Blade templates and safe output

A visitor saves a notice titled <script>alert(1)</script> and the page prints it as the words <script>alert(1)</script>, not as a running script. That is Blade doing its first job, which is to turn every value a template prints into HTML-safe text, so a stored field cannot sneak code into the page. The default is cheap and silent: Blade compiles {{ $value }} into <?php echo e($value); ?>, and e() runs PHP’s htmlspecialchars with ENT_QUOTES on.

The default is not the whole story. A bad URL in an href attribute passes through it untouched, and a value placed inside a <script> tag needs an encoder of its own. Every case below runs on Laravel 13.34 and shows its real output: the HTML a value becomes, the PHP each everyday directive compiles to, and the files php artisan view:cache writes before the first request.

Blade escapes a value by default, and the raw sink stays off

Blade reads a template and rewrites each marker into PHP. The echo markerA short placeholder in a Blade template that the compiler rewrites into a PHP echo of the given expression, HTML-escaping its value by default. {{ $value }} becomes <?php echo e($value); ?>, and the raw echoraw echo: An unescaped print, written as {!! … !!} in Blade; the value is sent to the browser as HTML without a call to the escape helper. {!! $value !!} becomes <?php echo $value; ?>. The helper e() returns htmlspecialchars($value ?? '', ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8', $doubleEncode), so the five characters HTML uses for its own grammar leave the page as character references: < becomes <, > becomes >, & becomes &, " becomes " and ' becomes the numeric reference '. The HTML standard defines both kinds, named and numeric, so every browser renders them back to text.

The probe prints the two sinks side by side, with a safe title and the attack title in the same list:

<?php

// Renders two Blade templates with the same notice: one with {{ }} auto-escaping and one with the raw sink {!! !!}.
// The last block uses Blade's compiler to show exactly what PHP each echo compiles to.
use Illuminate\Support\Facades\Blade;
use Illuminate\Support\Facades\View;

require __DIR__.'/vendor/autoload.php';
$app = require __DIR__.'/bootstrap/app.php';
$app->make(Illuminate\Contracts\Console\Kernel::class)->bootstrap();

$notices = [
    ['title' => 'Spoken English evening batch', 'body' => 'Open & affordable'],
    ['title' => '<script>alert(1)</script>', 'body' => 'An attacker tried this one'],
];

echo "{{ \$notice['title'] }} output (every notice):\n";
foreach ($notices as $n) {
    echo '  ', trim(View::make('escape.safe', ['notice' => $n])->render()), "\n";
}

echo "\n{!! \$notice['title'] !!} output (same input, raw sink):\n";
foreach ($notices as $n) {
    echo '  ', trim(View::make('escape.raw', ['notice' => $n])->render()), "\n";
}

echo "\nWhat Blade compiles each echo to:\n";
echo "  {{ \$notice['title'] }}  ->  ", trim(Blade::compileString("{{ \$notice['title'] }}")), "\n";
echo "  {!! \$notice['title'] !!}  ->  ", trim(Blade::compileString("{!! \$notice['title'] !!}")), "\n";

from session import run

# Render two Blade templates on the same notices: {{ }} auto-escaping and {!! !!} raw-sink, then print what Blade compiled.
run(
    """
php escape.php
""",
    app=True,
    overlay=("escape-probe",),
)

$ php escape.php
{{ $notice['title'] }} output (every notice):
  <strong>Spoken English evening batch</strong>: Open &amp; affordable
  <strong>&lt;script&gt;alert(1)&lt;/script&gt;</strong>: An attacker tried this one

{!! $notice['title'] !!} output (same input, raw sink):
  <strong>Spoken English evening batch</strong>: Open & affordable
  <strong><script>alert(1)</script></strong>: An attacker tried this one

What Blade compiles each echo to:
  {{ $notice['title'] }}  ->  <?php echo e($notice['title']); ?>
  {!! $notice['title'] !!}  ->  <?php echo $notice['title']; ?>

The first block printed the escaped titles. Open & affordable became Open & affordable, so a browser renders it as Open & affordable. The malicious title left the server as <script>alert(1)</script> and lands in the page as text. The second block ran the same values through {!! !!} and sent the script tag through untouched; a browser given that line would run alert(1). The last two lines show the compiler at work: {{ $notice['title'] }} compiled to <?php echo e($notice['title']); ?>, and {!! $notice['title'] !!} compiled to a bare <?php echo $notice['title']; ?>.

