>aaa</strong><em>bbb</em>
               <p>New paragaph</p><script>alert("Hello");</script>';

        return View::make('hello')->with('content', $data);
    }
);

and in hello.blade.php file:

<!doctype html>
<html lang="en">
<head>
    <meta charset="UTF-8">
</head>
<body>

{{ $content->page_desc }}

</body>
</html>

For the following code you will get output as on image

Output

So probably page_desc in your case is not what you expect. But as you see it can be potential dangerous if someone uses for example '` tag so you should probably in your route before assigning to blade template filter some tags

EDIT

I've also tested it with putting the same code into database:

Route::get('/', function () {

        $data = User::where('id','=',1)->first();

        return View::make('hello')->with('content', $data);
    }
);

Output is exactly the same in this case

Edit2

I also don't know if Pages is your model or it's a vendor model. For example it can have accessor inside:

public function getPageDescAttribute($value)
{
    return htmlspecialchars($value);
}

and then when you get page_desc attribute you will get modified page_desc with htmlspecialchars. So if you are sure that data in database is with raw html (not escaped) you should look at this Pages class

Gerald T - WordPress Buddha · Accepted Answer · 2023-05-21 16:22:42Z

1

This worked for me in Laravel 10

{!! $blog->description !!}

edited May 21, 2023 at 16:22

answered May 21, 2023 at 16:22

Gerald T - WordPress Buddha

2501 silver badge8 bronze badges

1 Comment

Chris-MindflowAU Over a year ago

Those tags will output what the user entered data saved to the database. This could include anything. Consider passing it through an HTML filter or purifier.

emi · Accepted Answer · 2014-11-11 17:20:15Z

-4

{{html_entity_decode ($post->content())}} saved the issue for me with Laravel 4.0. Now My HTML content is interpreted as it should.

edited Nov 11, 2014 at 17:20

answered Nov 11, 2014 at 16:20

emi

972 gold badges2 silver badges6 bronze badges

2 Comments

Kamil Kiełczewski Over a year ago

Yes, this solution actually works for laravel 4 - maybe someone know better solution for L4?

Nick Over a year ago

Since we are using laravel we should use {!! !!} which follows the Laravel syntax.

Collectives™ on Stack Overflow

Laravel Escaping All HTML in Blade Template

7 Answers 7

4 Comments

2 Comments

1 Comment

Comments

Comments

1 Comment

2 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

7 Answers 7

4 Comments

2 Comments

1 Comment

Comments

Comments

1 Comment

2 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related