Level 102
To leave out the guess work, please format what is code, and show some actual code. What is <foo>?
And I doubt forge sanitize anything..?
And inertia is a great tool for building spa's with vue/react
Feb 11, 2022
14
Level 2
Laravel API and input sanitize
Hello. I'm making an application with Laravel API and Vue.js. Do I need to sanitize user input in Laravel?
For example, should the user input
<foo>
be converted to
<foo>
and save in the database?
When you fetch the data stored as in Laravel Forge made with Laravel and Inertia.js, it is loaded as
<foo>
. Not
<foo>
I'm wondering which one is the best way to build an API for Vue or React.
Level 102
Thanks for the formatting. Where/how do you check the format? Be aware that your browser might make it pretty
Level 2
@Sinnbeck Thank you for reply. I applied the Sanitize middleware to the Laravel api. However, it is shown as
<foo>
in the view made with vue.
Level 102
@whamma are you using v-html="code" ?
Level 2
@Sinnbeck No. I ask that i should use html sanitize.
Level 102
@whamma I am unsure what you want. Remove all html before saving to database? Or just make sure it isn't parsed in vue?
Level 2
@Sinnbeck I just want to know whether or not to sanitize html when developing a normal laravel api project.
Level 102
@whamma well it depends on what you want. Vue will automatically ensure that any html etc is safe by not parsing it. But let's say you allow people to post some sort of text using a html editor like quill. Then you would want to make sure that the html you save in the database, does not contain script tags or similar
Level 2
@Sinnbeck So can I only sanitize the values entered in the html editor?
Level 102
@whamma well suppose you have a field called 'first_name`. You would never show this as html. So worst case you output an escaped html string as the name
And alot of sanitation is already happening as you of course validate all inputs
Level 2
@Sinnbeck In this case, I do not want the first_name field to be escaped. So I don't want to escape when saving it to the database. But I'm worried that if you do that, you'll be vulnerable to security.
Level 102
@whamma only if you output it unescaped (v-html or similar)
Both blade and vue will escape it automatically
Level 2
@Sinnbeck Thank u
Level 102
@whamma happy to help
Please or to participate in this conversation.