The OWASP XSS Prevention Cheat Sheet asks for output encoding as close as possible to where the data is rendered, in the encoding of that context, and for an HTML-body echo that is exactly what e() does. A raw echo belongs to code you own entirely, and even then a plain string that users wrote never goes through it.

Escaping stops HTML, not a dangerous scheme in an attribute

Escaping fixes HTML characters, so a value with no HTML-special characters leaves {{ }} unchanged. That is a problem the moment the value lands inside an attribute whose grammar lets the browser run code. The classic case is a link whose href the visitor controls:

<?php

// Renders a view with a user-supplied link inside href="{{ $url }}" and prints what Blade produced for each URL.
// Shows that {{ }} escapes HTML but still happily passes an attacker-chosen scheme through to the browser.
use Illuminate\Support\Facades\Blade;

require __DIR__.'/vendor/autoload.php';
$app = require __DIR__.'/bootstrap/app.php';
$app->make(Illuminate\Contracts\Console\Kernel::class)->bootstrap();

$cases = [
    '/batches/english-evening',
    'https://partner.example.com/offer',
    'javascript:alert(1)',
    'JAVASCRIPT:alert(1)',
    'data:text/html,<script>alert(1)</script>',
];

$template = Blade::compileString('<a href="{{ $url }}">Open</a>');

foreach ($cases as $url) {
    $html = (function (array $data) use ($template) {
        extract($data, EXTR_SKIP);
        ob_start();
        eval('?>'.$template);
        return trim(ob_get_clean());
    })(['url' => $url]);
    echo str_pad($url, 42), ' -> ', $html, "\n";
}

echo "\nValidator::make([...], ['url' => 'url:https,http']) result for each URL:\n";
foreach ($cases as $url) {
    $v = \Illuminate\Support\Facades\Validator::make(['url' => $url], ['url' => 'url:https,http']);
    echo str_pad($url, 42), ' -> ', $v->passes() ? 'passes' : 'fails: '.$v->errors()->first('url'), "\n";
}

from session import run

# Renders <a href="{{ $url }}"> for five chosen URLs; then validates each with 'url:https,http' to show the server-side guard.
run(
    """
php href_scheme.php
""",
    app=True,
    overlay=("escape-probe",),
)

$ php href_scheme.php
/batches/english-evening                   -> <a href="/batches/english-evening">Open</a>
https://partner.example.com/offer          -> <a href="https://partner.example.com/offer">Open</a>
javascript:alert(1)                        -> <a href="javascript:alert(1)">Open</a>
JAVASCRIPT:alert(1)                        -> <a href="JAVASCRIPT:alert(1)">Open</a>
data:text/html,<script>alert(1)</script>   -> <a href="data:text/html,&lt;script&gt;alert(1)&lt;/script&gt;">Open</a>

Validator::make([...], ['url' => 'url:https,http']) result for each URL:
/batches/english-evening                   -> fails: The url field must be a valid URL.
https://partner.example.com/offer          -> passes
javascript:alert(1)                        -> fails: The url field must be a valid URL.
JAVASCRIPT:alert(1)                        -> fails: The url field must be a valid URL.
data:text/html,<script>alert(1)</script>   -> fails: The url field must be a valid URL.

The first five lines show what Blade produced for each URL. javascript:alert(1) and JAVASCRIPT:alert(1) left the server as valid href values; a click would run the script. The data:text/html,<script>...</script> payload had its < and > replaced, but a browser decodes those references when it reads the attribute, so the link still points at an HTML page with a script in it. Modern browsers refuse to open a data: URL as a top-level page, which stops this click, yet the same value in an iframe’s src would load: the escaping did its job on HTML and ignored the scheme.

