Level 35
Apr 15, 2020
7
Level 3
How do I prevent @ from escaping {{}} content in blade
It looks like @ is used to escape {{}} in blade templating, especially for using in Vue.
But I need to prevent that action.
I want to display username with @ symbol like this:
User: @{{$user->name}}
Expected: @mrkarma4ya
But it won't work. How do I make it work?
Level 2
you could try {!! '@'.$user->name !!}
Level 122
Never do what @lindie2669 suggests since it creates an XSS vulnerability
You could also use the html entity
@{{ $user->name }}
Level 3
Thanks, looks like that'll do.
Could you explain the xss vulnerability with @lindie2669's suggestion? Just trying to learn a bit.
Level 122
XSS is someone embedding unwanted scripts in user provided data
https://owasp.org/www-community/attacks/xss/
Suppose I could add <script> tags into my username. When another user sees a screen that includes a list of users (eg posts on this page), then that script tag could be running in the browser. So now the attacker can pretend to be another unsuspecting user. This could for instance allow someone to post comments as that user (or worse)
Laravel protects against XSS by escaping html tags when outputting strings IF you use the {{ }} blade tags.
On the otherhand, if you use {!! !!} then the content of the username field is echoed to the browser in its raw format with no escaping.
What is worse in this case is that {!! '@'.$user->name !!} is no different to {{ '@' . $user->name }} except that it exposes you to XSS attacks.
Level 3
Ah, I thought you meant the vulnerability was with putting the @ inside curly braces.
So doing {{'@'.$user->name}} should be safe, right?
Level 122
Yep. Nothing wrong with that.
Please or to participate in this conversation.