The server has to validate the link itself. The second block runs the same list through Laravel’s url:https,http rule, which validates the value as a URL and refuses any scheme the list does not name. Every dangerous input failed, and /batches/english-evening failed too, because the plain url rule needs a scheme. A relative path needs its own rule: in practice a form stores two fields, a kind (absolute, path) and the value, and the rule changes with the kind. For an app that accepts user-supplied links, the OWASP cheat sheet asks for a scheme allowlistallowlist: A list of exactly what is accepted, so anything absent from it is refused. The opposite of a denylist, and the safer default for input. More in “Validation rules and error messages” such as https and http, and that is what the rule does.

Directives cover the loops and context a page needs

Beyond echoes, Blade has one more small language of its own: directivesBlade directive: A compile-time keyword starting with @ in a Blade template; the view compiler replaces it with PHP before the template runs.. Each starts with @ and compiles into a block of PHP. The probe reads each directive and prints what Blade produces:

<?php

// Prints what Blade compiles for the directives this lesson covers, so the text shows exactly which PHP each one becomes.
use Illuminate\Support\Facades\Blade;

require __DIR__.'/vendor/autoload.php';
$app = require __DIR__.'/bootstrap/app.php';
$app->make(Illuminate\Contracts\Console\Kernel::class)->bootstrap();

$cases = [
    "@foreach (\$notices as \$n) ... @endforeach",
    "@forelse (\$notices as \$n) ... @empty ... @endforelse",
    "@auth ... @endauth",
    "@can('update', \$notice) ... @endcan",
    "@env('production') ... @endenv",
    "@error('title') ... @enderror",
    "@csrf",
    "@method('PUT')",
    "@once ... @endonce",
    "@push('scripts') ... @endpush",
    "@include('partials.header', ['title' => 'Notices'])",
    "@each('partials.notice', \$notices, 'notice')",
];

foreach ($cases as $template) {
    echo str_pad($template, 56), ' -> ', str_replace(["\n", "\r"], ' ', trim(Blade::compileString($template))), "\n";
}

from session import run

# Print what Blade's compileString produces for the directives this lesson covers.
# @once generates a fresh UUID per compile; the session mask replaces it so two runs match.
run(
    """
php directives.php
""",
    app=True,
    overlay=("escape-probe",),
    masks=[
        (r"[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}", "<uuid>"),
    ],
)

$ php directives.php
@foreach ($notices as $n) ... @endforeach                -> <?php $__currentLoopData = $notices; $__env->addLoop($__currentLoopData); foreach($__currentLoopData as $n): $__env->incrementLoopIndices(); $loop = $__env->getLastLoop(); ?> ... <?php endforeach; $__env->popLoop(); $loop = $__env->getLastLoop(); ?>
@forelse ($notices as $n) ... @empty ... @endforelse     -> <?php $__empty_1 = true; $__currentLoopData = $notices; $__env->addLoop($__currentLoopData); foreach($__currentLoopData as $n): $__env->incrementLoopIndices(); $loop = $__env->getLastLoop(); $__empty_1 = false; ?> ... <?php endforeach; $__env->popLoop(); $loop = $__env->getLastLoop(); if ($__empty_1): ?> ... <?php endif; ?>
@auth ... @endauth                                       -> <?php if(auth()->guard()->check()): ?> ... <?php endif; ?>
@can('update', $notice) ... @endcan                      -> <?php if (app(\Illuminate\Contracts\Auth\Access\Gate::class)->check('update', $notice)): ?> ... <?php endif; ?>
@env('production') ... @endenv                           -> <?php if(app()->environment('production')): ?> ... <?php endif; ?>
@error('title') ... @enderror                            -> <?php $__errorArgs = ['title']; $__bag = $errors->getBag($__errorArgs[1] ?? 'default'); if ($__bag->has($__errorArgs[0])) : if (isset($message)) { $__messageOriginal = $message; } $message = $__bag->first($__errorArgs[0]); ?> ... <?php unset($message); if (isset($__messageOriginal)) { $message = $__messageOriginal; } endif; unset($__errorArgs, $__bag); ?>
@csrf                                                    -> <?php echo csrf_field(); ?>
@method('PUT')                                           -> <?php echo method_field('PUT'); ?>
@once ... @endonce                                       -> <?php if (! $__env->hasRenderedOnce('<uuid>')): $__env->markAsRenderedOnce('<uuid>'); ?> ... <?php endif; ?>
@push('scripts') ... @endpush                            -> <?php $__env->startPush('scripts'); ?> ... <?php $__env->stopPush(); ?>
@include('partials.header', ['title' => 'Notices'])      -> <?php echo $__env->make('partials.header', ['title' => 'Notices'], array_diff_key(get_defined_vars(), ['__data' => 1, '__path' => 1]))->render(); ?>
@each('partials.notice', $notices, 'notice')             -> <?php echo $__env->renderEach('partials.notice', $notices, 'notice'); ?>

The directives split into four groups.

Loops. @foreach compiles into a foreach that also builds $loop, so the template can read $loop->first, $loop->last, $loop->iteration and $loop->count without a counter of its own. @forelse adds an @empty branch for the “no notices” case in one place, with no outer if around a loop.

Context. @auth and its sibling @guest compile to if(auth()->guard()->check()) and its negation, so a view shows a sign-in link to a guest and a profile menu to a signed-in visitor. @can('update', $notice) resolves the authorization gate from the container and checks the ability on a model, so the Edit button appears only to a user whose policy says yes. @env('production') and @error('title') give the page a cheap way to say “only in production” and “when this field has an error”.

Forms. @csrf compiles into csrf_field(), which prints the hidden <input name="_token"> the CSRF tokenCSRF token: A secret value held in the visitor's session and expected back in every state-changing form, so a request a different site sent with the visitor's cookie is refused. More in “Your first CRUD feature with Eloquent” middleware expects, and @method('PUT') prints a hidden <input name="_method" value="PUT"> so an HTML form, which can send only GET and POST, can stand in for a PUT or DELETE.

Composition. @include and @each call the view engine to render another template, with its own data. @once runs its body once per rendering cycle, which is how a component that is used twice on a page prints its <script> tag only once. @push('scripts') and the matching @stack('scripts') in the layout let a child view add to a named region of the parent.

The table sets six of these directives against five jobs a template does. Answer its three questions about a template of your own, and it marks the rows that do not fit, with the reason on each:

Js::from sends a value safely into a <script> tag

A page sometimes has to hand data to the browser’s JavaScript: a bootstrap object, a translation table, the current user id. Writing <script>const page = {{ json_encode($data) }}; breaks the script, because {{ }} HTML-escapes and every quote arrives as ", which a script element never decodes. Writing <script>const page = {!! json_encode($data) !!}; works only by luck: PHP escapes / by default, so a </script> in the data arrives as <\/script>, but add JSON_UNESCAPED_SLASHES to keep URLs readable and a value that contains </script> ends the tag, so the characters after it are read as new HTML.

Laravel’s helper encodes the value and the script-close riskThe risk that a string printed inside a <script> element contains </script>, which ends the element early so the browser reads the rest as HTML. at once. For an array or an object, Js::from($value) emits a JSON.parse('…') call whose string is HEX-escaped so no <, >, &, ' or " survives, and then wraps the whole string once more so it is a valid single-quoted JavaScript literal; a plain string becomes a single-quoted literal with the same escapes, and a number stays a number. In a template the call sits inside the ordinary echo, const page = {{ Js::from($data) }};: the Js class is Htmlable, and e() prints an Htmlable value as it is. The probe runs the same payload four ways:

<?php

// Shows how Js::from($data) encodes a PHP value for safe inclusion inside <script>...</script>, including a </script> payload
// and a Hindi string; how plain json_encode() keeps < and > and escapes only the slash; and how JSON_UNESCAPED_SLASHES,
// added for readable URLs, puts a bare </script> back into the output.
use Illuminate\Support\Js;

require __DIR__.'/vendor/autoload.php';
$app = require __DIR__.'/bootstrap/app.php';
$app->make(Illuminate\Contracts\Console\Kernel::class)->bootstrap();

$pageData = [
    'studentName' => 'मीरा',
    'batch' => "Maths & science",
    'payload' => "</script><script>alert('taken over')</script>",
    'url' => "/batches/weekend?q=who's there",
];

echo "Js::from(\$pageData)\n";
echo "  ", Js::from($pageData), "\n";

echo "\njson_encode(\$pageData) (no flags)\n";
echo "  ", json_encode($pageData), "\n";

echo "\njson_encode(\$pageData, JSON_HEX_TAG|JSON_HEX_APOS|JSON_HEX_QUOT|JSON_HEX_AMP|JSON_UNESCAPED_UNICODE)\n";
echo "  ", json_encode($pageData, JSON_HEX_TAG | JSON_HEX_APOS | JSON_HEX_QUOT | JSON_HEX_AMP | JSON_UNESCAPED_UNICODE), "\n";

echo "\njson_encode(\$pageData, JSON_UNESCAPED_SLASHES|JSON_UNESCAPED_UNICODE)\n";
echo "  ", json_encode($pageData, JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE), "\n";

from session import run

# Encode a page payload (Hindi text, &, a </script> attack string) four ways: Js::from, plain json_encode, json_encode
# with the HEX_* flags, and json_encode with JSON_UNESCAPED_SLASHES, so the lesson can read what each one puts inside a
# <script> tag.
run(
    """
php js_from.php
""",
    app=True,
    overlay=("escape-probe",),
)

$ php js_from.php
Js::from($pageData)
  JSON.parse('{\u0022studentName\u0022:\u0022मीरा\u0022,\u0022batch\u0022:\u0022Maths \\u0026 science\u0022,\u0022payload\u0022:\u0022\\u003C\\\/script\\u003E\\u003Cscript\\u003Ealert(\\u0027taken over\\u0027)\\u003C\\\/script\\u003E\u0022,\u0022url\u0022:\u0022\\\/batches\\\/weekend?q=who\\u0027s there\u0022}')

json_encode($pageData) (no flags)
  {"studentName":"\u092e\u0940\u0930\u093e","batch":"Maths & science","payload":"<\/script><script>alert('taken over')<\/script>","url":"\/batches\/weekend?q=who's there"}

json_encode($pageData, JSON_HEX_TAG|JSON_HEX_APOS|JSON_HEX_QUOT|JSON_HEX_AMP|JSON_UNESCAPED_UNICODE)
  {"studentName":"मीरा","batch":"Maths \u0026 science","payload":"\u003C\/script\u003E\u003Cscript\u003Ealert(\u0027taken over\u0027)\u003C\/script\u003E","url":"\/batches\/weekend?q=who\u0027s there"}

json_encode($pageData, JSON_UNESCAPED_SLASHES|JSON_UNESCAPED_UNICODE)
  {"studentName":"मीरा","batch":"Maths & science","payload":"</script><script>alert('taken over')</script>","url":"/batches/weekend?q=who's there"}

The Js::from line printed JSON.parse('{\u0022studentName\u0022:\u0022मीरा\u0022,…}'). The Hindi string survived as text, so the page source stays readable to humans, while every quote, slash and tag became an escape, so neither the string literal nor the <script> tag can be broken. The plain json_encode line escaped the slash and nothing else: the payload’s <script> and its quotes arrived as they were, and the tag held only because the closing sequence read <\/script>. The last line, with JSON_UNESCAPED_SLASHES, printed a bare </script>, where a browser would end the script element. The third line used the four JSON_HEX_* flags with JSON_UNESCAPED_UNICODE: those are the flags Js::from always adds before it wraps the result in JSON.parse('…').

view:cache compiles every view ahead of a request

A Blade template is read, compiled and stored in storage/framework/views/, in a PHP file named after an xxh128 hash of the template’s path. On the first render Blade compiles the file. On every later render Blade reads the mtime of the source: if the compiled file is newer than the source, the cached PHP is included; otherwise Blade compiles again. On a hot path that cost is already small, but a deploy sees a cold cache, so the first visitor to every page pays for its compile.

php artisan view:cache warms the cache by compiling every view at deploy time. php artisan view:clear empties the folder. The probe starts in a fresh project, so the folder is empty:

from session import run

# Run view:cache and view:clear and show how many compiled files land under storage/framework/views.
run(
    """
ls storage/framework/views/ | wc -l
php artisan view:cache
ls storage/framework/views/*.php 2>/dev/null | wc -l
php artisan view:clear
ls storage/framework/views/*.php 2>/dev/null | wc -l
""",
    app=True,
)

$ ls storage/framework/views/ | wc -l
       0
$ php artisan view:cache
   INFO  Blade templates cached successfully.
$ ls storage/framework/views/*.php 2>/dev/null | wc -l
      62
$ php artisan view:clear
   INFO  Compiled views cleared successfully.
$ ls storage/framework/views/*.php 2>/dev/null | wc -l
       0

The folder started with zero files. After view:cache the project held 62 compiled PHP files. Only one of them, welcome.blade.php, is in the skeleton’s resources/views; view:cache also compiles every view the framework registers: 9 pagination views, the notification email, 8 error pages with their 2 layouts and, because the project runs with APP_DEBUG=true, the 41 views of the debug error page. view:clear left the folder empty again.

Practise

Try these on your own Pathshala project:

1. Add a notice to the seeder whose title is <img src=x onerror="alert(1)">, visit the notices page, and view the source. The title must appear as text; nothing must run.
2. Add a link field to the notice form validated with url:https,http or starts_with:/ (two kinds the form accepts) and prove each case with a feature test that posts a dangerous value and asserts an error for link with assertSessionHasErrors (a request sent with postJson gets 422 instead).
3. Add a tiny bootstrap object with Js::from(['currentUser' => auth()->id(), 'csrfToken' => csrf_token()]) to the layout. Open DevTools, read the parsed object, and confirm nothing in it would break the <script> tag.
4. Run php artisan view:cache and look under storage/framework/views. Change one .blade.php file and reload the page: the stale compiled file is replaced.

Then work through the self-check.

Interview questions

Warm-up: what does Blade’s {{ }} do that Twig’s {{ }} does not?

The syntax looks the same, but the compilers differ. Blade’s {{ $value }} is one echo wrapped in e(), which runs htmlspecialchars with ENT_QUOTES on every value, and no block in a template turns that escaping off. Twig escapes by default too, but its autoescape setting can change per environment and per block, and it offers filters such as |raw or |e('js') that choose a context (HTML, JS, CSS, URL). Blade keeps one echo for text and a second one, {!! !!}, for raw HTML; context-specific encoding for a script tag is Js::from, and context-specific encoding for an attribute is still {{ }} plus server-side validation of what the attribute carries. Blade also compiles its own directives (@foreach, @auth, @error), while Twig has its own tag language, so a view’s shape differs even though the escape rule is the same.

Two longer questions follow:

Key takeaways

• Blade compiles {{ $value }} into <?php echo e($value); ?>, which calls htmlspecialchars with ENT_QUOTES, so the five HTML-special characters leave the page as character references, which browsers render back to text.
• {!! $value !!} is a raw sink and is acceptable only for HTML your own code produced from text your own code read, such as a sanitised Markdown document; a value a user typed never goes through it.
• Blade’s HTML escape fixes HTML, not an attribute whose values can be code: a javascript: URL in href still runs in the browser and a data: URL still carries its page, so validate URLs on the server with the url rule and a scheme allowlist.
• Js::from($value) encodes a value as JSON.parse('…') with every quote and angle bracket HEX-escaped and every slash escaped, so a payload with a </script> string does not close the surrounding tag, whatever flags you pass.
• php artisan view:cache compiles every view into storage/framework/views at deploy time, so no visitor pays the compile cost on a cold cache, and view:clear empties the folder on development.